A fault diagnosis method for server

Abstract

The present invention relates to a fault diagnosis method for servers, which realizes efficient fault location and processing by constructing a multi-dimensional intelligent diagnosis system. A server virtual model is constructed at each node and a connection relationship is established. Various data are collected and mapped to the virtual model. The data is weighted and fused through correlation analysis, and fault features containing time and space correlations are extracted using a bidirectional long short-term memory network. The fault probability distribution is obtained with the help of a dynamic fault knowledge graph and graph neural network reasoning, and the fault assessment results are visualized in combination with the virtual model. Finally, the behavioral deviation is analyzed through a neural network and a processing strategy is generated. The system realizes real-time processing of multi-source data, intelligent extraction of fault features and dynamic deduction of fault propagation, effectively improving the accuracy, real-time and automation level of server fault diagnosis, and realizing predictive maintenance and intelligent decision-making of complex server systems.

Description

Technical Field

[0001] The present invention belongs to the technical field of server fault diagnosis, and in particular relates to a fault diagnosis method for a server. Background Art

[0002] In today's rapidly developing information technology landscape, servers, as the core carriers of data storage and processing, are crucial for enterprise operations and network services. However, server operating environments are complex, with frequent and diverse failures and their causes, and traditional fault diagnosis techniques have numerous limitations. Furthermore, with the widespread adoption of cloud computing and big data technologies, server clusters are expanding in size and their architectures are becoming increasingly complex, creating a complex web of issues, including hardware failures, software vulnerabilities, and network attacks.

[0003] Traditional server fault diagnosis relies on threshold-based judgments, but lacks the ability to comprehensively analyze multi-source data, making it difficult to accurately locate the root cause of complex faults. Diagnostic models that rely on manual experience are not only inefficient but also prone to missed and misjudgment. Furthermore, the dynamic evolution of server faults requires real-time and forward-looking diagnostic technology, but existing technologies often fail to effectively capture the early characteristics and propagation patterns of faults, resulting in delayed fault response and severe economic losses.

[0004] Therefore, there is an urgent need to improve the existing server fault diagnosis methods to solve the technical problems of lack of comprehensive analysis capabilities of multi-source data, difficulty in accurately locating the root causes of complex faults, low efficiency, and prone to missed judgments and misjudgments. Summary of the Invention

[0005] The purpose of the present invention is to provide a fault diagnosis method for a server to solve the technical problems of lack of comprehensive analysis capability of multi-source data, difficulty in accurately locating the root causes of complex faults, low efficiency, and prone to missed judgments and misjudgments.

[0006] In order to solve the above technical problems, the technical solutions adopted by the present invention are as follows:

[0007] A method for diagnosing a server fault includes the following steps:

[0008] S1: Build a server virtual model at each node, and establish a connection relationship between the virtual models based on the real-time connection relationship of each node;

[0009] S2: Collects server hardware underlying data, operating system kernel data, application running data, and network interaction traffic data, and pre-processes each data before mapping it to the corresponding virtual model in real time;

[0010] S3: Obtain historical fault diagnosis data and the correlation between the pre-processed data, and perform weighted fusion of the data based on the correlation to obtain fused data;

[0011] S4: constructing a bidirectional long short-term memory network model and inputting the fused data based on the time series, extracting fault features including time dependency and spatial correlation of the fused data through the bidirectional long short-term memory network, and converting them into fault feature vectors;

[0012] S5: Build a dynamic fault knowledge graph and update it in real time based on real-time fault data and empirical rules. Input the fault feature vector into the dynamic fault knowledge graph and obtain the fault probability distribution through graph neural network reasoning and calculation.

[0013] S6: Evaluate the fault type, fault level, fault location, and probability using a preset fault evaluation model according to the fault probability distribution and visualize them in a corresponding virtual model, and evaluate the fault-inducing result based on the connection relationship;

[0014] S7: Analyze the multi-dimensional behavioral deviations of the virtual model in real time through neural networks, generate and execute processing strategies based on the behavioral deviations and fault assessment results.

[0015] Preferably, the specific process of constructing the server virtual model at each node in step S1 is as follows:

[0016] S11: Obtain point cloud data of the server's shell and internal specified components, model the standardized components using a parametric model library, and construct a three-dimensional model of the server based on the point cloud data and the standardized component modeling;

[0017] S12: performing equivalent circuit modeling in the three-dimensional model, the equivalent circuit modeling including constructing a power factor correction model, a DC-DC conversion model, and a filter circuit module in the three-dimensional model;

[0018] S13: Constructing a three-dimensional thermal resistance network based on the heat conduction equation to establish a CPU / GPU thermal model in the three-dimensional model, wherein the nodes of the three-dimensional thermal resistance network correspond to the chip core, package, and heat sink components;

[0019] S14: Establish a virtual mechanical hard disk to simulate the vibration characteristics and power consumption curve of the spindle motor, magnetic head arm, and disk, and establish a temperature-performance-life correlation model for the flash memory chip and controller to achieve the establishment of a storage system model in the three-dimensional model.

[0020] Preferably, the specific process of step S2 of pre-processing each data and mapping it to the corresponding virtual model in real time is as follows:

[0021] S21: Unify the data into a specified format, create a time series data set in ascending time order, identify abnormal data in the time series data set, and delete or replace the abnormal data;

[0022] S22: Set a sliding window of a specified size, calculate the mean and standard deviation of the specified data in the sliding window within the specified time, perform Fourier transform on the specified data, and extract the data values ​​within the specified interval;

[0023] S23: Establish a hierarchical transmission strategy to divide the time series dataset into different data subsets, including real-time control datasets, log datasets, and file-based datasets. The real-time control dataset is transmitted via MQTT, the log dataset is transmitted asynchronously via Kafka, and the file-based dataset is transmitted encrypted via FTP / SFTP.

[0024] S24: Establish a hierarchical mapping model and set a structural mapping relationship between physical data and virtual models, directly map the real-time control data set and the file-type data set, and map the log data set after filtering.

[0025] Preferably, the specific process of filtering and mapping the log data set in step S24 is as follows:

[0026] S241: Filter invalid logs using regular expressions, predict normal log patterns using a preset machine learning model, filter outliers, and define log semantic rules based on domain knowledge to remove redundant information.

[0027] S242: Extract key events, impact scope, and timestamps from the filtered logs to generate an event chain;

[0028] S243: Map the event chain to the log node of the virtual model, store it in time series, and associate it with the state change of the virtual model;

[0029] S244: Associate the log event with the specified data of the virtual model to form a complete fault tracing chain.

[0030] Preferably, in step S3, the correlation between each item of data after preprocessing is obtained, and the specific process of weighted fusion of each item of data based on the correlation to obtain fused data is as follows:

[0031] S31: Divide the preprocessed data into different data blocks, filter the specified features in each data block, and construct a feature set for each data block;

[0032] S32: Construct feature combinations based on the feature set, distribute the feature combinations to different computing nodes, each node processes several feature pairs, and calculates the correlation of all feature combinations in parallel to generate a structured correlation matrix;

[0033] S33: incrementally updating the association matrix using a sliding window, and performing standardization on the association matrix.

[0034] Preferably, the specific process of calculating the association degrees of all feature combinations in parallel in step S32 is as follows:

[0035] S321: Let the feature combination be ( X i , X j ) ,calculate X i and X j The edge frequency and joint frequency of are calculated as follows:

[0036] ;

[0037] in, count (·) represents the number of conditions that are met in the data set, Representation characteristics X i In the value x i k Appear on, i, j, k, l For different serial numbers, N is the global sample number;

[0038] X i Pick x i k and X j Pick x i l The formula for calculating the joint probability is as follows:

[0039] ;

[0040] in, X j = x i l Representation characteristics X j In the value x i l Appear on, N is the global sample number;

[0041] S322: Calculate local mutual information and global mutual information:

[0042] The local mutual information calculation formula is as follows:

[0043] I local ( X i ; Y j )=∑ x,y ( count ( x , y ) / N block )log[ count ( x , y )· N block / [ count ( x )· count ( y )];

[0044] x and y For different feature sets, X i Feature Set x The characteristics of N block is the number of block samples;

[0045] The global mutual information calculation formula is as follows:

[0046] I ( X i ; Y j )=∑ x,y ( count ( x , y ) / N )log[ count ( x , y )· N / [ count ( x )· count ( y )];

[0047] N is the global sample number.

[0048] Preferably, the bidirectional long short-term memory network is provided with dual input channels, one input channel is connected to the forward LSTM layer, and the other input channel is connected to the reverse LSTM layer. The output ends of the forward LSTM layer and the reverse LSTM layer are both connected to the merging layer, the merging layer is connected to the fully connected layer, and the fully connected layer is connected to the output layer.

[0049] Preferably, in step S4, the specific process of extracting the fault features including time dependency and spatial correlation of the fused data through the bidirectional long short-term memory network and converting them into fault feature vectors is as follows:

[0050] S41: The fused data is input into the forward LSTM layer and the reverse LSTM layer through the dual input channels respectively. The forward LSTM layer t =0 to t =T processes the fused data to capture historical features; the reverse LSTM layer t =T to t =0 process fused data to capture future features;

[0051] S42: Learning the spatial relationship of features through the weight matrix between the forward LSTM layer and the backward LSTM layer;

[0052] S43: Extract the hidden state of the last time step: , h t is the merged hidden state vector, which is used to extract the global features of time series data. and The forward LSTM layer and the reverse LSTM layer are respectively t The hidden state of

[0053] S44: Mapped to a fixed-dimensional fault feature vector through a fully connected layer: v = W·h t +b ,in, W is the weight matrix, b is the bias term.

[0054] Preferably, the specific process of step S5 is as follows:

[0055] S51: Define entities including equipment components, fault types, fault symptoms, maintenance measures, and association rules, as well as their relationships and key attributes;

[0056] S52: Use real-time fault data to train an incremental learning model, predict new fault associations, and add them to the graph after filtering through thresholds;

[0057] S53: Perform dimension reduction and normalization on the fault feature vector, and calculate the embedding vector of the fault feature vector and the fault type node in the knowledge graph e i Cosine similarity of:

[0058] ;

[0059] S54: Building an attention modelf ( h t , e i ), output the weight of the feature for each entity and generate the soft mapping probability:

[0060] ;

[0061] S55: The fault node mapped by the fault feature vector is used as the seed node through the input layer of the graph neural network to initialize the failure probability of the seed node p i =1, other nodes p j =0, the node transmits the fault impact message to the neighbor, the weight is determined by the confidence of the edge, and the probability distribution is output by the output layer after probability aggregation.

[0062] Preferably, the specific process of step S7 is as follows:

[0063] S71: Real-time acquisition of multi-source data from virtual models, including physical dimensions: sensor data such as temperature, pressure, vibration frequency, current and voltage; logical dimensions: model state transition probability, algorithm execution efficiency, parameter convergence, etc.; spatial dimensions: topological structure associated with device locations, signal transmission delay, spatial coupling effects, etc.

[0064] S72: Establish a normal behavior baseline: Define the normal range through unsupervised learning and calculate deviation indicators: Absolute deviation: |Current value - Baseline value|; Dynamic deviation rate: (Current value - Baseline value) / Baseline value × 100%; Spatiotemporal correlation deviation: Combine device location and signal propagation path to calculate the deviation propagation coefficient in the spatial dimension;

[0065] S73: Maps behavioral deviation data to initial amplitudes, encodes real-number features into probability amplitudes through embedding, captures the correlation of multi-dimensional deviations, simulates the nonlinear coupling effects of complex faults, and sets up parameterized circuits. Optimizes circuit parameters using variational algorithms to adapt to dynamic changes in real-time data.

[0066] S74: Map the correlation between the probability amplitude and the multi-dimensional deviation into a priority score of the processing strategy, and select the optimal strategy in combination with the fault assessment result.

[0067] The beneficial effects of the present invention include:

[0068] The fault diagnosis method for servers provided by the present invention realizes efficient fault location and processing by constructing a multi-dimensional intelligent diagnosis system. A server virtual model is constructed at each node and a connection relationship is established. Various data are collected and mapped to the virtual model. The data is weighted and fused through correlation analysis, and fault features containing time and space correlations are extracted using a bidirectional long-short-term memory network. The fault probability distribution is obtained with the help of a dynamic fault knowledge graph and graph neural network reasoning, and the fault assessment results are visualized in combination with the virtual model. Finally, the behavioral deviation is analyzed through a neural network and a processing strategy is generated. Real-time processing of multi-source data, intelligent extraction of fault features, and dynamic deduction of fault propagation are achieved, effectively improving the accuracy, real-time nature, and automation level of server fault diagnosis, and realizing predictive maintenance and intelligent decision-making for complex server systems.

[0069] First, by collecting data from the hardware bottom layer, system kernel, applications, and network traffic, a monitoring system covering the entire server stack is built to avoid diagnostic blind spots caused by single-dimensional data. Based on correlation analysis, multi-source data is weighted and integrated to highlight key features and suppress noise interference, thereby effectively improving the accuracy of fault identification.

[0070] Secondly, by simultaneously processing time series data through forward and reverse LSTM layers, the historical trends before the fault and the future patterns after the fault are captured synchronously. The fault probability distribution is deduced through the dynamic knowledge graph combined with the graph neural network, effectively reducing the fault propagation prediction error.

[0071] Finally, by integrating the fault type, level, and propagation probability into the virtual model, operation and maintenance personnel can quickly locate key fault nodes through an interactive interface, thereby effectively improving decision-making efficiency. The knowledge graph is dynamically updated based on real-time fault data and empirical rules, continuously enhancing the fault diagnosis capabilities of new hardware. BRIEF DESCRIPTION OF THE DRAWINGS

[0072] Figure 1 The figure is a flow chart of a fault diagnosis method for a server according to the present invention.

[0073] Figure 2 Schematic diagram of the architecture of the bidirectional long short-term memory network of the present invention. DETAILED DESCRIPTION

[0074] The following is combined with Figures 1 - 2 The present invention is described in further detail:

[0075] Example 1

[0076] See attached Figure 1 As shown, a fault diagnosis method for a server includes the following steps:

[0077] S1: Build a server virtual model and a three-dimensional model at each node, perform equivalent circuit modeling, thermal modeling, and virtual mechanical hard disk modeling in the three-dimensional model, and establish a connection relationship between each virtual model based on the real-time connection relationship of each node.

[0078] S2: Collect the server's underlying hardware data, operating system kernel data, application running data, and network interaction traffic data, pre-process each data item, and map it to the corresponding virtual model in real time. The underlying hardware data includes basic hardware component information, hardware operating status data, and performance monitoring data. The operating system kernel data includes process and thread data, memory management data, storage and file system data, and system scheduling and security data. The application running data includes basic program running data, business logic data, performance and exception data. The network interaction traffic data includes network interface and protocol data, traffic performance and security data, and connection and session data.

[0079] S3: Obtain historical fault diagnosis data and the correlation between the pre-processed data, and perform weighted fusion on the data based on the correlation to obtain fused data.

[0080] S4: Construct a bidirectional long short-term memory network model and input the fused data based on the time series, extract the fault features of the fused data including time dependency and spatial correlation through the bidirectional long short-term memory network, and convert them into fault feature vectors. Figure 2 The bidirectional long short-term memory network is provided with dual input channels, one input channel is connected to the forward LSTM layer, and the other input channel is connected to the reverse LSTM layer. The output ends of the forward LSTM layer and the reverse LSTM layer are both connected to the merging layer, the merging layer is connected to the fully connected layer, and the fully connected layer is connected to the output layer.

[0081] S5: Build a dynamic fault knowledge graph and update it in real time based on real-time fault data and empirical rules. Input the fault feature vector into the dynamic fault knowledge graph and obtain the fault probability distribution through graph neural network reasoning and calculation.

[0082] S6: Evaluate the fault type, fault level, fault location, and probability using a preset fault evaluation model according to the fault probability distribution and visualize them in a corresponding virtual model, and evaluate the fault-inducing result based on the connection relationship;

[0083] S7: Analyze the multi-dimensional behavioral deviations of the virtual model in real time through neural networks, generate and execute processing strategies based on the behavioral deviations and fault assessment results.

[0084] In this embodiment, the specific process of constructing a server virtual model at each node in step S1 is as follows:

[0085] S11: Obtain point cloud data of the server's shell and internal specified components, model the standardized components using a parametric model library, and construct a three-dimensional model of the server based on the point cloud data and the standardized component modeling;

[0086] S12: performing equivalent circuit modeling in the three-dimensional model, the equivalent circuit modeling including constructing a power factor correction model, a DC-DC conversion model, and a filter circuit module in the three-dimensional model;

[0087] S13: Constructing a three-dimensional thermal resistance network based on the heat conduction equation to establish a CPU / GPU thermal model in the three-dimensional model, wherein the nodes of the three-dimensional thermal resistance network correspond to the chip core, package, and heat sink components;

[0088] S14: Establish a virtual mechanical hard disk to simulate the vibration characteristics and power consumption curve of the spindle motor, magnetic head arm, and disk, and establish a temperature-performance-life correlation model for the flash memory chip and controller to achieve the establishment of a storage system model in the three-dimensional model.

[0089] This paper uses a distributed storage and computing cluster deployed in a cloud computing data center of an internet company, comprising thousands of servers. A scanner is used to perform layered scans of the server casing and internal components to obtain point cloud data. For casing scanning, the chassis surface is scanned at a specified point spacing, focusing on capturing the geometric features of vents and heat sinks. After disassembling the server, non-standard components such as the CPU heat sink and hard drive tray are scanned with a 360° scanning angle and a point cloud density of 10 points / mm. Noise is removed using designated software, and basic geometry such as planes and cylinders is fitted using the RANSAC algorithm. Based on the measured parameters of the server power supply, a totem pole PFC circuit is constructed, including the main inductor, equivalent series resistance, switch, on-resistance, and control IC. The PFC circuit model is encapsulated in a recognizable VTK format and localized to the three-dimensional spatial coordinates of the power module. Thermal resistance nodes, their corresponding components, and thermal resistance parameters are defined, and the heat conduction equation is set and solved.

[0090] By combining point cloud scanning with parametric modeling, a 3D geometric model of the server was constructed, embedding an equivalent circuit, thermal resistance network, and storage multiphysics model. The model's accuracy meets fault diagnosis requirements, providing a quantitative basis for cooling optimization, hardware selection, and fault prediction in cloud computing data centers. Future work will integrate real-time sensor data to dynamically update the server virtual model, improving the real-time and accuracy of fault diagnosis.

[0091] Example 2

[0092] Based on Example 1, the specific process of step S2 for pre-processing various data and mapping them to the corresponding virtual model in real time is as follows:

[0093] S21: Unify all data into a specified format, perform timestamp calibration, synchronize all data to UTC via NTP, establish a time series data set for each data in ascending time order, identify abnormal data in the time series data set, and delete or replace the abnormal data. For continuous data, the IQR method is used to calculate the first quartile Q1 and the third quartile Q3. The abnormal threshold is: lower limit = Q1-1.5×IQR, upper limit = Q3+1.5×IQR. For the statistical frequency distribution of discrete data, low-frequency values ​​below the 3σ principle are judged as abnormal. For single-point anomalies, the weighted average of the five valid points before and after is used to replace them. Continuous anomalies are marked as invalid data and trigger an alarm.

[0094] S22: Set a sliding window of a specified size, calculate the mean and standard deviation of the specified data in the sliding window within the specified time, perform Fourier transform on the specified data, convert it to the frequency domain, and extract the data values ​​within the specified interval.

[0095] S23: Establish a hierarchical transmission strategy to divide the time series dataset into different data subsets, including real-time control datasets, log datasets, and file-based datasets. The real-time control dataset is transmitted via MQTT, the log dataset is transmitted asynchronously via Kafka, and the file-based dataset is transmitted encrypted via FTP / SFTP.

[0096] S24: Establish a hierarchical mapping model and set a structural mapping relationship between physical data and virtual models, directly map the real-time control data set and the file-type data set, and map the log data set after filtering.

[0097] The specific process of filtering and mapping the log data set in step S24 is as follows:

[0098] S241: Filter invalid logs using regular expressions, predict normal log patterns using a preset machine learning model, filter statistical deviations, and define log semantic rules based on domain knowledge to remove redundant information.

[0099] S242: Extract key events, impact scope, and timestamps from the filtered logs, generate an event chain, parse timestamps, event types, and impact scopes from the logs, sort events by timestamps, and associate causal relationships.

[0100] S243: Map the event chain to the log node of the virtual model, store it in time series, and associate it with the state changes of the virtual model. Map each event in the event chain to the corresponding component of the virtual model, preserving the time series relationship when storing, and dynamically update the virtual model state.

[0101] S244: Associate log events with specified data in the virtual model to form a complete fault tracing chain. Log events are associated with the virtual model's monitoring metrics and configuration change records. Device restart events in the log can be linked to change records in the configuration management database. Kibana or Grafana can be used to visualize the event chain, supporting timeline backtracking and root cause identification.

[0102] Example 3

[0103] On the basis of Example 1 or Example 2, the specific process of obtaining the correlation between the pre-processed data in step S3 and performing weighted fusion on the data based on the correlation to obtain fused data is as follows:

[0104] S31: Split the preprocessed data into different data blocks, filter the specified features in each data block, and construct a feature set for each data block. Here, even splitting is performed based on the number of records, ensuring that each data block contains the same number of samples, thus achieving segmented processing of time series data. In a distributed system, splitting is performed automatically by the scheduler. The split size must be load-balanced to avoid memory overflow caused by too large blocks and increased communication overhead due to too small blocks. The block size is typically set to 64MB-128MB.

[0105] Feature filtering is applied independently to each data block to remove redundant or irrelevant features and focus on key variables. The filtering method combines domain knowledge and statistical indicators to quickly evaluate the importance of features based on statistical indicators. The correlation between features and target variables is calculated, and the TOP-K features are retained. If the feature distribution between data blocks is very different, the statistics of each block need to be calculated independently to adapt to local characteristics, and a threshold is set to filter out noise features; when processing categorical features, encoding and then filtering are required. The filtered features are reorganized in the original order, and the discarded columns are removed to generate a streamlined data set. For example, a specified number of key features are filtered out from the original specified number of features to construct a new data block. Convert to a unified format to ensure consistent feature dimensions, add identifiers to the feature set of each data block, and store in a columnar format to optimize query efficiency.

[0106] S32: Construct feature combinations based on the feature set, distribute the feature combinations to different computing nodes, each node processes several feature pairs, and calculates the correlation of all feature combinations in parallel to generate a structured correlation matrix.

[0107] The specific process of calculating the association degree of all feature combinations in parallel in step S32 is as follows:

[0108] S321: Let the feature combination be ( X i , X j ) ,calculate X i andX j The edge frequency and joint frequency of are calculated as follows:

[0109] ;

[0110] in, count (·) represents the number of conditions that are met in the data set, Representation characteristics X i In the value x i k Appear on, i, j, k, l For different serial numbers, N is the global sample number;

[0111] X i Pick x i k and X j Pick x i l The formula for calculating the joint probability is as follows:

[0112] ;

[0113] in, X j = x i l Representation characteristics X j In the value x i l Appear on, N is the global sample number;

[0114] S322: Calculate local mutual information and global mutual information:

[0115] The local mutual information calculation formula is as follows:

[0116] I local ( X i ; Y j )=∑ x,y ( count ( x , y ) / N block )log[ count ( x , y)· N block / [ count ( x )· count ( y )];

[0117] x and y For different feature sets, X i Feature Set x The characteristics of N block is the number of block samples;

[0118] The global mutual information calculation formula is as follows:

[0119] I ( X i ; Y j )=∑ x,y ( count ( x , y ) / N )log[ count ( x , y )· N / [ count ( x )· count ( y )];

[0120] N is the global sample number.

[0121] S33: incrementally updating the association matrix using a sliding window, and performing standardization on the association matrix.

[0122] In this embodiment, the specific process of extracting the fault features including time dependency and spatial correlation of the fused data through the bidirectional long short-term memory network in step S4 and converting them into fault feature vectors is as follows:

[0123] S41: The fused data is input into the forward LSTM layer and the reverse LSTM layer through the dual input channels respectively. The forward LSTM layer t =0 to t =T processes the fused data to capture historical features; the reverse LSTM layer t =T to t = 0 to process the fused data to capture future features.

[0124] The fused data is time series data with a shape of (T, D), where T is the number of time steps and T is the feature dimension. The forward LSTM layer processes from t=0 to t=T, and calculates the hidden state of each time step in turn. h → t , depends on the state of the previous moment h → t -1 and the current input. The processing order of the reverse LSTM layer: from t=T to t=0, calculate the hidden state h ← t , depends on the state at the next moment h ←t+1 and current input.

[0125] S42: Spatial relationships between features are learned through the weight matrix between the forward and reverse LSTM layers. The hidden states of the forward and reverse LSTM layers interact through shared or independent weight matrices to learn spatial dependencies in time series data. The weight matrix of the bidirectional LSTM is jointly optimized through backpropagation to minimize the loss function.

[0126] S43: Extract the hidden state of the last time step: , h t is the merged hidden state vector, which is used to extract the global features of time series data. and The forward LSTM layer and the reverse LSTM layer are respectively t The hidden state of

[0127] S44: Mapped to a fixed-dimensional fault feature vector through a fully connected layer: ,in, W is the weight matrix, b is the bias term.

[0128] Example 4

[0129] On the basis of Example 1 or Example 2 or Example 3, the specific process of step S5 is as follows:

[0130] S51: Define entities, including equipment components, fault types, fault symptoms, repair measures, and association rules, as well as their relationships and key attributes. Equipment components include component ID, name, model, and installation location, which identify the physical components of the equipment. Fault types include fault codes, severity levels, and impact ranges.

[0131] S52: Utilize real-time fault data to train an incremental learning model, predict new fault associations, and add them to the graph after filtering through a threshold. The incremental learning model uses a random forest model, taking as input a fault feature vector and outputting a predicted fault association probability. Only associations with probabilities above the threshold are retained to avoid noise interference. New nodes and edges are added through the graph database.

[0132] S53: Perform dimension reduction and normalization processing on the fault feature vector to calculate the fault feature vector h t Embedding vector of fault type node in knowledge graph e i Cosine similarity of:

[0133] ;

[0134] S54: Building an attention model f ( h t , e i ), output the weight of the feature for each entity and generate the soft mapping probability:

[0135] ;

[0136] S55: The fault node mapped by the fault feature vector is used as the seed node through the input layer of the graph neural network to initialize the failure probability of the seed node p i =1, other nodes p j =0, the node transmits the fault impact message to the neighbor, the weight is determined by the confidence of the edge, and the probability distribution is output by the output layer after probability aggregation.

[0137] The specific process of step S7 is as follows:

[0138] S71: Real-time acquisition of multi-source data from virtual models, including physical dimensions: sensor data such as temperature, pressure, vibration frequency, current and voltage; logical dimensions: model state transition probability, algorithm execution efficiency, parameter convergence, etc.; spatial dimensions: topological structure associated with device locations, signal transmission delay, spatial coupling effects, etc.

[0139] S72: Establish a normal behavior baseline: Define the normal range through unsupervised learning and calculate deviation indicators: Absolute deviation: |Current value - Baseline value|; Dynamic deviation rate: (Current value - Baseline value) / Baseline value × 100%; Spatiotemporal correlation deviation: Combine device location and signal propagation path to calculate the deviation propagation coefficient in the spatial dimension;

[0140] S73: Maps behavioral deviation data to initial amplitudes, encodes real-number features into probability amplitudes through embedding, captures the correlation of multi-dimensional deviations, simulates the nonlinear coupling effects of complex faults, and sets up parameterized circuits. Optimizes circuit parameters using variational algorithms to adapt to dynamic changes in real-time data.

[0141] S74: Map the correlation between the probability amplitude and the multi-dimensional deviation into a priority score of the processing strategy, and select the optimal strategy in combination with the fault assessment result.

[0142] In summary, the fault diagnosis method for servers provided by the present invention realizes efficient fault location and processing by constructing a multi-dimensional intelligent diagnosis system. A server virtual model is constructed at each node and a connection relationship is established. Various data are collected and mapped to the virtual model. The data is weighted and fused through correlation analysis, and fault features containing time and space correlations are extracted using a bidirectional long-short-term memory network. The fault probability distribution is obtained with the help of a dynamic fault knowledge graph and graph neural network reasoning, and the fault assessment results are visualized in combination with the virtual model. Finally, the behavioral deviation is analyzed through a neural network and a processing strategy is generated. Real-time processing of multi-source data, intelligent extraction of fault features, and dynamic deduction of fault propagation are realized, effectively improving the accuracy, real-time nature, and automation level of server fault diagnosis, and realizing predictive maintenance and intelligent decision-making of complex server systems.

Claims

1. A fault diagnosis method for a server, characterized in that: The following steps are involved: S1: Build a server virtual model at each node, and establish a connection relationship between the virtual models based on the real-time connection relationship of each node; S2: Collects server hardware underlying data, operating system kernel data, application running data, and network interaction traffic data, and pre-processes each data before mapping it to the corresponding virtual model in real time; S3: Obtain historical fault diagnosis data and the correlation between the pre-processed data, and perform weighted fusion of the data based on the correlation to obtain fused data; S4: constructing a bidirectional long short-term memory network model and inputting the fused data based on the time series, extracting fault features including time dependency and spatial correlation of the fused data through the bidirectional long short-term memory network, and converting them into fault feature vectors; S5: Build a dynamic fault knowledge graph and update it in real time based on real-time fault data and empirical rules. Input the fault feature vector into the dynamic fault knowledge graph and obtain the fault probability distribution through graph neural network reasoning and calculation. S6: Evaluate the fault type, fault level, fault location, and probability using a preset fault evaluation model according to the fault probability distribution and visualize them in a corresponding virtual model, and evaluate the fault-inducing result based on the connection relationship; S7: Analyzes the multi-dimensional behavioral deviations of the virtual model in real time through a neural network, generates and executes a processing strategy based on the behavioral deviations and fault assessment results; The specific process of step S7 is as follows: S71: Real-time acquisition of multi-source data from virtual models, including physical dimensions: sensor data on temperature, pressure, vibration frequency, current and voltage; logical dimensions: model state transition probability, algorithm execution efficiency, and parameter convergence; and spatial dimensions: topological structure associated with device locations, signal transmission delay, and spatial coupling effects. S72: Establishing a baseline of normal behavior: defining the normal range through unsupervised learning and calculating deviation indicators such as absolute deviation, dynamic deviation rate, and temporal and spatial correlation deviation; S73: Maps behavioral deviation data to initial amplitudes, encodes real-number features into probability amplitudes through embedding, captures the correlation of multi-dimensional deviations, simulates the nonlinear coupling effects of complex faults, and sets up parameterized circuits. Optimizes circuit parameters using variational algorithms to adapt to dynamic changes in real-time data. S74: Map the correlation between the probability amplitude and the multi-dimensional deviation into a priority score of the processing strategy, and select the optimal strategy in combination with the fault assessment result.

2. A method for diagnosing a fault in a server according to claim 1, characterized in that: The specific process of constructing the server virtual model at each node in step S1 is as follows: S11: Obtain point cloud data of the server's shell and internal specified components, model the standardized components using a parametric model library, and construct a three-dimensional model of the server based on the point cloud data and the standardized component modeling; S12: performing equivalent circuit modeling in the three-dimensional model, the equivalent circuit modeling including constructing a power factor correction model, a DC-DC conversion model, and a filter circuit module in the three-dimensional model; S13: constructing a three-dimensional thermal resistance network based on the heat conduction equation, and establishing a CPU / GPU thermal model in the three-dimensional model, wherein the nodes of the three-dimensional thermal resistance network correspond to the chip core, package, and heat sink components; S14: Establish a virtual mechanical hard disk to simulate the vibration characteristics and power consumption curve of the spindle motor, magnetic head arm, and disk, and establish a temperature-performance-life correlation model for the flash memory chip and controller to achieve the establishment of a storage system model in the three-dimensional model.

3. A fault diagnosis method for a server according to claim 1, characterized in that: The specific process of step S2 in which each data is pre-processed and then mapped to the corresponding virtual model in real time is as follows: S21: Unify the data into a specified format, create a time series data set in ascending time order, identify abnormal data in the time series data set, and delete or replace the abnormal data; S22: Set a sliding window of a specified size, calculate the mean and standard deviation of the specified data in the sliding window within the specified time, perform Fourier transform on the specified data, and extract the data values ​​within the specified interval; S23: Establish a hierarchical transmission strategy to divide the time series dataset into different data subsets, including real-time control datasets, log datasets, and file-based datasets. The real-time control dataset is transmitted via MQTT, the log dataset is transmitted asynchronously via Kafka, and the file-based dataset is transmitted encrypted via FTP / SFTP. S24: Establish a hierarchical mapping model and set a structural mapping relationship between physical data and virtual models, directly map the real-time control data set and the file-type data set, and map the log data set after filtering.

4. A method for diagnosing a fault in a server according to claim 3, characterized in that: The specific process of filtering and mapping the log data set in step S24 is as follows: S241: Filter invalid logs using regular expressions, predict normal log patterns using a preset machine learning model, filter outliers, and define log semantic rules based on domain knowledge to remove redundant information. S242: Extract key events, impact scope, and timestamps from the filtered logs to generate an event chain; S243: Map the event chain to the log node of the virtual model, store it in time series, and associate it with the state change of the virtual model; S244: Associate the log event with the specified data of the virtual model to form a complete fault tracing chain.

5. A method for diagnosing a server fault according to claim 1, characterized in that: In step S3, the correlation between each data item after preprocessing is obtained, and the specific process of weighted fusion of each data item based on the correlation degree to obtain fused data is as follows: S31: Divide the preprocessed data into different data blocks, filter the specified features in each data block, and construct a feature set for each data block; S32: Construct feature combinations based on the feature set, distribute the feature combinations to different computing nodes, each node processes several feature pairs, and calculates the correlation of all feature combinations in parallel to generate a structured correlation matrix; S33: incrementally updating the association matrix using a sliding window, and performing standardization on the association matrix.

6. A method for diagnosing a fault in a server according to claim 5, characterized in that: The specific process of calculating the association degree of all feature combinations in parallel in step S32 is as follows: S321: Let the feature combination be ( X i , X j ) ,calculate X i and X j The edge frequency and joint frequency of are calculated as follows: ； in, count (·) represents the number of conditions that are met in the data set, Representation characteristics X i In the value x i k Appear on, i, j, k, l For different serial numbers, N is the global sample number; X i Pick x i k and X j Pick x i l The formula for calculating the joint probability is as follows: ； in, X j = x i l Representation characteristics X j In the value x i l Appear on, N is the global sample number; S322: Calculate local mutual information and global mutual information: The local mutual information calculation formula is as follows: ； x and y For different feature sets, X i Feature Set x The characteristics of N block is the number of block samples; The global mutual information calculation formula is as follows: ； N is the global sample number.

7. A fault diagnosis method for a server according to claim 1, characterized in that: The bidirectional long short-term memory network is provided with dual input channels, one input channel is connected to the forward LSTM layer, and the other input channel is connected to the reverse LSTM layer. The output ends of the forward LSTM layer and the reverse LSTM layer are both connected to the merging layer, the merging layer is connected to the fully connected layer, and the fully connected layer is connected to the output layer.

8. A fault diagnosis method for a server according to claim 7, characterized in that: In step S4, the specific process of extracting the fault features including time dependency and spatial correlation of the fused data through the bidirectional long short-term memory network and converting them into fault feature vectors is as follows: S41: The fused data is input into the forward LSTM layer and the reverse LSTM layer through the dual input channels respectively. The forward LSTM layer t =0 to t =T processes fused data to capture historical features; The reverse LSTM layer starts from t =T to t =0 process fused data to capture future features; S42: Learning the spatial relationship between features through the weight matrix between the forward LSTM layer and the reverse LSTM layer; S43: extract the hidden state of the last time step; S44: Mapped into a fixed-dimensional fault feature vector through a fully connected layer.

9. A method for diagnosing a fault in a server according to claim 8, characterized in that: The specific process of step S5 is as follows: S51: Define entities including equipment components, fault types, fault symptoms, maintenance measures, and association rules, as well as their relationships and key attributes; S52: Use real-time fault data to train an incremental learning model, predict new fault associations, and add them to the graph after filtering through thresholds; S53: Perform dimension reduction and normalization processing on the fault feature vector, and calculate the cosine similarity between the fault feature vector and the embedding vector of the fault type node in the knowledge graph: S54: Build an attention model, output the weight of the feature for each entity, and generate soft mapping probability; S55: The fault node mapped by the fault feature vector is used as the seed node through the input layer of the graph neural network. The failure probability of the seed node and the failure probability of other nodes are initialized. The node transmits the fault impact message to the neighbor. The weight is determined by the confidence of the edge. After probability aggregation, the probability distribution is output by the output layer.

Images