Alarm text root cause analysis method, device and equipment

Abstract

The embodiment of the invention provides an alarm text root cause analysis method, device and equipment, which are used for solving the problems of low efficiency and high error rate of root cause analysis of an alarm text in the prior art. Classifying each alarm text to be processed, and determining each alarm category; aiming at each alarm category, searching a target root cause chain containing a target node corresponding to the alarm category in each stored root cause chain; and determining information carried in each root node of the target nodes in the target root cause chain as a target root cause corresponding to the alarm text of the alarm category. Based on the target root cause chain, the root cause corresponding to the alarm text of each alarm category can be quickly positioned, the alarm text processing efficiency is improved, especially in a complex system, abnormal components can be effectively recognized, the abnormal root cause can be effectively determined, the troubleshooting time is shortened, the alarm text processing efficiency and accuracy are improved, and the alarm text processing efficiency and accuracy are improved. And the stability and the reliability of the system are improved.

Description

Technical Field

[0001] This application relates to the technical field of data processing, and in particular, to a method, device, and equipment for root cause analysis of alarm texts. Background Art

[0002] With the rapid development of the supercomputing Internet technology, the complexity of large-scale IT infrastructure has been continuously increasing, and automated operation and maintenance systems have been widely applied. Systems such as modern supercomputing centers and cloud computing platforms carry out high-performance computing (HPC) tasks and provide large-scale distributed computing capabilities. These systems usually include tens of thousands of computing nodes, storage systems, and network devices.

[0003] In such a huge and complex environment, traditional alarm text processing methods are difficult to meet the requirements of the supercomputing Internet. Existing alarm management systems usually rely on simple filtering strategies and sorting mechanisms for alarm texts and are unable to conduct in-depth analysis of alarm texts. Related technologies such as alarm management systems like Nagios and Zabbix can collect a large number of alarm texts, but their root cause analysis functions are relatively limited. The main root cause analysis still relies on manual operations by operation and maintenance personnel, which results in low efficiency and easy errors in the root cause analysis of alarm texts. Moreover, since a large number of alarm texts are often received, operation and maintenance personnel need to conduct root cause analysis on each alarm text one by one. It is difficult for humans to quickly find the root cause of the problem, and the root cause analysis relying on humans is prone to mistakes. Summary of the Invention

[0004] This application provides a method, device, and equipment for root cause analysis of alarm texts to achieve root cause analysis of alarm texts and improve the efficiency and accuracy of root cause analysis.

[0005] In a first aspect, an embodiment of this application provides a method for root cause analysis of alarm texts. The method is applied to an electronic device and includes: Classify each alarm text to be processed to determine each alarm category; wherein, the alarm category carries an abnormal component identifier. For each alarm category, in each saved root cause chain, search for a target root cause chain that contains the target node corresponding to the alarm category; determine the information carried by each root node of the target node in the target root cause chain as the target root cause corresponding to the alarm text of the alarm category.

[0006] In the above manner, each alarm text to be processed is classified to determine each alarm category, and in combination with each pre-stored root cause chain, the target root cause chain corresponding to each alarm category is searched. Based on the target root cause chain, the root cause corresponding to the alarm text of each alarm category can be quickly located, improving the efficiency of alarm text processing. Especially in a complex system, abnormal components can be effectively identified and the root cause of the abnormality can be determined, thereby reducing the troubleshooting time, improving the efficiency and accuracy of alarm text processing, and enhancing the stability and reliability of the system.

[0007] In a possible implementation manner, before searching for the target root cause chain containing the target node corresponding to the alarm category in each of the stored root cause chains, the method further includes: According to the pre-configured association relationship between components, obtain other components that have an association relationship with the component carrying the target component identifier in the alarm category; If there are other alarm categories in each alarm category that carry other component identifiers of the other components, in each of the stored root cause chains, determine each candidate root cause chain that contains other nodes corresponding to the other alarm categories; The searching for the target root cause chain containing the target node corresponding to the alarm category in each of the stored root cause chains includes: In each of the candidate root cause chains, search for the target root cause chain that contains the target node corresponding to the alarm category.

[0008] In the above manner, information about other components associated with the target component is obtained from the CMDB asset relationship model, so that the target root cause chain is determined based on the other components and the target component together, further expanding the search scope of the root cause chain, enabling the finally determined target root cause chain to more comprehensively represent the relevance between alarm categories, avoiding omission of potential root causes, and thus improving the accuracy and comprehensiveness of alarm text analysis. Especially in the scenario of multi-component collaborative work, the root cause of complex faults can be more accurately identified.

[0009] In a possible implementation manner, each alarm text carries the component identifier of the abnormal component and the abnormal content; The classifying each alarm text to be processed to determine each alarm category includes: For each alarm text, determine the component identifier carried in the alarm text; according to the similarity between the alarm text and each preset alarm category containing the component identifier, determine the alarm category to which the alarm text belongs.

[0010] In the above manner, by combining the component identifiers and abnormal content carried in the alarm text with the preset alarm category similarity for classification, the alarm text can be more accurately classified into the corresponding alarm categories. This method improves the accuracy of alarm classification, reduces the possibility of misclassification, and subsequent root cause analysis can be carried out in units of alarm categories, improving the efficiency of root cause analysis.

[0011] In a possible implementation manner, before classifying each alarm text to be processed, the method further includes: Obtain each alarm data from each preset data source; Determine the original alarm text carried in each alarm data as the alarm text to be processed.

[0012] In the above manner, obtaining alarm data from multiple preset data sources and determining the original alarm text carried in each alarm data as the alarm text to be processed can effectively integrate alarm texts from different data sources, avoid data omission, ensure the comprehensiveness and timeliness of the obtained alarm texts, and thus improve the coverage and response speed of alarm text processing.

[0013] In a possible implementation manner, after obtaining each alarm data from each preset data source and before determining the original alarm text carried in each alarm data as the alarm text to be processed, the method further includes: Identify and delete duplicate alarm data.

[0014] In the above manner, by identifying and deleting duplicate alarm data, the processing burden of the electronic device on redundant alarm data is reduced, the efficiency of alarm text processing is effectively improved, repeated analysis of the same problem is avoided, and the resources of the electronic device are saved.

[0015] In a possible implementation manner, the alarm data also carries an identifier, and the identifier is used to identify the component that generates the alarm data and the corresponding alarm content; The identifying of duplicate alarm data includes: Identifying alarm data with the same carried identifier; and / or Identifying alarm data with the same carried original alarm text.

[0016] In the above manner, through two identification mechanisms of the identifier and the original alarm text, duplicate alarm data can be more accurately identified, the accuracy of duplicate alarm data identification is improved, and the flexibility of alarm data processing is enhanced. Especially in a large-scale system, the data processing volume can be effectively reduced, and the performance of alarm data processing is improved.

[0017] In a possible implementation, before determining the original alarm text carried in each alarm data as the alarm text, the method further includes: Clean the original alarm text according to a preset cleaning principle.

[0018] By the above method, identifying and deleting preset characters in the original alarm text can effectively clean the noise information in the original alarm text, improve the purity of the alarm text, reduce the interference of irrelevant information on the classification and root cause analysis of the alarm text, and thus improve the accuracy and efficiency of alarm text processing.

[0019] In a possible implementation, the process of constructing the root cause chain includes: Input each pre-configured historical alarm category and its corresponding historical root cause into the relationship reasoning model, so that the relationship reasoning model takes each historical alarm category and historical root cause as a node respectively, reasons the causal relationship between each node, and determines and outputs each root cause chain; [[ID=ll]] Wherein, the historical root cause is the alarm category and / or device status information.

[0020] By the above method, constructing the root cause chain through the relationship reasoning model can automatically reason the causal relationship between the alarm category and the preset cause text, and between the alarm categories, and generate the root cause chain, improve the efficiency of root cause chain construction, and enhance the intelligence level of root cause analysis. Especially in a complex system, it can quickly identify the root cause of the fault and improve the maintainability and stability of the system.

[0021] In a second aspect, an embodiment of the present application further provides an alarm text root cause analysis device, which has the function of implementing the behavior of the device in the method embodiment of the first aspect above. The beneficial effects can be seen in the description of the first aspect and will not be elaborated here. The alarm text root cause analysis device includes: A classification module, configured to classify each alarm text to be processed and determine each alarm category; wherein, the alarm category carries an abnormal component identifier; A root cause analysis module, configured to, for each alarm category, find a target root cause chain including a target node corresponding to the alarm category in each saved root cause chain; and determine the information carried in each root node of the target node in the target root cause chain as the target root cause corresponding to the alarm text of the alarm category.

[0022] In a third aspect, an embodiment of the present application further provides an electronic device, which at least includes a processor and a memory. The processor is configured to implement the steps of the alarm text root cause analysis method as described in any one of the above when executing a computer program stored in the memory. Description of the Drawings

[0023] To more clearly illustrate the technical solutions in the embodiments of the present application, the following will briefly introduce the drawings required for the description of the embodiments. Obviously, the drawings in the following description are only some embodiments of the present application. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0024] Figure 1 It is a schematic diagram of a process for analyzing the root cause of an alarm text provided by an embodiment of the present application; Figure 2 It is a schematic diagram of a root cause chain provided by an embodiment of the present application; Figure 3 It is a schematic diagram of the association relationship of components saved in the CMDB asset relationship model provided by an embodiment of the present application; Figure 4 It is a schematic diagram of a process for processing an alarm text provided by an embodiment of the present application; Figure 5 It is a schematic diagram of the structure of an alarm text root cause analysis device provided by an embodiment of the present application; Figure 6 It is a schematic diagram of the structure of an electronic device provided by an embodiment of the present application. Detailed implementation manners

[0025] To make the purpose and implementation manners of the present application clearer, the following will clearly and completely describe the exemplary implementation manners of the present application in combination with the drawings in the exemplary embodiments of the present application. Obviously, the described exemplary embodiments are only a part of the embodiments of the present application, rather than all of the embodiments.

[0026] It should be noted that the brief description of the terms in the present application is only for the convenience of understanding the subsequent described implementation manners, rather than intending to limit the implementation manners of the present application. Unless otherwise specified, these terms should be understood in their ordinary and general meanings.

[0027] The terms "first", "second", "third", etc. in the description, claims and drawings of the present application are used to distinguish similar or like objects or entities, and do not necessarily mean to limit a specific order or sequence, unless otherwise noted. It should be understood that such terms can be interchanged under appropriate circumstances.

[0028] The terms "comprising" and "having" and any variations thereof are intended to cover but not be exclusive of inclusion. For example, a product or device including a series of components does not necessarily have to be limited to all the clearly listed components, but may include other components not clearly listed or inherent to these products or devices.

[0029] The term "module" refers to any known or later-developed hardware, software, firmware, artificial intelligence, fuzzy logic, or a combination of hardware and / or software code that can perform functions related to that element.

[0030] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit them; although the present application has been described in detail with reference to the foregoing embodiments, those of ordinary skill in the art should understand that they can still modify the technical solutions recorded in the foregoing embodiments, or perform equivalent replacements on some or all of the technical features; and these modifications or replacements do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present application.

[0031] For the sake of convenience of explanation, the above description has been made in combination with specific embodiments. However, the above exemplary discussions are not intended to be exhaustive or to limit the embodiments to the specific forms disclosed above. According to the above teachings, various modifications and variations can be obtained. The selection and description of the above embodiments are for the purpose of better explaining the principles and practical applications, so that those skilled in the art can better use the embodiments and various different variations of the embodiments suitable for specific use considerations.

[0032] The embodiments of the present application provide a method, device, and equipment for analyzing the root cause of alarm texts. In this method, each alarm text to be processed is classified to determine each alarm category; wherein, the alarm category carries an abnormal component identifier; for each alarm category, in each saved root cause chain, a target root cause chain containing the target node corresponding to the alarm category is searched; the information carried in each root node of the target node in the target root cause chain is determined as the target root cause corresponding to the alarm text of the alarm category. In the embodiments of the present application, by classifying each alarm text to be processed, determining each alarm category, and combining each pre-saved root cause chain, searching for the target root cause chain corresponding to each alarm category, the root cause corresponding to the alarm text of each alarm category can be quickly located, improving the efficiency of alarm text processing. Especially in a complex system, it can effectively identify abnormal components and determine the root cause of the abnormality, thereby reducing the fault troubleshooting time, improving the efficiency and accuracy of alarm text processing, and enhancing the stability and reliability of the system.

[0033] Embodiment 1: Figure 1 It is a schematic diagram of an alarm text processing process provided by the embodiments of the present application, and this process includes: S101: Classify each alarm text to be processed to determine each alarm category; wherein, the alarm category carries an abnormal component identifier.

[0034] The alarm text processing method provided by the embodiments of the present application is applied to an electronic device, which may be a computer (Personal Computer, PC), a server, or the like.

[0035] The alarm management system in the related art does not have the ability to perform root cause analysis on alarm texts. For example, the related art uses an open-source alarm management system such as Nagios, which can monitor the health status of devices and applications, but cannot provide complex root cause analysis; Zabbix can also be used for alarm text processing, but Zabbix has a weak correlation analysis function for multiple alarm texts.

[0036] In practical applications, when internal components of an electronic device malfunction during operation, an alarm event will be triggered, generating alarm texts. However, for the same exception, multiple alarm texts may be generated. If manual root cause analysis is performed on each alarm text, it will consume a large amount of resources and the efficiency of root cause analysis will be extremely low.

[0037] In the embodiments of the present application, the electronic device performs root cause analysis on the alarm texts collected within a set time length, and the set time length can be set according to actual needs. For example, if quick exception handling is required, the set time length can be set shorter, such as five minutes, etc. If there is no requirement for the speed of exception handling, the set time length can be set longer, such as half an hour, one hour, etc.

[0038] Based on this, in the embodiments of the present application, after the electronic device obtains the alarm text, it can classify each obtained alarm text and perform root cause analysis by category. That is, for the alarm texts belonging to the same category, root cause analysis is performed once, shortening the time for root cause analysis and improving the efficiency of root cause analysis.

[0039] In a possible implementation manner, the electronic device clusters each alarm text to obtain each group. Since different components may have the same exception, for example, both the Central Processing Unit (CPU) and the Graphics Processing Unit (GPU) may have problems with overheating, in the embodiments of the present application, the alarm text carries the component identifier of the component with the exception and the specific fault content, and the electronic device divides the alarm texts with the same component identifier and similar fault content into one group.

[0040] For example, the electronic device first groups each alarm text according to the component identifier carried in each alarm text, and divides the alarm texts with the same carried component identifier into one group. Then, the electronic device performs clustering on the alarm texts in each group based on a preset clustering algorithm.

[0041] After clustering the alarm texts, the electronic device can call a large model or the like to analyze each group of alarm texts and determine the alarm category corresponding to each group of alarm texts. In addition, technicians can also determine the alarm category corresponding to each group of alarm texts based on professional experience.

[0042] In another possible implementation, multiple alarm categories are pre-configured in the electronic device. After the electronic device obtains each alarm text to be processed, the electronic device can sequentially determine to which of the pre-configured alarm categories each alarm text belongs according to a preset classification method.

[0043] Exemplarily, the electronic device can determine the alarm category to which each alarm text belongs through a trained classification model, where the categories included in the classification model are the pre-configured alarm categories. In addition, the electronic device can also determine the alarm category to which each alarm text belongs based on a similarity algorithm or the like.

[0044] S102: For each alarm category, in each saved root cause chain, search for the target root cause chain that contains the target node corresponding to the alarm category; determine the information carried by each root node of the target node in the target root cause chain as the target root cause corresponding to the alarm text of the alarm category.

[0045] In order to better perform root cause analysis on alarm texts, multiple root cause chains are pre-constructed in the electronic device. Each root cause chain contains at least two interconnected nodes, including at least one root node and at least one leaf node. Each node carries information. Generally, the information carried by the leaf node is the alarm category, and the information carried by the root node is generally device status information. The information carried by the root node may also be the alarm category. Among them, the device status information is, for example, too many application programs, etc.

[0046] It should be noted that the line segment connecting two nodes in each root cause chain has a direction, that is, the line segment connecting two nodes carries an arrow, and the arrow indicates the causal relationship. For example, the root cause chain is composed of the connection between node a and node b, where the arrow points from node a to node b, indicating that the information carried by node a causes the information carried by node b to occur. That is, node a is a cause for the occurrence of node b. Therefore, node a is the root node and node b is the leaf node. If node a is not connected to other nodes except for being connected to node b, it means that the information carried by node a is all or part of the root cause for the occurrence of the information carried by node b.

[0047] In the embodiments of the present application, whether each node is a leaf node or a root node is determined in the root cause chain. It can be determined whether a node is a root node according to whether there is a line segment pointing to the node. For example, if a node in the root cause chain has no line segment pointing to it, then it is determined that the node is a root node; if there is a line segment pointing to the node, then it is determined that the node is a leaf node. Among them, the alarm category can be carried either in the leaf node or in the root node.

[0048] Among them, in each root cause chain, a root node may be connected to only one leaf node, or may be connected to multiple leaf nodes. A root node can point to one or more leaf nodes, and a leaf node can also be pointed to by one or more root nodes. In addition, in each root cause chain, a leaf node may be connected to only one leaf node, or may be connected to multiple leaf nodes. A leaf node can point to one or more leaf nodes, and a leaf node can also be pointed to by one or more leaf nodes. For example, a leaf node is connected to one or more leaf nodes; or, a leaf node is connected to both one or more leaf nodes and one or more root nodes; or, a leaf node is connected to one or more root nodes.

[0049] It should be noted that in the embodiments of the present application, when a leaf node is connected to a root node, the direction of the connected line segment is from the root node to the leaf node.

[0050] Figure 2 is a schematic diagram of the root cause chain provided by the embodiments of the present application. As shown in Figure 2 this figure, the root cause chain contains six nodes, and the information carried by the six nodes is respectively abnormal fan connection, abnormal fan speed, too high server CPU temperature, abnormal application program loading, too high CPU load, and too many application programs. Among them, too many application programs is device status information. The root node is the node in the root cause chain that is not pointed to. The node carrying abnormal fan connection is the root node, and the node carrying abnormal fan connection is also the root node. The other nodes are leaf nodes.

[0051] In Figure 2 this figure, the root node carrying abnormal fan connection is connected to the leaf node carrying abnormal fan speed, that is, the root node is connected to the leaf node; the leaf node carrying abnormal fan speed is respectively connected to the root node carrying abnormal fan connection and the leaf node carrying too high server CPU temperature, that is, the leaf node is connected to both the root node and the leaf node; the leaf node carrying too high server CPU temperature is respectively connected to the leaf node carrying abnormal fan speed and the leaf node carrying too high CPU load, that is, the leaf node is connected to multiple leaf nodes.

[0052] In the embodiment of the present application, after the electronic device determines each alarm category corresponding to each alarm text, the electronic device performs root cause analysis on each alarm category based on the root cause chain to determine the root cause corresponding to each alarm category.

[0053] Specifically, for each alarm category, the electronic device obtains each saved root cause chain. The electronic device determines a target root cause chain that includes a target node whose carried information is the alarm category according to the nodes included in each root cause chain. The electronic device searches for the root node corresponding to the target node according to the connection relationship between each node in the target root cause chain, and determines the information carried in the root node as the root cause corresponding to the alarm category. The electronic device determines the root cause corresponding to the alarm category as the target root cause corresponding to each alarm text belonging to the alarm category.

[0054] In addition, in the embodiment of the present application, multiple nodes may be connected to each other in the root cause chain, but there is only one direction, pointing to a certain specific node among the multiple nodes, which indicates that the information carried in the other nodes except the specific node among the multiple nodes acts together to cause the abnormality of the alarm category carried in the specific node. If multiple nodes are connected to each other and there are multiple directions, pointing to some specific nodes among the multiple nodes, it means that the information carried in the other nodes except these specific nodes among the multiple nodes acts together to cause the abnormality of the alarm categories carried in these specific nodes.

[0055] Based on this, the target node in the target root cause chain may be directly or indirectly connected to one root node or multiple root nodes. If there are multiple root nodes in the target root cause chain, obtain the information on whether the saved root nodes in the target root cause chain are connected to each other, and determine the target root cause according to the connection information. For example, if the multiple root nodes are connected to each other, it means that the information carried in these root nodes acts together to cause the abnormality of the alarm category carried in the target node. Then obtain each information carried in each root node, and determine the collection of each information as the target root cause; if the root nodes are not connected to each other, it means that the information carried in any root node will cause the abnormality of the alarm category carried in the target node. Then obtain each information carried in each root node, and determine each information as the target root cause respectively; if some specific root nodes among the root nodes are connected to each other and the other root nodes are not connected to each other, it means that the information carried in these specific root nodes acts together to cause the abnormality of the alarm category carried in the target node, and the information carried in each other root node will also cause the abnormality of the alarm category carried in the target node. Then obtain each specific information carried in these specific root nodes, and determine the collection of each specific information as the target root cause, and obtain each other information carried in each other root node, and also determine each other information as the target root cause respectively.

[0056] In the embodiment of the present application, by classifying each alarm text to be processed, each alarm category is determined, and in combination with each pre-stored root cause chain, the target root cause chain corresponding to each alarm category is searched. Based on the target root cause chain, the root cause corresponding to the alarm text of each alarm category can be quickly located, improving the efficiency of alarm text processing. Especially in a complex system, abnormal components can be effectively identified and the root cause of the abnormality can be determined, thereby reducing the troubleshooting time, improving the efficiency and accuracy of alarm text processing, and enhancing the stability and reliability of the system.

[0057] Embodiment 2: In order to enable the determined target root cause chain to more comprehensively represent the correlation between alarm data, avoid missing potential root causes, and thus improve the accuracy and comprehensiveness of alarm analysis. On the basis of the above embodiment, in the embodiment of the present application, before searching for the target root cause chain containing the target node corresponding to this alarm category in each pre-stored root cause chain, the method further includes: According to the pre-configured association relationship between components, obtain other components that have an association relationship with the component carrying the target component identifier in this alarm category; If there are other alarm categories in each alarm category that carry the other component identifier of the other component, in each pre-stored root cause chain, determine each candidate root cause chain that contains the other node corresponding to the other alarm category; Searching for the target root cause chain containing the target node corresponding to this alarm category in each pre-stored root cause chain includes: In each of the candidate root cause chains, search for the target root cause chain that contains the target node corresponding to this alarm category.

[0058] There are many components in an electronic device, including but not limited to CPU, GPU, hard disk, fan, etc. There are also association relationships between these components. For example, when the CPU is running, the fan is also running, and the fan runs to cool the CPU. If the fan malfunctions and stops rotating, it will subsequently cause the CPU to overheat abnormally. Therefore, when one component malfunctions, it may cause other components to malfunction together. So when the electronic device searches for the target root cause chain, it can first determine whether there are malfunctions in other components that have an association relationship with the target component corresponding to the target alarm category. If there is a malfunction, it is considered that the malfunction of the other component may cause the target component to malfunction. Based on this, the electronic device can search in the found target root cause chain to see if there is a node with the other component identifier of the other component. If this node is included, the target root cause is determined based on this target root cause chain; otherwise, the target root cause chain is searched again.

[0059] Specifically, the electronic device obtains the pre-configured association relationships between components, and based on these association relationships between components, determines other components that have an association relationship with the target component whose target component identifier is carried in the alarm category, and determines the other component identifiers of these other components. The electronic device searches for other alarm categories in each of the already determined alarm categories, and determines whether there are other target alarm categories in the other alarm categories that carry the other component identifier. If other target alarm categories are found, then among each of the saved root cause chains, each candidate root cause chain that includes other nodes corresponding to the other alarm category is filtered out. After that, the electronic device determines, from each candidate root cause chain, a target root cause chain that includes the target node, such that the finally determined target root cause chain includes both the other nodes of the other components and the target node of the target component.

[0060] Among them, the association relationships between components can be saved in the asset relationship model of the Configuration Management Database (CMDB). The CMDB asset relationship model is a database model used to manage various types of assets (such as hardware, software, services) and their association relationships in an IT system. Components are managed by defining Configuration Items (CIs), that is, adding or deleting components and the association relationships between components through CIs, thereby helping operation and maintenance personnel perform root cause analysis of faults.

[0061] In the embodiments of the present application, by constructing and saving the association relationships between all assets (such as servers, network devices, software, etc.) through the CMDB asset relationship model, the electronic device can find other components that have a connection relationship with any component through the association relationships in the CMDB.

[0062] In the embodiments of the present application, the association relationships between components can be inclusion relationships, dependency relationships, subordination relationships, etc., which are not limited here. By way of example, Figure 3 is a schematic diagram of the association relationships of the components saved in the CMDB asset relationship model provided for the embodiments of the present application, as Figure 3 shown, the computer room includes a blade enclosure, the blade enclosure includes servers, application A depends on the servers, and the CPU component and the fan belong to the servers.

[0063] In the embodiments of the present application, information about other components associated with the target component is obtained from the CMDB asset relationship model, so as to determine the target root cause chain together with the other components and the target component, further expanding the search scope of the root cause chain, such that the finally determined target root cause chain can more comprehensively represent the association between alarm categories, avoid missing potential root causes, and thus improve the accuracy and comprehensiveness of alarm text analysis. Especially in scenarios where multiple components work together, the root cause of complex faults can be more accurately identified.

[0064] Example 3: To improve the accuracy of alarm classification and reduce the possibility of misclassification, based on the above embodiments, in the embodiments of the present application, each alarm text carries a component identifier of an abnormal component and abnormal content; Classify each alarm text to be processed, and determine that each alarm category includes: For each alarm text, determine the component identifier carried in the alarm text; according to the similarity between the alarm text and each preset alarm category including the component identifier, determine the alarm category to which the alarm text belongs.

[0065] In the embodiments of the present application, the electronic device can classify each alarm text to be processed based on text similarity.

[0066] Specifically, since the same abnormality may occur in different components, in order to avoid classifying the alarm text into the alarm category corresponding to other components when classifying the alarm text, for each alarm text, the electronic device will first determine the component identifier carried in the alarm text, and then determine each preset alarm category including the component identifier. The electronic device determines the similarity between the alarm text and each preset alarm category including the component identifier, and determines the alarm category corresponding to the maximum similarity as the alarm category to which the alarm text belongs.

[0067] In a possible implementation manner, the electronic device can perform similarity calculation based on natural language processing (NLP) technology, including but not limited to methods such as term frequency-inverse document frequency (TF-IDF), word to vector (Word2Vec), and bidirectional encoder representations from transformers (BERT).

[0068] Among them, TF-IDF generates vector representations for each alarm text and alarm category by calculating the frequency of words and the weights of words in all alarm texts and alarm categories. Subsequently, through cosine similarity, the similarity between the text vector corresponding to each alarm text and the vector corresponding to each alarm category is measured. This TF-IDF is suitable for simple text similarity analysis and has high efficiency, especially for short-text alarm texts. Word2Vec converts each word into a high-dimensional vector through training, so that similar words will cluster together, which can capture semantic-level similarities. BERT is a more advanced pre-trained model that can understand complex semantic relationships. Through BERT, in-depth understanding of alarm texts can be achieved, especially when the alarm texts are long.

[0069] In the embodiments of the present application, by combining the component identifier and abnormal content carried in the alarm text with the preset alarm category similarity for classification, the alarm text can be more accurately classified into the corresponding alarm category. This method improves the accuracy of alarm classification, reduces the possibility of misclassification, and subsequent root cause analysis can be carried out in units of alarm categories, improving the efficiency of root cause analysis.

[0070] Embodiment 4: In order to improve the comprehensiveness and timeliness of the obtained alarm text and avoid data omission, on the basis of the above embodiments, in the embodiments of the present application, before classifying each alarm text to be processed, the method further includes: Obtain each alarm data from each preset data source; Determine the original alarm text carried in each alarm data as the alarm text to be processed.

[0071] In the embodiments of the present application, the data source is used to collect alarm data, and the information carried by the alarm data can be an abnormality of a certain component inside the electronic device, or an abnormality of a certain device or base station, etc., which is not limited here.

[0072] The electronic device can obtain each alarm data from each preset data source; the preset data source includes but is not limited to monitoring tools, log management tools, and custom reporting application programming interfaces (Application Programming Interface, API), etc. Among them, the monitoring tools can be Zabbix, Nagios, Prometheus, etc., and the log management tools can be Elasticsearch, Logstash, Kibana, Splunk, etc.

[0073] In the embodiment of the present application, each alarm data carries an original alarm text, and the electronic device determines the original alarm text carried in each alarm data as each alarm text to be root cause analyzed.

[0074] In an embodiment of the present application, by obtaining alarm data from multiple preset data sources and determining the original alarm text carried in each alarm data as the alarm text to be processed, the alarm texts from different data sources can be effectively integrated, data omissions can be avoided, and the comprehensiveness and timeliness of the obtained alarm texts can be ensured, thereby improving the coverage and response speed of alarm text processing.

[0075] In order to implement root cause analysis of the alarm text and improve the efficiency and accuracy of the root cause analysis, based on the above embodiments, in an embodiment of the present application, before determining the original alarm text carried in each alarm data as the alarm text, the method further includes: The original alarm text is cleaned according to a preset cleaning principle.

[0076] In actual applications, the original alarm text may carry some redundant information, such as characters irrelevant to the alarm text. In order to provide high-quality input data for subsequent alarm analysis, in an embodiment of the present application, the electronic device will clean the original alarm text.

[0077] Specifically, the electronic device will also pre-save preset characters corresponding to the redundant information. The preset characters can be common Chinese words, such as "的" and "了", or English stop words, such as "and" and "is", or spaces, etc. The electronic device will recognize the preset characters carried in the original alarm text and delete the recognized preset characters from the original alarm text.

[0078] In addition, the electronic device can also identify and delete unnecessary information in the original alarm text, such as date, time, IP address, etc.

[0079] In an embodiment of the present application, in order to facilitate the subsequent classification of the alarm text, the electronic device can also split the sentences in the alarm text into independent words after cleaning the original alarm text, so that in the subsequent classification process of the alarm text, the text vector corresponding to the alarm text can be determined based on the segmented alarm text. For example, if the alarm text is in Chinese, the electronic device can use the Jieba word segmentation library to split the alarm text; if the alarm text is in English, the electronic device can use tools such as NLTK to split the alarm text.

[0080] In the embodiments of the present application, by identifying and deleting the preset characters in the original alarm text, the electronic device can effectively clean the noise information in the original alarm text, improve the purity of the alarm text, reduce the interference of irrelevant information on the classification and root cause analysis of the alarm text, and thus improve the accuracy and efficiency of alarm text processing.

[0081] Embodiment 5: In order to reduce the processing burden of the electronic device on redundant alarm data and save the resources of the electronic device, on the basis of the above embodiments, in the embodiments of the present application, after obtaining each alarm data from each preset data source and before determining the original alarm text carried in each alarm data as the alarm text to be processed, the method further includes: Identifying and deleting duplicate alarm data.

[0082] For a certain abnormality of a certain component, the abnormal component may generate multiple alarm data, and other components associated with the component may also generate alarm data regarding the abnormality of the component. In order to prevent the electronic device from processing duplicate alarm data multiple times and save the resources of the electronic device, in the embodiments of the present application, the electronic device will identify duplicate alarm data and delete the duplicate alarm data.

[0083] Exemplarily, the electronic device can adopt a text similarity algorithm to determine the similarity of the alarm texts carried in every two alarm data, and use this similarity as the similarity of the two alarm data. If the similarity corresponding to the two alarm data is higher than a preset threshold, it is determined that the two alarm data are duplicates.

[0084] In the embodiments of the present application, by identifying and deleting duplicate alarm data, the processing burden of the electronic device on redundant alarm data is reduced, the efficiency of alarm text processing is effectively improved, repeated analysis of the same problem is avoided, and the resources of the electronic device are saved.

[0085] In order to improve the accuracy of identifying duplicate alarm data and reduce the data processing volume, on the basis of the above embodiments, in the embodiments of the present application, the alarm data also carries an identifier, and the identifier is used to identify the component that generates the alarm data and the corresponding alarm content; The identifying of duplicate alarm data includes: Identifying alarm data with the same carried identifier; and / or Identifying alarm data with the same carried original alarm text.

[0086] In the embodiments of the present application, the alarm data also carries an identifier, which is used to identify the component that generates the alarm data and the corresponding alarm content. For example, if the identifier is C001, it means that the component that generates the alarm data is the CPU, and the alarm content is that the CPU temperature is too high; if the identifier is G001, it means that the component that generates the alarm data is the GPU, and the alarm content is that the GPU temperature is too high.

[0087] Among them, when an abnormal component generates multiple alarm data for an anomaly, the identifiers carried in the multiple alarm data are the same. Based on this, the electronic device can identify duplicate alarm data according to the identifiers carried in each alarm data.

[0088] Specifically, the electronic device identifies the alarm data with the same carried identifier, and determines the alarm data with the same identifier as duplicate alarm data. The electronic device retains one alarm data corresponding to the identifier and deletes other alarm data.

[0089] In addition, in the embodiments of the present application, the electronic device can also identify duplicate alarm data according to the original alarm text carried in each alarm data. Specifically, the electronic device reads the original alarm text carried in each alarm data, and compares every two original alarm texts. If there are two or more identical original alarm texts, the alarm data corresponding to the two or more identical original alarm texts is determined as duplicate alarm data. The electronic device retains one alarm data corresponding to the original alarm text and deletes other alarm data.

[0090] In the embodiments of the present application, through the two identification mechanisms of the identifier and the original alarm text, the electronic device can more accurately identify duplicate alarm data, improve the accuracy of duplicate alarm data identification, and also enhance the flexibility of alarm data processing. Especially in a large-scale system, it can effectively reduce the data processing volume and improve the performance of alarm data processing.

[0091] Embodiment 6: In order to implement root cause analysis of alarm data and improve the efficiency and accuracy of root cause analysis, on the basis of the above embodiments, in the embodiments of the present application, the process of constructing the root cause chain includes: Input each pre-configured historical alarm category and the corresponding historical root cause into the relationship reasoning model, so that the relationship reasoning model takes each historical alarm category and historical root cause as a node respectively, reasons the causal relationship between each node, and determines and outputs each root cause chain; Among them, the historical root cause is the alarm category and / or device status information.

[0092] In the embodiments of the present application, the electronic device can construct each root cause chain through a relationship reasoning model, so that subsequently, the causal relationships between the alarm category and the device status information, and between the alarm category and the alarm category can be analyzed according to each root cause chain, realizing the root cause analysis of the alarm text.

[0093] Specifically, in the embodiments of the present application, the electronic device inputs each pre-configured historical alarm category and the corresponding historical root cause into the relationship reasoning model. The relationship reasoning model takes each historical alarm category and historical root cause as a node respectively. Based on machine learning or deep learning techniques, the relationship reasoning model analyzes and infers the causal relationship between every two nodes, and determines and outputs the graph corresponding to each root cause chain. Among them, one historical alarm category may correspond to multiple historical root causes.

[0094] Exemplarily, the relationship reasoning model takes "CPU overload" and "process scheduling exception" as two independent nodes respectively. And through the analysis of multiple historical alarm categories and the corresponding historical root causes, the relationship reasoning model may find that "process scheduling exception" often leads to "CPU overload", and "CPU overload" may in turn cause "system response delay". Based on these reasoning results, the relationship reasoning model will generate a root cause chain: "process scheduling exception" → "CPU overload" → "system response delay", where "process scheduling exception" is the root node of the root cause chain, and "CPU overload" and "system response delay" are the leaf nodes of the root cause chain. The relationship reasoning model performs the above analysis for all historical alarm categories and historical root causes, and finally generates each root cause chain.

[0095] In the embodiments of the present application, when constructing the root cause chain, the relationship reasoning model includes but is not limited to the following several reasoning ideas. One is in the direction of seeking the cause, analyzing from the present to the past, that is, analyzing what alarm category or device status information may cause the current node; the other is in the direction of seeking the result, that is, analyzing what alarm category may be caused by the current node. At the same time, attention should also be paid to the logical relationship between the causal relationships. Generally, one result may be caused by multiple root causes, where it may be that multiple root causes act together to cause the result, or it may be that multiple root causes act independently to cause the result.

[0096] Based on this, in the embodiments of the present application, when the relationship reasoning model constructs a root cause chain, if there are multiple root nodes for a leaf node, the relationship reasoning model will analyze the logical relationship between the multiple root nodes according to the historical alarm categories and the corresponding historical root causes, and mark it in the root cause chain. The logical relationship includes but is not limited to the "and" relationship and the "or" relationship. Among them, the "and" relationship means that the information carried by the multiple root nodes acts together to cause the alarm category carried by the leaf node to appear; the "or" relationship means that the information carried by the multiple root nodes acts independently to cause the alarm category carried by the leaf node to appear.

[0097] For example, the CPU temperature being too high is generally caused by abnormal fan speed + too high CPU load, that is, the abnormal fan speed and the too high CPU load are in an "and" relationship; if the CPU load is too high, but the fan speed is normal, the CPU temperature will not be too high. That is, the abnormal fan speed and the too high CPU load are two reasons for the CPU temperature to be too high, and the two reasons act together to cause the CPU temperature to be too high.

[0098] Another example, Figure 2 is a schematic diagram of a root cause chain provided by the embodiments of the present application. As shown in Figure 2 this figure, if the relationship between "abnormal fan speed" and "too high CPU load" marked in the root cause chain is an "and" relationship, then according to this root cause chain, the root causes of "too high server CPU temperature" are determined to be "abnormal fan speed" and "too high CPU load".

[0099] In addition, each node in the root cause chain is not necessarily a historical alarm category, that is, the historical root cause input into the relationship reasoning model may be an alarm category or simply information.

[0100] In the embodiments of the present application, the historical alarm categories input into the relationship reasoning model can be obtained by clustering historical alarm data. Specifically, historical alarm data is collected from multiple data sources such as the device logs and monitoring systems of the electronic device, and the historical alarm text carried in each historical alarm data is obtained. The electronic device will also obtain the historical root cause corresponding to the saved historical alarm text.

[0101] To improve the accuracy of root cause chain construction, the electronic device can also clean and standardize the collected historical alarm text and historical root cause, remove noise information (such as irrelevant characters and duplicate data), and unify the format.

[0102] The electronic device clusters the cleaned historical alarm text to obtain multiple historical alarm categories.

[0103] For example, historical alarm categories may include "high CPU load", "insufficient memory", "disk I / O latency", etc., while historical root causes may include "abnormal process scheduling", "memory leak", "disk fragmentation", etc.

[0104] In addition, in the embodiments of this application, after the electronic device generates each root cause chain based on the inference relationship model, the electronic device can also verify and optimize each generated root cause chain, thereby making the root cause chain more accurate.

[0105] In a possible implementation, the electronic device can use the historical alarm data and the corresponding historical root cause as verification data. The electronic device determines the historical alarm category corresponding to the historical alarm data, and based on the generated root cause chain, determines the target root cause corresponding to the historical alarm category. If the electronic device determines that the target root cause is consistent with the historical root cause, the electronic device determines that the root cause chain passes the verification; if the electronic device determines that the target root cause is inconsistent with the historical root cause, the electronic device re - invokes the inference relationship model to optimize the root cause chain.

[0106] In another possible implementation, the electronic device can also perform anomaly simulation based on the root cause chain. The electronic device simulates the state corresponding to a certain root cause, and determines whether the root cause chain is accurate according to whether the anomaly corresponding to the root cause in the root cause chain appears.

[0107] For example, for the root cause chain "abnormal process scheduling" → "high CPU load" → "system response latency", the electronic device simulates the "abnormal process scheduling" event and observes whether the "high CPU load" event and the "system response latency" event actually occur. If it is found that the "high CPU load" event and the "system response latency" event do not occur, the electronic device re - invokes the inference relationship model to optimize the root cause chain.

[0108] In another possible implementation, the electronic device can also receive an input revision operation for the root cause chain and adjust the root cause chain according to the revision operation.

[0109] In the embodiments of this application, each generated root cause chain will be stored in the knowledge base for subsequent alarm text processing and analysis. To adapt to the dynamic changes of alarms, the knowledge base supports real - time update of the root cause chain. For example, when a new alarm category is added or a new causal relationship is discovered in the electronic device, the electronic device updates the root cause chain saved in the knowledge base.

[0110] In an embodiment of the present application, the electronic device constructs a root cause chain through a relational reasoning model, which can automatically infer the causal relationship between alarm categories and device status information, and between alarm categories and alarm categories, and generate a root cause chain, thereby improving the efficiency of root cause chain construction and enhancing the intelligence level of root cause analysis, especially in complex systems, which can quickly identify the root cause of the fault and improve the maintainability and stability of the system.

[0111] Example 7: Based on the above embodiments, Figure 4 A schematic diagram of an alarm text processing process provided in an embodiment of the present application is provided. Figure 4 , including the following steps: Step 1: Alarm collection: The electronic device obtains each alarm data from each preset data source, which includes but is not limited to log tools, Prometheus, and Zabbix.

[0112] Step 2: Alarm preprocessing. The electronic device deduplicates the alarm data and performs text cleaning and word segmentation on the original alarm text contained in the alarm data. Text cleaning involves removing unnecessary information from the alarm, such as date, time, IP address, and stop words. Word segmentation involves breaking sentences in the alarm text into independent words. Stop words include preset characters, such as common Chinese words like "的" and "了," or English stop words like "和" and "是."

[0113] Step 3: Calculate text similarity. For each warning text, the electronic device determines the component identifier contained in the warning text and the similarity between the warning text and each preset warning category containing the component identifier. The electronic device can use methods such as TF-IDF, Word2Vec, and BERT to determine similarity.

[0114] Step 4: Alarm clustering and classification: The electronic device clusters and classifies each alarm text based on its similarity to each alarm category, thereby reducing the workload of the electronic device.

[0115] Step 5: Root cause analysis: The electronic device performs root cause analysis on each alarm category based on each pre-configured root cause chain and the stored associations between components to obtain the root cause corresponding to each alarm category.

[0116] Step 5.1: According to each root cause chain saved in the preset root cause chain model, search for one or more root cause chains containing nodes corresponding to the alarm category.

[0117] Step 5.2: Based on the association relationships between components stored in the preset CMDB relationship model, find other components that have an association relationship with the target component corresponding to the alarm category.

[0118] Step 5.3: Search for the target root cause chain containing the other component in the one or more root cause chains.

[0119] Step 5.4: Determine the target root cause according to the target root cause chain.

[0120] Embodiment 8: Based on the same technical concept, on the basis of the above embodiments, the present application provides an alarm text root cause analysis device. Figure 5 As shown in the schematic structural diagram of an alarm text root cause analysis device provided by an embodiment of the present application, Figure 5 as shown, the device includes: A classification module 501, configured to classify each alarm text to be processed and determine each alarm category; wherein, the alarm category carries an abnormal component identifier. A root cause analysis module 502, configured to, for each alarm category, search for a target root cause chain containing the target node corresponding to the alarm category in each saved root cause chain; determine the information carried in each root node of the target node in the target root cause chain as the target root cause corresponding to the alarm text of the alarm category.

[0121] In a possible implementation manner, the root cause analysis module 502 is further configured to obtain other components associated with the component with the target component identifier carried in the alarm category according to the pre-configured association relationship between components; if there is another alarm category carrying the other component identifier of the other component in each alarm category, determine each candidate root cause chain containing the other node corresponding to the other alarm category in each saved root cause chain. The root cause analysis module 502 is specifically configured to search for a target root cause chain containing the target node corresponding to the alarm category in each candidate root cause chain.

[0122] In a possible implementation manner, each alarm text carries a component identifier of an abnormal component and abnormal content. The classification module 501 is specifically configured to, for each alarm text, determine the component identifier carried in the alarm text; determine the alarm category to which the alarm text belongs according to the similarity between the alarm text and each preset alarm category containing the component identifier.

[0123] In a possible implementation manner, the device further includes: A processing module 503, configured to obtain each alarm data from each preset data source; determine the original alarm text carried in each alarm data as the alarm text to be processed.

[0124] In a possible implementation, the processing module 503 is further configured to identify duplicate alarm data and delete it.

[0125] In a possible implementation, the alarm data further carries an identifier, which is used to identify the component that generates the alarm data and the corresponding alarm content; The processing module 503 is specifically configured to identify alarm data with the same carried identifier; and / or identify alarm data with the same carried original alarm text.

[0126] In a possible implementation, the processing module 503 is further configured to clean the original alarm text according to a preset cleaning principle.

[0127] In a possible implementation, the processing module 503 is further configured to input each pre-configured historical alarm category and the corresponding historical root cause into a relationship reasoning model, so that the relationship reasoning model takes each historical alarm category and historical root cause as a node respectively, reasons the causal relationship between each node, and determines and outputs each root cause chain; wherein, the historical root cause is the alarm category and / or device status information.

[0128] Example 9: Based on the same technical concept, the present application further provides an electronic device, Figure 6 which is a schematic structural diagram of an electronic device provided by an embodiment of the present application, as Figure 6 shown, including: a processor 601, a communication interface 602, a memory 603, and a communication bus 604, wherein the processor 601, the communication interface 602, and the memory 603 complete mutual communication through the communication bus 604; The memory 603 stores a computer program, and when the program is executed by the processor 601, the processor 601 is caused to execute the following steps: Classify each alarm text to be processed to determine each alarm category; wherein, the alarm category carries an abnormal component identifier; For each alarm category, in each saved root cause chain, search for a target root cause chain that contains the target node corresponding to the alarm category; determine the information carried in each root node of the target node in the target root cause chain as the target root cause corresponding to the alarm text of the alarm category.

[0129] In a possible implementation, the processor 601 is further configured to obtain other components that have an association relationship with the component with the target component identifier carried in the alarm category according to the pre-configured association relationship between components; If there are other alarm categories carrying the other component identifiers of the other components in each of the alarm categories, in each of the saved root cause chains, determine each candidate root cause chain that includes the other nodes corresponding to the other alarm categories. The finding of the target root cause chain including the target node corresponding to the alarm category in each of the saved root cause chains includes: In each of the candidate root cause chains, find the target root cause chain that includes the target node corresponding to the alarm category.

[0130] In a possible implementation manner, each of the alarm texts carries the component identifier of the abnormal component and the abnormal content; The processor 601 is specifically configured to, for each alarm text, determine the component identifier carried in the alarm text; and determine the alarm category to which the alarm text belongs according to the similarity between the alarm text and each of the preset alarm categories including the component identifier.

[0131] In a possible implementation manner, the processor 601 is further configured to obtain each alarm data from each preset data source; and determine the original alarm text carried in each of the alarm data as the alarm text to be processed.

[0132] In a possible implementation manner, the processor 601 is further configured to identify duplicate alarm data and delete it.

[0133] In a possible implementation manner, the alarm data further carries an identifier, and the identifier is used to identify the component generating the alarm data and the corresponding alarm content; The processor 601 is specifically configured to identify the alarm data with the same carried identifier; and / or identify the alarm data with the same carried original alarm text.

[0134] In a possible implementation manner, the processor 601 is further configured to clean the original alarm text according to a preset cleaning principle.

[0135] In a possible implementation manner, the processor 601 is further configured to input each pre-configured historical alarm category and the corresponding historical root cause into a relationship inference model, so that the relationship inference model takes each of the historical alarm categories and historical root causes as a node, infers the causal relationship between each node, and determines and outputs each root cause chain; Wherein, the historical root cause is the alarm category and / or the device status information.

[0136] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. This communication bus can be divided into an address bus, a data bus, a control bus, etc. For the sake of convenience in representation, only a thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0137] The communication interface 602 is used for communication between the above electronic device and other devices.

[0138] The memory may include a Random Access Memory (RAM), and may also include a Non-Volatile Memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located far from the aforementioned processor.

[0139] The above processor may be a general-purpose processor, including a central processing unit, a Network Processor (NP), etc.; it may also be a Digital Signal Processing (DSP), an application-specific integrated circuit, a field-programmable gate array, or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc.

[0140] Embodiment 9: Based on the same technical concept, an embodiment of the present application provides a computer-readable storage medium, in which a computer program executable by an electronic device is stored. When the program runs on the electronic device, it enables the electronic device to implement any of the above embodiments when executed.

[0141] The above computer-readable storage medium can be any available medium or data storage device accessible by the processor in the electronic device, including but not limited to magnetic memories such as floppy disks, hard disks, magnetic tapes, magneto-optical disks (MO), etc., optical memories such as CDs, DVDs, BDs, HVDs, etc., and semiconductor memories such as ROM, EPROM, EEPROM, non-volatile memories (NANDFLASH), solid-state drives (SSD), etc.

[0142] Based on the same inventive concept, an embodiment of the present application also provides a computer program product, which includes computer program code. When the computer program code runs on a computer, it causes the computer to execute any of the above embodiments. Since the principle of the above computer program product for solving problems is similar to the method for root cause analysis of alarm texts, the implementation of the above computer program product can refer to the implementation of the method, and the repeated parts will not be elaborated.

[0143] Those skilled in the art should understand that the embodiments of the present application can be provided as a method, a system, or a computer program product. Therefore, the present application can take the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware aspects. Moreover, the present application can take the form of a computer program product implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) that contain computer-usable program code.

[0144] The present application is described with reference to the flowcharts and / or block diagrams of the method, device (system), and computer program product according to the present application. It should be understood that each flow and / or block in the flowchart and / or block diagram, as well as the combination of flows and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to the processor of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable data processing devices to generate a machine, such that the instructions executed by the processor of the computer or other programmable data processing devices generate means for implementing the functions specified in Figure 1 one or more of the flows Figure 1 or a block or multiple blocks.

[0145] These computer program instructions can also be stored in a computer-readable memory that can direct a computer or other programmable data processing device to work in a specific manner, such that the instructions stored in the computer-readable memory generate a manufactured article including instruction means that implement the functions specified in Figure 1 one or more of the flows Figure 1 or a block or multiple blocks.

[0146] These computer program instructions can also be loaded onto a computer or other programmable data processing device, such that a series of operation steps are executed on the computer or other programmable device to generate a computer-implemented process. Thus, the instructions executed on the computer or other programmable device provide steps for implementing the functions specified in Figure 1 one or more of the flows Figure 1 or a block or multiple blocks.

[0147] Obviously, those skilled in the art can make various changes and modifications to this application without departing from the spirit and scope of this application. Thus, if these modifications and variations of this application fall within the scope of the claims of this application and their equivalent technologies, this application is also intended to include these modifications and variations.

Claims

1. A root cause analysis method for alarm text, characterized in that, The method includes: Classifying each alarm text to be processed to determine each alarm category; wherein, the alarm category carries an abnormal component identifier; For each alarm category, in each saved root cause chain, searching for a target root cause chain that contains a target node corresponding to the alarm category; determining the information carried by each root node of the target node in the target root cause chain as the target root cause corresponding to the alarm text of the alarm category.

2. The method according to claim 1, wherein Before searching for a target root cause chain that contains a target node corresponding to the alarm category in each saved root cause chain, the method further includes: According to the pre-configured association relationship between components, obtaining other components that have an association relationship with the component with the target component identifier carried in the alarm category; If there are other alarm categories in each alarm category that carry other component identifiers of the other components, then in each saved root cause chain, determining each candidate root cause chain that contains other nodes corresponding to the other alarm categories; Searching for a target root cause chain that contains a target node corresponding to the alarm category in each saved root cause chain includes: Searching for a target root cause chain that contains a target node corresponding to the alarm category in each candidate root cause chain.

3. The method according to claim 1, wherein Each alarm text carries a component identifier of an abnormal component and abnormal content; Classifying each alarm text to be processed to determine each alarm category includes: For each alarm text, determining the component identifier carried in the alarm text; determining the alarm category to which the alarm text belongs according to the similarity between the alarm text and each preset alarm category that contains the component identifier.

4. The method according to claim 1, wherein Before classifying each alarm text to be processed, the method further includes: Obtaining each alarm data from each preset data source; Determining the original alarm text carried in each alarm data as the alarm text to be processed.

5. The method according to claim 4, wherein After obtaining each alarm data from each preset data source and before determining the original alarm text carried in each alarm data as the alarm text to be processed, the method further includes: Identifying and deleting duplicate alarm data.

6. The method according to claim 5, characterized in that, The alarm data also carries an identifier, and the identifier is used to identify the component that generates the alarm data and the corresponding alarm content; Identifying duplicate alarm data includes: Identifying alarm data with the same carried identifier; and / or Identifying alarm data with the same carried original alarm text.

7. The method according to claim 4, characterized in that Before determining the original alarm text carried in each alarm data as the alarm text, the method further includes: Cleaning the original alarm text according to preset cleaning principles.

8. The method according to claim 1, wherein The process of constructing the root cause chain includes: Inputting each pre-configured historical alarm category and the corresponding historical root cause into a relationship inference model, so that the relationship inference model takes each historical alarm category and historical root cause as a node respectively, infers the causal relationship between each node, and determines and outputs each root cause chain; Wherein, the historical root cause is an alarm category and / or device status information.

9. An alarm text root cause analysis device, characterized in that, The device includes: A classification module, configured to classify each alarm text to be processed and determine each alarm category; wherein, the alarm category carries an abnormal component identifier. A root cause analysis module, configured to, for each alarm category, search for a target root cause chain containing a target node corresponding to the alarm category in each saved root cause chain; and determine the information carried by each root node of the target node in the target root cause chain as the target root cause corresponding to the alarm text of the alarm category.

10. An electronic device, characterized in that, The electronic device includes at least a processor and a memory, and the processor is configured to implement the steps of the alarm text root cause analysis method according to any one of claims 1-8 when executing a computer program stored in the memory.

Images