Operation and maintenance fault location method, device, equipment and storage medium based on large model

Abstract

The present application discloses a method, device, equipment and storage medium for locating operation and maintenance faults based on a large model, which relates to the field of computer technology, including: if a system fault is detected, the current system operation and maintenance data is collected in real time, and the current system operation and maintenance data is preprocessed to obtain the target preprocessed system operation and maintenance data; the data features corresponding to the target preprocessed system operation and maintenance data are extracted, and the data features are input into a preset large model to analyze the data features through the preset large model to obtain the fault analysis results; based on the fault tree analysis method, a fault tree corresponding to the fault analysis results is constructed to determine the cause of the system fault through the fault tree, and the cause of the fault is analyzed to complete the fault location. Thus, when a fault occurs, various information related to the fault can be quickly collected to quickly and accurately locate the root cause of the fault, thereby reducing the time for troubleshooting and improving the efficiency of fault handling.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a large model-based operation and maintenance fault locating method, device, equipment and storage medium. Background Art

[0002] In today's digital age, the scale and complexity of various information systems, network systems, and industrial control systems continue to grow. These systems are typically composed of a large number of hardware devices, software components, and network connections. Their operational status is affected by a variety of factors, such as hardware aging, software vulnerabilities, network fluctuations, and human error. Once a system failure occurs, it can lead to serious consequences such as business interruption, data loss, and reduced service quality, resulting in significant losses for enterprises and users.

[0003] Traditional operations management relies primarily on manual experience and simple monitoring tools. Operations personnel set fixed thresholds to monitor key system metrics, such as processor usage, memory utilization, and network traffic. When these metrics exceed the thresholds, the system issues an alarm to notify the operator. However, this approach suffers from issues such as insufficient fault prediction due to rigid threshold settings and difficulty locating the root cause of faults due to complex alarm information. Summary of the Invention

[0004] In view of this, the purpose of the present invention is to provide a large-scale model-based operation and maintenance fault location method, device, equipment, and storage medium. When a fault occurs, various information related to the fault can be quickly collected to quickly and accurately locate the root cause of the fault, thereby reducing troubleshooting time and improving fault handling efficiency. The specific solution is as follows:

[0005] In a first aspect, the present application discloses a method for locating operation and maintenance faults based on a large model, comprising:

[0006] If a system failure is detected, the current system operation and maintenance data is collected in real time, and the current system operation and maintenance data is preprocessed to obtain the target preprocessed system operation and maintenance data;

[0007] Extracting data features corresponding to the target pre-processed system operation and maintenance data, and inputting the data features into a preset large model, so as to analyze the data features through the preset large model to obtain a fault analysis result;

[0008] A fault tree corresponding to the fault analysis result is constructed based on a fault tree analysis method, so as to determine the fault cause of the system fault through the fault tree, and the fault cause is analyzed to complete the fault location.

[0009] Optionally, if a system fault is detected, current system operation and maintenance data is collected in real time, and the current system operation and maintenance data is preprocessed to obtain target preprocessed system operation and maintenance data, including:

[0010] If a system failure is detected, the current system operation and maintenance data of the local system is collected in real time, and the current system operation and maintenance data is labeled and classified to obtain the first pre-processed system operation and maintenance data;

[0011] Determining invalid data, duplicate data, and abnormal data in the first preprocessed system operation and maintenance data, and removing the invalid data, the duplicate data, and the abnormal data from the first preprocessed system operation and maintenance data to obtain second preprocessed system operation and maintenance data;

[0012] Normalization processing is performed on the second preprocessed system operation and maintenance data to convert the second preprocessed system operation and maintenance data into a preset data format to obtain target preprocessed system operation and maintenance data.

[0013] Optionally, the real-time collection of local current system operation and maintenance data of the system, and data labeling and data classification of the current system operation and maintenance data to obtain first pre-processed system operation and maintenance data, include:

[0014] Real-time collection of the system's current system logs, alarm information, performance indicator data, network traffic data, and hardware status data;

[0015] adding a timestamp to the system log, and sorting the system log based on the timestamp to obtain sorted system logs;

[0016] An alarm event chain is generated based on the alarm information, and the performance indicator data is classified based on the indicator type, the hardware status data is classified based on the component type, and the network traffic data is classified based on the traffic type.

[0017] Optionally, analyzing the data features using the preset large model to obtain a fault analysis result includes:

[0018] Extracting information from the data features through a preset large model, and matching the extracted target information with preset fault cases to determine a target fault case that matches the target information in the preset fault cases;

[0019] Constructing a fault causal relationship diagram based on the alarm event chain in the data feature;

[0020] Comparing the performance indicator data with historical performance indicator data to determine abnormal changes in the performance indicator;

[0021] Analyzing the network traffic data to determine abnormal network behavior in the network traffic data;

[0022] Comparing the hardware status data with a preset hardware data threshold to determine an abnormal hardware status in the hardware status data;

[0023] The fault causal relationship diagram, the abnormal change of the performance indicator, the abnormal network behavior, the abnormal hardware status and the target fault case are used as the fault analysis result.

[0024] Optionally, constructing a fault tree corresponding to the fault analysis result based on a fault tree analysis method to determine the cause of the system fault through the fault tree includes:

[0025] Identifying a top fault event, an intermediate fault event, and a bottom fault event corresponding to the system fault based on the fault analysis result, and constructing a fault tree corresponding to the fault analysis result based on the top fault event, the intermediate fault event, and the bottom fault event;

[0026] A target bottom fault event having the greatest probability of affecting the top fault event among the bottom fault events is determined through the fault tree, and the target bottom fault event is used as the fault cause of the system fault.

[0027] Optionally, analyzing the cause of the fault to locate the fault includes:

[0028] The fault cause is analyzed to determine the fault occurrence time, fault-occurring component, and fault abnormality data corresponding to the fault cause, so as to complete the fault location.

[0029] Optionally, the large model-based operation and maintenance fault location method further includes:

[0030] Build a fault prediction model based on the pre-trained model through an ensemble learning method;

[0031] Collecting current target system operation and maintenance data in real time based on a preset time interval, and inputting the target system operation and maintenance data into the fault prediction model, so as to perform system fault prediction in real time through the fault prediction model to obtain a real-time fault prediction result;

[0032] System parameters are adjusted based on the fault prediction results to prevent system faults.

[0033] In a second aspect, the present application discloses a large-scale model-based operation and maintenance fault location device, comprising:

[0034] A data preprocessing module is used to collect current system operation and maintenance data in real time if a system fault is detected, and preprocess the current system operation and maintenance data to obtain target preprocessed system operation and maintenance data;

[0035] a fault analysis module, configured to extract data features corresponding to the target pre-processed system operation and maintenance data, and input the data features into a preset large model, so as to analyze the data features through the preset large model and obtain a fault analysis result;

[0036] The fault location module is used to construct a fault tree corresponding to the fault analysis result based on the fault tree analysis method, so as to determine the fault cause of the system fault through the fault tree, and analyze the fault cause to complete the fault location.

[0037] In a third aspect, the present application discloses an electronic device, comprising:

[0038] Memory, used to store computer programs;

[0039] A processor is used to execute the computer program to implement the aforementioned large model-based operation and maintenance fault location method.

[0040] In a fourth aspect, the present application discloses a computer-readable storage medium for storing a computer program, wherein when the computer program is executed by a processor, it implements the aforementioned large model-based operation and maintenance fault location method.

[0041] In this application, if a system fault is detected, the current system operation and maintenance data is collected in real time, and the current system operation and maintenance data is preprocessed to obtain the target preprocessed system operation and maintenance data; the data features corresponding to the target preprocessed system operation and maintenance data are extracted, and the data features are input into a preset large model to analyze the data features through the preset large model to obtain a fault analysis result; a fault tree corresponding to the fault analysis result is constructed based on the fault tree analysis method to determine the fault cause of the system fault through the fault tree, and the fault cause is analyzed to complete the fault location. It can be seen that, through the method of this application, it is necessary to collect system operation and maintenance data in real time after the system fault is detected, and then preprocess the system operation and maintenance data and extract the operation and maintenance features of the preprocessed data. After the features are extracted, it is necessary to analyze the data features through the preset large model and construct a fault tree corresponding to the obtained analysis result to determine the cause of the system fault through the final obtained fault tree. In this way, when a fault occurs, various information related to the fault can be quickly collected to quickly and accurately locate the root cause of the fault, reduce the time for troubleshooting, improve the efficiency of fault handling, and ensure the rapid recovery and normal operation of the system. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are merely embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying any creative work.

[0043] Figure 1 This is a flow chart of a large model-based operation and maintenance fault location method disclosed in this application;

[0044] Figure 2 This is a timing diagram of an operation and maintenance fault location method based on a large model disclosed in this application;

[0045] Figure 3 This is a structural diagram of an operation and maintenance fault location device based on a large model disclosed in this application;

[0046] Figure 4 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0047] The following will clearly and completely describe the technical solutions in the embodiments of the present invention in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of the present invention.

[0048] Traditional operations and maintenance management methods rely primarily on manual experience and simple monitoring tools. For example, these methods manually set thresholds to monitor key system indicators and generate alerts. However, this approach suffers from issues such as insufficient fault prediction due to rigid threshold settings and difficulty locating the root cause of faults due to complex alert information.

[0049] In order to overcome the above technical problems, the present application discloses a large-model-based operation and maintenance fault location method, device, equipment and storage medium. When a fault occurs, it can quickly collect various information related to the fault and quickly and accurately locate the root cause of the fault, thereby reducing fault troubleshooting time and improving fault handling efficiency.

[0050] See also Figure 1 As shown, an embodiment of the present invention discloses a method for locating operation and maintenance faults based on a large model, comprising:

[0051] Step S11: If a system failure is detected, current system operation and maintenance data is collected in real time, and the current system operation and maintenance data is preprocessed to obtain target preprocessed system operation and maintenance data.

[0052] In this embodiment, Figure 2 As shown, if a system failure is detected, it is necessary to collect the current system operation and maintenance data in real time and perform corresponding preprocessing on the system operation and maintenance data. Specifically, if a system failure is detected, the current system operation and maintenance data of the local system is collected in real time, and the current system operation and maintenance data is labeled and classified to obtain the first preprocessed system operation and maintenance data, wherein it is necessary to collect the current system logs, alarm information, performance indicator data, network traffic data and hardware status data of the system in real time, such as server, application, database and other logs. After the log collection is completed, it is necessary to add a timestamp to the log and sort the system log based on the timestamp to obtain the sorted system log; the alarm information needs to be collected from the hardware , network, and application performance monitoring systems, and the alarm information needs to be integrated and classified, duplicates removed, and the alarm information correlated to form an alarm event chain; for performance indicator data, such as processor usage, memory occupancy, etc., the performance indicator data is classified according to the indicator type, and then the historical data and change trends are displayed in the form of charts; for hardware status data, the hardware status data needs to be classified according to the corresponding component type of the hardware, such as temperature, fan speed, power status, etc.; for traffic data, network traffic data needs to be obtained through a network traffic collection tool, and the network traffic data is classified according to the traffic type, and the traffic direction, size and data packet characteristics can be analyzed.

[0053] Furthermore, the first pre-processed system operation and maintenance data needs to be further processed. Specifically, invalid data, duplicate data, and abnormal data in the first pre-processed system operation and maintenance data need to be determined and removed from the first pre-processed system operation and maintenance data to obtain second pre-processed system operation and maintenance data. In this way, by removing invalid data, duplicate data, and abnormal data, noise interference in the data can be effectively reduced, thereby more accurately reflecting the data characteristics.

[0054] Next, the obtained second pre-processed system operation and maintenance data needs to be normalized to convert it into a preset data format, thereby obtaining the target pre-processed system operation and maintenance data. It should be noted that normalizing the data and converting it into a unified data format, namely JSON (JavaScript Object Notation), ensures data consistency and avoids analysis errors caused by data inconsistencies.

[0055] Step S12: extracting data features corresponding to the target pre-processed system operation and maintenance data, and inputting the data features into a preset large model, so as to analyze the data features through the preset large model to obtain a fault analysis result.

[0056] In this embodiment, Figure 2 As shown, it is necessary to extract features from the target pre-processed system operation and maintenance data, and analyze the extracted data features using multiple large models to obtain the corresponding fault analysis results. Specifically, it is necessary to extract information from the data features using a preset large model, and match the extracted target information with the preset fault cases to determine the target fault cases that match the target information in the preset fault cases. It should be noted that after obtaining the target pre-processed system operation and maintenance data, it is necessary to extract features from the data. Time domain features include the mean, variance, maximum, and median of performance indicators, as well as the frequency and time interval of specific events in the log; frequency domain features obtain data frequency components such as the main frequency and harmonics through Fourier transform, reflecting the periodicity and stability of system operation; trend features use time series analysis methods such as moving average and exponential smoothing to extract the upward, downward, or stable trends of performance indicators, and detect system performance anomalies in advance; text features are targeted at text data such as system logs. The extracted data features are then input into the preset large model. The large model determines which features are important for fault prediction based on the analysis of operation and maintenance domain knowledge and data to avoid feature redundancy affecting model performance. The large model will also match the fault cases in the operation and maintenance domain with the feature information to determine the corresponding target fault cases.

[0057] Furthermore, it is necessary to construct a fault causal relationship diagram based on the alarm event chain in the data characteristics to determine which alarms trigger other alarms and the root cause of the fault. It is also necessary to compare performance indicator data with historical performance indicator data to determine abnormal changes in performance indicators. The fault correlation can be determined based on the normal system and failure mode, and the process and cause that lead to abnormal performance indicators can be analyzed. Network traffic data can also be analyzed to determine abnormal network behavior in the network traffic data and determine whether there are fault factors such as network attacks, congestion, or abnormal network behavior of applications. Hardware status data can be compared with preset hardware data thresholds to determine abnormal hardware status in the hardware status data, such as determining the cause of excessive server temperature and its impact on other system components. Ultimately, the fault causal relationship diagram, abnormal changes in performance indicators, abnormal network behavior, abnormal hardware status, and target failure cases are used as fault analysis results.

[0058] Step S13: constructing a fault tree corresponding to the fault analysis result based on a fault tree analysis method, determining the cause of the system fault through the fault tree, and analyzing the cause of the fault to complete fault location.

[0059] In this embodiment, it is necessary to determine the cause of the system failure through the constructed fault tree and complete the corresponding fault location. Specifically, it is necessary to identify the top fault event, intermediate fault event, and bottom fault event corresponding to the system failure based on the fault analysis results, and construct a fault tree corresponding to the fault analysis results based on the top fault event, intermediate fault event, and bottom fault event. That is, based on the analysis results of the large model, the fault tree is constructed using the fault tree analysis method. Taking the fault phenomenon as the top event, according to the fault cause and causal relationship analyzed by the large model, the intermediate events and bottom events are gradually constructed. If the system service is unavailable, the intermediate event may be a network failure, server hardware failure, or application error. Further expansion of the network failure may be a bottom event such as network equipment failure, line interruption, or configuration error.

[0060] Next, the fault tree is used to identify the target bottom-level event with the highest probability of influencing the top-level event. This target bottom-level event is then used as the cause of the system failure. Specifically, fault tree analysis software is used to input parameters such as the fault tree structure, event logical relationships, and bottom-level event probability. The contribution of the bottom-level events to the top-level event is calculated, and the target bottom-level event with the highest probability of influencing the top-level event is identified. This target bottom-level event is then used as the cause of the system failure. Furthermore, the cause of the failure is analyzed to determine the corresponding fault occurrence time, faulty component, and abnormal fault data to complete fault location. It should be noted that after fault location is completed, a fault report can be generated, including the fault occurrence time, location, symptoms, root cause analysis process, fault tree structure, and recommended solutions. This report details the large-scale model analysis approach and fault tree construction process, providing operations and maintenance personnel with a clear basis for troubleshooting. Based on the root cause of the fault, specific action steps and recommendations are then provided. For example, if a network device port is faulty, recommendations include replacing the port, checking line connections, and reconfiguring parameters. Links to relevant technical documentation and reference materials are also provided. Finally, the fault analysis report is provided to operations and maintenance personnel. In this way, when a fault occurs, various information related to the fault can be quickly collected, including system logs, alarm information, performance indicators, etc., and with the help of the knowledge reasoning and semantic understanding capabilities of the large model, the root cause of the fault can be quickly and accurately located, reducing troubleshooting time, improving fault handling efficiency, and ensuring the rapid recovery and normal operation of the system.

[0061] It should be further explained that a fault prediction model can be constructed to predict the system through the prediction model. Specifically, a fault prediction model can be constructed based on a pre-trained model through a learning method. It should be explained that the pre-trained model can be selected according to needs, such as support vector machines (SVM), random forests (RF), long short-term memory networks (LSTM), convolutional neural networks (CNN) and other algorithms. The appropriate algorithm or combination can be selected according to the system characteristics and data features. In addition, after the fault prediction model is constructed, the current target system operation and maintenance data can be collected in real time based on a preset time interval, and the target system operation and maintenance data can be input into the fault prediction model to perform system fault prediction in real time through the fault prediction model to obtain real-time fault prediction results. Furthermore, the pre-set large model can combine fault prediction results with operation and maintenance cases and data to understand model performance under different parameter settings and provide optimal parameter recommendations for the fault prediction model. For example, it can recommend adjustments to the kernel function parameters and penalty factors of the SVM (Support Vector Machine) model. This also optimizes the model architecture. For example, based on system data complexity and fault patterns, it recommends adjusting the number of network layers and neurons in the LSTM or CNN model to enhance the model's predictive capabilities. This allows for real-time fault prediction, and parameter adjustments through the large model effectively improve the efficiency and accuracy of fault prediction.

[0062] In this embodiment, if a system fault is detected, the current system operation and maintenance data is collected in real time, and the current system operation and maintenance data is preprocessed to obtain the target preprocessed system operation and maintenance data; the data features corresponding to the target preprocessed system operation and maintenance data are extracted, and the data features are input into a preset large model, so that the data features are analyzed by the preset large model to obtain a fault analysis result; a fault tree corresponding to the fault analysis result is constructed based on the fault tree analysis method, so as to determine the fault cause of the system fault through the fault tree, and the fault cause is analyzed to complete the fault location. It can be seen that, through the method of the present application, it is necessary to collect the system operation and maintenance data in real time after the system fault is detected, and then preprocess the system operation and maintenance data, and extract the operation and maintenance features of the preprocessed data. After the features are extracted, it is necessary to analyze the data features through the preset large model, and construct a fault tree corresponding to the obtained analysis result, so as to determine the cause of the system fault through the fault tree finally obtained. This allows, on the one hand, rapid collection of relevant information when a fault occurs, enabling quick and accurate identification of the root cause, reducing troubleshooting time, improving troubleshooting efficiency, and ensuring rapid system recovery and normal operation. Furthermore, automated fault prediction and root cause location reduce reliance on manual O&M, lowering the workload and expertise required of O&M personnel, and thus reducing the company's O&M costs. This also improves system availability and stability, minimizing business losses caused by faults. Furthermore, by collecting and analyzing multi-source, heterogeneous data generated during system operation in real time and leveraging predictive models, potential faults in the system can be identified in advance, enabling accurate fault prediction and providing O&M personnel with ample time to prevent and address faults, reducing the probability and impact of faults.

[0063] See also Figure 3 As shown, an embodiment of the present invention discloses an operation and maintenance fault location device based on a large model, comprising:

[0064] The data preprocessing module 11 is used to collect the current system operation and maintenance data in real time if a system fault is detected, and preprocess the current system operation and maintenance data to obtain target preprocessed system operation and maintenance data;

[0065] A fault analysis module 12 is configured to extract data features corresponding to the target pre-processed system operation and maintenance data, and input the data features into a preset large model to analyze the data features using the preset large model to obtain a fault analysis result;

[0066] The fault location module 13 is configured to construct a fault tree corresponding to the fault analysis result based on a fault tree analysis method, determine the cause of the system fault through the fault tree, and analyze the cause of the fault to complete fault location.

[0067] In this embodiment, if a system fault is detected, the current system operation and maintenance data is collected in real time, and the current system operation and maintenance data is preprocessed to obtain the target preprocessed system operation and maintenance data; the data features corresponding to the target preprocessed system operation and maintenance data are extracted, and the data features are input into a preset large model to analyze the data features through the preset large model to obtain a fault analysis result; a fault tree corresponding to the fault analysis result is constructed based on the fault tree analysis method to determine the fault cause of the system fault through the fault tree, and the fault cause is analyzed to complete the fault location. It can be seen that, through the method of the present application, it is necessary to collect system operation and maintenance data in real time after the system fault is detected, and then preprocess the system operation and maintenance data and extract the operation and maintenance features of the preprocessed data. After the features are extracted, it is necessary to analyze the data features through the preset large model and construct a fault tree corresponding to the obtained analysis results to determine the cause of the system fault through the final obtained fault tree. In this way, when a fault occurs, various information related to the fault can be quickly collected to quickly and accurately locate the root cause of the fault, reduce the time for troubleshooting, improve the efficiency of fault handling, and ensure the rapid recovery and normal operation of the system.

[0068] In some embodiments, the data preprocessing module 11 may specifically include:

[0069] A first preprocessing submodule is configured to collect local current system operation and maintenance data in real time if a system failure is detected, and to perform data labeling and data classification on the current system operation and maintenance data to obtain first preprocessed system operation and maintenance data;

[0070] A second preprocessing submodule is used for processing data and removing the invalid data, the duplicate data and the abnormal data from the first preprocessed system operation and maintenance data to obtain second preprocessed system operation and maintenance data;

[0071] The data conversion submodule is used to perform normalization processing on the second preprocessed system operation and maintenance data to convert the second preprocessed system operation and maintenance data into a preset data format to obtain target preprocessed system operation and maintenance data.

[0072] In some embodiments, the first pre-processing submodule may specifically include:

[0073] Data collection unit, used to collect the system's current system logs, alarm information, performance indicator data, network traffic data and hardware status data in real time;

[0074] a log sorting unit, configured to add a timestamp to the system log and sort the system log based on the timestamp to obtain a sorted system log;

[0075] A data classification unit is used to generate an alarm event chain based on the alarm information, and classify the performance indicator data based on the indicator type, classify the hardware status data based on the component type, and classify the network traffic data based on the traffic type.

[0076] In some embodiments, the fault analysis module 12 may specifically include:

[0077] An information matching unit is used to extract information from the data features using a preset large model, and match the extracted target information with preset fault cases to determine a target fault case that matches the target information in the preset fault cases;

[0078] A relationship graph construction unit, configured to construct a fault causal relationship graph based on the alarm event chain in the data feature;

[0079] a first data comparison unit, configured to compare the performance indicator data with historical performance indicator data to determine abnormal changes in the performance indicator;

[0080] a second data comparison unit, used for the data analysis unit, for analyzing the network traffic data to determine abnormal network behavior present in the network traffic data;

[0081] a third data comparing unit, configured to compare the hardware status data with a preset hardware data threshold to determine an abnormal hardware status in the hardware status data;

[0082] A data definition unit is used to use the fault causal relationship diagram, the abnormal change of the performance indicator, the abnormal network behavior, the abnormal hardware status and the target fault case as the fault analysis result.

[0083] In some embodiments, the fault location module 13 may specifically include:

[0084] a fault tree construction unit, configured to identify a top fault event, an intermediate fault event, and a bottom fault event corresponding to the system fault based on the fault analysis result, and to construct a fault tree corresponding to the fault analysis result based on the top fault event, the intermediate fault event, and the bottom fault event;

[0085] The fault cause analysis unit is configured to determine, through the fault tree, a target bottom fault event among the bottom fault events that has the greatest probability of influencing the top fault event, and use the target bottom fault event as the fault cause of the system fault.

[0086] In some embodiments, the fault location module 13 may specifically include:

[0087] The fault location unit is used to analyze the cause of the fault to determine the fault occurrence time, fault-occurring component and fault abnormality data corresponding to the fault cause, so as to complete the fault location.

[0088] In some embodiments, the large model-based operation and maintenance fault location device may further include:

[0089] A model building unit, configured to build a fault prediction model based on a pre-trained model by using an ensemble learning method;

[0090] A real-time fault prediction unit, configured to collect current target system operation and maintenance data in real time based on a preset time interval, and input the target system operation and maintenance data into the fault prediction model, so as to perform system fault prediction in real time through the fault prediction model to obtain a real-time fault prediction result;

[0091] A parameter adjustment unit is used to adjust system parameters based on the fault prediction result to prevent system faults.

[0092] Furthermore, the embodiment of the present application also discloses an electronic device, Figure 4 This is a structural diagram of an electronic device 20 according to an exemplary embodiment. The content in the diagram should not be considered as any limitation to the scope of application of the present application.

[0093] Figure 4 This is a schematic diagram of the structure of an electronic device 20 provided in an embodiment of the present application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input / output interface 25, and a communication bus 26. The memory 22 is used to store a computer program, which is loaded and executed by the processor 21 to implement the relevant steps of the large model-based operation and maintenance fault location method disclosed in any of the aforementioned embodiments. Furthermore, the electronic device 20 in this embodiment may specifically be an electronic computer.

[0094] In this embodiment, the power supply 23 is used to provide operating voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device. The communication protocol it follows is any communication protocol that can be applied to the technical solution of this application and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world. Its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0095] In addition, the memory 22, as a carrier for resource storage, can be a read-only memory, random access memory, disk or CD, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0096] The operating system 221 is used to manage and control the hardware devices on the electronic device 20 and the computer program 222, and can be Windows Server, NetWare, Unix, Linux, etc. In addition to including computer programs capable of implementing the large model-based operation and maintenance fault location method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include computer programs capable of completing other specific tasks.

[0097] Furthermore, this application also discloses a computer-readable storage medium for storing a computer program; wherein, when executed by a processor, the computer program implements the aforementioned large-model-based operation and maintenance fault location method. The specific steps of this method can be referred to the corresponding content disclosed in the aforementioned embodiments and will not be repeated here.

[0098] The various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from the other embodiments. Reference can be made to the descriptions of the identical or similar parts between the various embodiments. For the devices disclosed in the embodiments, since they correspond to the methods disclosed in the embodiments, the descriptions are relatively simple, and the relevant parts can be referred to the descriptions of the methods.

[0099] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the above description has generally described the components and steps of each example according to their functions. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0100] The steps of the methods or algorithms described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in random access memory (RAM), internal memory, read-only memory (ROM), electrically programmable ROM, electrically erasable programmable ROM, registers, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0101] Finally, it should be noted that, in this document, relational terms such as first and second, etc., are used only to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any actual relationship or order between these entities or operations. Moreover, the terms "comprises," "comprising," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or device comprising a series of elements includes not only those elements, but also other elements not explicitly listed, or elements inherent to such process, method, article, or device. In the absence of further limitations, an element defined by the phrase "comprising a ..." does not exclude the presence of additional identical elements in the process, method, article, or device comprising the element.

[0102] The above is a detailed introduction to the technical solution provided by the present application. Specific examples are used herein to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for those skilled in the art, according to the ideas of the present application, there may be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A large-scale model-based operation and maintenance fault location method, characterized in that: include: If a system failure is detected, the current system operation and maintenance data is collected in real time, and the current system operation and maintenance data is preprocessed to obtain the target preprocessed system operation and maintenance data; Extracting data features corresponding to the target pre-processed system operation and maintenance data, and inputting the data features into a preset large model, so as to analyze the data features through the preset large model to obtain a fault analysis result; Constructing a fault tree corresponding to the fault analysis result based on a fault tree analysis method, determining the cause of the system fault through the fault tree, and analyzing the cause of the fault to complete fault location; The analyzing the data features by the preset large model to obtain the fault analysis results includes: Extracting information from the data features through a preset large model, and matching the extracted target information with preset fault cases to determine a target fault case that matches the target information in the preset fault cases; Constructing a fault causal relationship diagram based on the alarm event chain in the data feature; the alarm event chain is an event chain generated based on the alarm information; Compare performance indicator data with historical performance indicator data to identify abnormal changes in performance indicators; Analyzing network traffic data to determine abnormal network behavior in the network traffic data; Comparing the hardware status data with a preset hardware data threshold to determine an abnormal hardware status in the hardware status data; Taking the fault causal relationship diagram, the abnormal change of the performance indicator, the abnormal network behavior, the abnormal hardware status, and the target fault case as the fault analysis result; Among them, the alarm information, the performance indicator data, the network traffic data, and the hardware status data are data obtained by real-time collection of the system.

2. The operation and maintenance fault location method based on a large model according to claim 1 is characterized in that: If a system failure is detected, the current system operation and maintenance data is collected in real time, and the current system operation and maintenance data is preprocessed to obtain target preprocessed system operation and maintenance data, including: If a system failure is detected, the current system operation and maintenance data of the local system is collected in real time, and the current system operation and maintenance data is labeled and classified to obtain the first pre-processed system operation and maintenance data; Determining invalid data, duplicate data, and abnormal data in the first preprocessed system operation and maintenance data, and removing the invalid data, the duplicate data, and the abnormal data from the first preprocessed system operation and maintenance data to obtain second preprocessed system operation and maintenance data; Normalization processing is performed on the second preprocessed system operation and maintenance data to convert the second preprocessed system operation and maintenance data into a preset data format to obtain target preprocessed system operation and maintenance data.

3. The operation and maintenance fault location method based on a large model according to claim 2 is characterized in that: The real-time acquisition system locally acquires current system operation and maintenance data, and performs data labeling and data classification on the current system operation and maintenance data to obtain first pre-processed system operation and maintenance data, including: Real-time collection of the system's current system logs, alarm information, performance indicator data, network traffic data, and hardware status data; adding a timestamp to the system log, and sorting the system log based on the timestamp to obtain sorted system logs; An alarm event chain is generated based on the alarm information, and the performance indicator data is classified based on the indicator type, the hardware status data is classified based on the component type, and the network traffic data is classified based on the traffic type.

4. The operation and maintenance fault location method based on a large model according to claim 1 is characterized in that: The constructing a fault tree corresponding to the fault analysis result based on the fault tree analysis method to determine the cause of the system fault through the fault tree includes: Identifying a top fault event, an intermediate fault event, and a bottom fault event corresponding to the system fault based on the fault analysis result, and constructing a fault tree corresponding to the fault analysis result based on the top fault event, the intermediate fault event, and the bottom fault event; A target bottom fault event having the greatest probability of affecting the top fault event among the bottom fault events is determined through the fault tree, and the target bottom fault event is used as the fault cause of the system fault.

5. The operation and maintenance fault location method based on a large model according to claim 1 is characterized in that: Analyzing the cause of the fault to locate the fault includes: The fault cause is analyzed to determine the fault occurrence time, fault-occurring component, and fault abnormality data corresponding to the fault cause, so as to complete the fault location.

6. The operation and maintenance fault location method based on a large model according to claim 1 is characterized in that: Also includes: Build a fault prediction model based on the pre-trained model through an ensemble learning method; Collecting current target system operation and maintenance data in real time based on a preset time interval, and inputting the target system operation and maintenance data into the fault prediction model, so as to perform system fault prediction in real time through the fault prediction model to obtain a real-time fault prediction result; System parameters are adjusted based on the fault prediction results to prevent system faults.

7. A large-scale model-based operation and maintenance fault location device, characterized in that: include: A data preprocessing module is used to collect current system operation and maintenance data in real time if a system fault is detected, and preprocess the current system operation and maintenance data to obtain target preprocessed system operation and maintenance data; a fault analysis module, configured to extract data features corresponding to the target pre-processed system operation and maintenance data, and input the data features into a preset large model, so as to analyze the data features through the preset large model and obtain a fault analysis result; a fault location module, configured to construct a fault tree corresponding to the fault analysis result based on a fault tree analysis method, so as to determine the cause of the system fault through the fault tree, and to analyze the cause of the fault to complete the fault location; Wherein, the fault analysis module includes: An information matching unit is used to extract information from the data features using a preset large model, and match the extracted target information with preset fault cases to determine a target fault case that matches the target information in the preset fault cases; A relationship graph construction unit, configured to construct a fault causal relationship graph based on an alarm event chain in the data feature; the alarm event chain is an event chain generated based on the alarm information; a first data comparison unit, configured to compare the performance indicator data with historical performance indicator data to determine abnormal changes in the performance indicator; a second data comparison unit, used in the data analysis unit, for analyzing the network traffic data to determine abnormal network behavior present in the network traffic data; a third data comparing unit, configured to compare the hardware status data with a preset hardware data threshold to determine an abnormal hardware status in the hardware status data; a data definition unit, configured to use the fault causal relationship diagram, the abnormal change in the performance indicator, the abnormal network behavior, the abnormal hardware status, and the target fault case as a fault analysis result; Among them, the alarm information, the performance indicator data, the network traffic data, and the hardware status data are data obtained by real-time collection of the system.

8. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor is used to execute the computer program to implement the large model-based operation and maintenance fault location method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that Used to store a computer program, wherein when the computer program is executed by a processor, it implements the large model-based operation and maintenance fault location method according to any one of claims 1 to 6.

Images