Fault processing method and device, equipment and storage medium

Abstract

The invention provides a fault processing method and device, equipment, a storage medium and a program product, and can be applied to the technical field of computers. The fault processing method comprises the steps that in response to received alarm information for fault hardware, a log text and sensor data of the fault hardware and a topological graph of a fault server where the fault hardware is located are obtained, and the topological graph represents the connection relation of hardware in the fault server; similarity matching is carried out on the log text, the sensor data and the topological graph and historical fault data in a historical fault library to obtain a matching result, and the matching result comprises the similarity between the log text, the sensor data and the topological graph and the historical fault data; and in response to determining that the similarity is smaller than a preset threshold value, performing fault diagnosis on the alarm information, the log text, the sensor data and the topological graph by using the multi-modal large model to obtain a fault diagnosis result.

Description

Technical Field

[0001] The present application relates to the field of computer technology, and more specifically to a fault handling method, apparatus, device, and storage medium. Background Art

[0002] As server scale and complexity continue to grow, the requirements for server reliability have significantly increased. Therefore, to ensure server reliability, timely diagnosis is required when server failures occur.

[0003] When diagnosing server failures, the server logs are typically matched against pre-set rules to determine the cause of the failure and the corrective action. However, these fixed pre-set rules typically only cover known failure scenarios, resulting in low accuracy in diagnosing new failures. Summary of the Invention

[0004] In view of the above problems, the present application provides a fault handling method, apparatus, device, medium and program product.

[0005] According to the first aspect of the present application, a fault handling method is provided, comprising: in response to received alarm information for faulty hardware, obtaining log text, sensor data, and a topology map of a faulty server where the faulty hardware is located, the topology map representing the connection relationship of the hardware in the faulty server; performing similarity matching on the log text, sensor data, and topology map with historical fault data in a historical fault library to obtain a matching result, the matching result including the similarity between the log text, sensor data, and topology map and the historical fault data; and in response to determining that the similarity is less than a preset threshold, performing fault diagnosis on the alarm information, log text, sensor data, and topology map using a multimodal large model to obtain a fault diagnosis result.

[0006] The second aspect of the present application provides a fault handling device, including: an acquisition module, used to respond to the alarm information received for the faulty hardware, obtain the log text, sensor data and topology map of the faulty hardware and the faulty server where the faulty hardware is located, the topology map representing the connection relationship of the hardware in the faulty server; a matching module, used to match the log text, sensor data and topology map with the historical fault data in the historical fault library for similarity, and obtain a matching result, the matching result including the similarity between the log text, sensor data and topology map and the historical fault data; and a diagnosis module, used to respond to determining that the similarity is less than a preset threshold, use a multimodal large model to perform fault diagnosis on the alarm information, log text, sensor data and topology map, and obtain a fault diagnosis result.

[0007] The third aspect of the present application provides an electronic device, comprising: one or more processors; a memory for storing one or more computer programs, wherein the one or more processors execute the one or more computer programs to implement the steps of the above method.

[0008] The fourth aspect of the present application further provides a computer-readable storage medium having a computer program or instructions stored thereon, which implements the steps of the above method when the computer program or instructions are executed by a processor.

[0009] The fifth aspect of the present application further provides a computer program product, comprising a computer program or instructions, which implement the steps of the above method when executed by a processor.

[0010] According to an embodiment of the present application, by matching log text, sensor data, and topology maps with historical fault data in a historical fault library, data from multiple dimensions are used to jointly determine historical faults similar to the current fault, thereby improving the accuracy of the matching results and the efficiency of diagnosis. Furthermore, when the similarity between the log text, sensor data, and topology maps and the historical fault data is less than a preset threshold, a multimodal large model is used to perform fault diagnosis on the alarm information, log text, sensor data, and topology maps, so that fault diagnosis is not limited to the preset historical fault library, thereby improving the flexibility of fault diagnosis. Furthermore, a multimodal large model is used to perform fault diagnosis on multi-dimensional data, thereby improving the accuracy of the fault diagnosis results. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The above contents and other objects, features and advantages of the present application will become more apparent through the following description of the embodiments of the present application with reference to the accompanying drawings, in which:

[0012] Figure 1 A diagram schematically illustrates an application scenario of the fault handling method, apparatus, device, medium, and program product according to an embodiment of the present application;

[0013] Figure 2 A flowchart of a fault handling method according to an embodiment of the present application is schematically shown;

[0014] Figure 3 A flowchart of a fault handling method according to a specific embodiment of the present application is schematically shown;

[0015] Figure 4 A schematic diagram of generating a fault diagnosis result according to a specific embodiment of the present disclosure is schematically shown;

[0016] Figure 5 A flowchart of fault diagnosis using a multimodal large model according to a specific embodiment of the present application is schematically shown;

[0017] Figure 6 Schematically shows a flow chart of updating a historical fault library according to a specific embodiment of the present disclosure;

[0018] Figure 7 A schematic diagram of a structure of a fault handling device according to an embodiment of the present application is shown; and

[0019] Figure 8 A block diagram of an electronic device suitable for implementing a fault handling method according to an embodiment of the present application is schematically shown. DETAILED DESCRIPTION

[0020] Hereinafter, embodiments of the present application will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present application. In the detailed description below, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present application. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessarily confusing the concepts of the present application.

[0021] The terms used herein are only for describing specific embodiments and are not intended to limit the present application. The terms "comprise," "include," etc. used herein indicate the presence of features, steps, operations, and / or components, but do not exclude the presence or addition of one or more other features, steps, operations, or components.

[0022] All terms used herein (including technical and scientific terms) have the meanings commonly understood by those skilled in the art unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification and should not be interpreted in an idealized or overly rigid manner.

[0023] When expressions such as "at least one of A, B, and C, etc." are used, they should generally be interpreted in accordance with the meaning commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0024] During server software development and testing, the system generates massive logs containing information such as code errors, hardware status, and service call chains. Traditional hardware fault diagnosis relies primarily on manual experience and a fixed rule base, requiring operations personnel to review logs line by line and compare them with the fixed rule base. However, hardware failure modes are complex and varied (such as new hardware compatibility issues and occasional signal interference), and delayed rule base updates lead to a high rate of misdiagnosis.

[0025] An embodiment of the present application provides a fault handling method, characterized in that the method includes: in response to received alarm information for faulty hardware, obtaining log text, sensor data and a topology map of the faulty server where the faulty hardware is located, the topology map representing the connection relationship of the hardware in the faulty server; performing similarity matching on the log text, sensor data and topology map with historical fault data in a historical fault library to obtain a matching result, the matching result including the similarity between the log text, sensor data and topology map and the historical fault data; and in response to determining that the similarity is less than a preset threshold, using a multimodal large model to perform fault diagnosis on the alarm information, log text, sensor data and topology map to obtain a fault diagnosis result.

[0026] The embodiments of the present application utilize a multimodal large model to perform fault diagnosis on alarm information, log text, sensor data, and topology maps when the similarity is less than a preset threshold, so that fault diagnosis is not limited to a preset historical fault library, thereby improving the flexibility of fault diagnosis.

[0027] Figure 1 The application scenario diagram of the fault handling method, apparatus, device, medium and program product according to the embodiments of the present application is schematically shown.

[0028] like Figure 1 As shown, the application scenario according to this embodiment may include a diagnostic server 101, a network 102, and a server cabinet 103, wherein multiple target servers 104 are placed in the server cabinet 103. The network 102 is used as a medium for providing a communication link between the diagnostic server 101 and the target servers 104. The network 102 may include various connection types, such as wired or wireless communication links or fiber optic cables.

[0029] The diagnostic server 101 is used to provide fault diagnosis services to the target server 104 , for example, to perform fault diagnosis on the target server 104 when the target server 104 generates alarm information.

[0030] The target server 104 may be a server that provides various services, such as a backend management server that supports websites browsed by terminal devices (for example only). The backend management server may analyze and process received user requests and other data, and feed back the processing results (e.g., web pages, information, or data obtained or generated based on user requests) to the terminal device.

[0031] It should be noted that the fault handling method provided in the embodiment of the present application can generally be executed by the diagnostic server 101. Accordingly, the fault handling device provided in the embodiment of the present application can generally be set in the server 101. The fault handling method provided in the embodiment of the present application can also be executed by a server or server cluster that is different from the diagnostic server 101 and can communicate with the target server 104. Accordingly, the fault handling device provided in the embodiment of the present application can also be set in a server or server cluster that is different from the diagnostic server 101 and can communicate with the target server 104. The fault handling method provided in the embodiment of the present application can also be executed by a server different from the target server 104. Accordingly, the fault handling device provided in the embodiment of the present application can also be set in the target server 104.

[0032] For example, when the target server generates alarm information for faulty hardware, the target server can send the alarm information to the diagnostic server. In response to receiving the alarm information, the diagnostic server can determine that the target server is a faulty server and perform fault diagnosis to obtain a fault diagnosis result.

[0033] It should be understood that Figure 1 The number of diagnostic servers and target servers in the embodiment is only for illustration. Any number of diagnostic servers and target servers may be provided according to implementation requirements.

[0034] The following will be based on Figure 1 The scene described by Figures 2 to 6 The fault handling method of the application embodiment is described in detail.

[0035] Figure 2 The flowchart of the fault handling method according to the embodiment of the present application is schematically shown.

[0036] like Figure 2 As shown, the fault handling method of this embodiment includes operations S210 to S230.

[0037] In operation S210 , in response to the received alarm information regarding the faulty hardware, log text, sensor data, and a topology map of a faulty server where the faulty hardware is located are acquired.

[0038] When diagnosing server faults, in order to avoid misjudgments caused by using single-dimensional logs for fault diagnosis, such as only focusing on logs and ignoring changes in the physical state of the faulty hardware, fault diagnosis can be performed using multiple-dimensional data such as the faulty hardware's log text, sensor data, and the topology diagram of the faulty server where the faulty hardware is located.

[0039] In embodiments of the present application, log text can be used to characterize overt fault characteristics of faulty hardware, such as a disk array card overheating protection. Sensor data can be used to characterize latent fault characteristics of faulty hardware, such as a sudden 20°C rise in CPU temperature within 10 minutes. A topology map can also characterize the hardware connections within a faulty server. For example, the topology map can be used to determine the impact of a fault.

[0040] When acquiring log text, sensor data, and topology maps, the diagnostic server can interact with the faulty server to acquire the log text and sensor data of the faulty hardware. Furthermore, the diagnostic server can store topology maps for different types of servers and acquire the topology map of the faulty server based on the type of the faulty server.

[0041] In operation S220 , similarity matching is performed between the log text, the sensor data, and the topology map and the historical fault data in the historical fault database to obtain a matching result.

[0042] When diagnosing server faults, you can first use a local historical fault database. To improve diagnostic accuracy, the database can store historical fault data from multiple dimensions. This allows you to compare log text, sensor data, and topology data with historical fault data, and identify historical faults similar to the current fault from multiple dimensions.

[0043] After similarity matching is performed on the log text, sensor data, and topology map with the historical fault data, the obtained matching result may include the similarity between the log text, sensor data, and topology map and the historical fault data.

[0044] For example, historical fault data may include historical log text, historical sensor data, and historical topology maps, and matching results are determined based on the similarity between the log text, sensor data, and topology maps and the historical log text, historical sensor data, and historical topology maps, respectively.

[0045] In operation S230 , in response to determining that the similarity is less than a preset threshold, a multimodal large model is used to perform fault diagnosis on the alarm information, log text, sensor data, and topology map to obtain a fault diagnosis result.

[0046] Since the historical fault data stored in the historical fault library has limitations and cannot cover all fault scenarios, when the similarity is less than the preset threshold, it can be determined that there is no historical fault data of historical faults similar to the current fault stored in the historical fault library. At this time, a multimodal large model can be used to perform fault diagnosis on multi-dimensional data to improve the accuracy of diagnosis.

[0047] When using a multimodal large model for fault diagnosis, prompt information can be generated based on log text, sensor data, and topology maps, and the prompt information can be used to guide the large model to output fault diagnosis results.

[0048] According to an embodiment of the present application, by matching log text, sensor data, and topology maps with historical fault data in a historical fault library, data from multiple dimensions are used to jointly determine historical faults similar to the current fault, thereby improving the accuracy of the matching results and the efficiency of diagnosis. Furthermore, when the similarity between the log text, sensor data, and topology maps and the historical fault data is less than a preset threshold, a multimodal large model is used to perform fault diagnosis on the alarm information, log text, sensor data, and topology maps, so that fault diagnosis is not limited to the preset historical fault library, thereby improving the flexibility of fault diagnosis. Furthermore, a multimodal large model is used to perform fault diagnosis on multi-dimensional data, thereby improving the accuracy of the fault diagnosis results.

[0049] According to an embodiment of the present application, the fault handling method also includes: in response to determining that the similarity is greater than or equal to a preset threshold, obtaining historical fault causes and historical repair suggestions that have a mapping relationship with historical fault data from a historical fault library; generating a fault diagnosis result based on the historical fault causes and historical repair suggestions.

[0050] When the similarity is greater than or equal to the preset threshold, it can be determined that historical fault data similar to the current fault is stored in the historical fault library. Therefore, fault diagnosis can be performed directly based on historical fault causes and historical repair suggestions to improve fault diagnosis efficiency.

[0051] There is a mapping relationship between historical fault causes and historical repair suggestions and historical fault data. For example, a fault diagnosis mapping table can be set up in the historical fault database to store historical fault data and the historical fault causes and repair suggestions that match the historical fault data in the fault diagnosis mapping table, so that historical fault causes and repair suggestions can be obtained based on the historical fault data.

[0052] After obtaining the historical fault causes and historical repair suggestions, the historical fault causes and historical repair suggestions can be determined as the fault diagnosis results of this fault, and the fault diagnosis results can be displayed on the user's terminal so that the user can repair the faulty server according to the fault diagnosis results.

[0053] According to an embodiment of the present application, when the similarity is greater than or equal to a preset threshold, a fault diagnosis result is generated based on historical fault causes and historical repair suggestions that have a mapping relationship with historical fault data in a historical fault library, thereby improving the efficiency of fault diagnosis.

[0054] For example, when a transmission link error is detected to occur continuously: historical fault data (such as firmware version defects and gold finger oxidation) is matched in the historical fault database; the server operation and maintenance manual is associated and it is recommended to execute the transmission link diagnostic command; according to the topology diagram, it is prompted to check the physical connection of the corresponding slot first.

[0055] The generated fault diagnosis results may indicate a faulty solder joint on the RAID card's printed circuit board. Repair recommendations may include hardware-level steps such as reseating the RAID card and replacing a spare disk slot. Furthermore, the fault diagnosis results may include preventative measures, such as recommending cleaning the gold finger every 2,000 hours based on historical data predicting the frequency of similar failures.

[0056] For example, the historical fault library can also include a parsing script. When a driver error occurs in the log, a parsing script is matched from the historical fault library to parse the driver file path in the error stack and locate the specific function module in the associated source code repository. The parsing script is then executed to perform parsing and generate repair suggestions based on the parsing results, such as updating the driver version or checking the direct memory access mapping configuration.

[0057] Figure 3 The following schematically shows a flow chart of a fault handling method according to a specific embodiment of the present application.

[0058] like Figure 3 As shown, the fault handling method includes operations S310 to S360.

[0059] In operation S310, multiple source initial logs related to the faulty hardware are obtained. In an embodiment of the present application, the initial logs may include hardware layer logs, firmware layer logs, and system layer logs.

[0060] In operation S320, the initial log is standardized to obtain log text. Since the formats and contents of the initial logs from multiple sources vary and the log readability is low, the initial logs can be standardized. For example, the initial logs can be converted into a unified JSON format.

[0061] In operation S330 , similarity matching is performed on the log text, sensor data, topology map, and historical fault data.

[0062] In operation S340, a determination is made as to whether the similarity is greater than a preset threshold. If the similarity is greater than the preset threshold, operation S350 is executed; otherwise, operation S360 is executed. In operation S350, a fault diagnosis result is generated based on the historical fault causes and historical repair suggestions corresponding to the historical fault data. In operation S360, a multimodal large model is used to perform fault diagnosis on the alarm information, log text, sensor data, topology map, and historical fault data to obtain a fault diagnosis result.

[0063] According to an embodiment of the present application, a multimodal large model is used to perform fault diagnosis on alarm information, log text, sensor data and topology map to obtain a fault diagnosis result, including: adding the alarm information, log text, sensor data and topology map to a first prompt template to generate a first prompt information; inputting the first prompt information into the multimodal model to obtain data to be supplemented; in response to receiving supplementary data for the data to be supplemented input by the user, the multimodal large model is used to process the alarm information, log text, sensor data, topology map and supplementary data to obtain a fault diagnosis result.

[0064] When using a large multimodal model for fault diagnosis, it may not be possible to accurately determine the cause of the fault and repair suggestions based solely on log text, sensor data, and topology maps. Therefore, the large multimodal model can be guided to generate supplementary data for fault diagnosis to improve the accuracy of fault diagnosis.

[0065] In an embodiment of the present application, the first prompt template is used to guide the multimodal large model to generate data to be supplemented for fault diagnosis. By adding alarm information, log text, sensor data and topology map to the first prompt template, the generated first prompt information is input into the multimodal large model, and the corresponding data to be supplemented can be obtained.

[0066] The first prompt template may include placeholders. For example, the first prompt information may be obtained by adding the alarm information, log text, sensor data, and topology map to their corresponding placeholders according to their respective identification information.

[0067] In some embodiments, after the data to be supplemented is determined using the multimodal large model, the data to be supplemented can be displayed on the user's terminal, and the user can input the supplementary data for the data to be supplemented by interacting with the terminal.

[0068] In other embodiments, after obtaining the data to be supplemented using the multimodal large model, the diagnostic server can also interact directly with the faulty server based on the data to be supplemented to obtain supplementary data from the faulty server. For example, the diagnostic server can obtain supplementary data from log text and sensor data of other hardware in the faulty server.

[0069] When using a multimodal large model to process alarm information, log text, sensor data, topology maps and supplementary data, a prompt template can be used to guide the multimodal large model to output fault diagnosis results. Prompt information can be generated by adding alarm information, log text, sensor data, topology maps and supplementary data to the prompt template, and the prompt information can be input into the multimodal large model to obtain fault diagnosis results.

[0070] According to an embodiment of the present application, by using a first prompt template that can guide the multimodal large model to generate supplementary data, a first prompt information is generated based on the first prompt template in combination with alarm information, log text, sensor data and topology map, so that the multimodal large model generates data to be supplemented according to the first prompt information, and then generates a fault diagnosis result based on the data to be supplemented, thereby improving the accuracy of fault diagnosis.

[0071] Figure 4 A schematic diagram of generating a fault diagnosis result according to a specific embodiment of the present disclosure is schematically shown.

[0072] like Figure 4 As shown, the multimodal large model can be used to process alarm information 410, log text 420, sensor data 430, and topology map 440 to generate data to be supplemented 450. The user inputs supplementary data 460 based on data to be supplemented 450, and the multimodal large model is used to process alarm information 410, log text 420, sensor data 430, topology map 440, and supplementary data 460 to generate fault diagnosis result 470.

[0073] According to an embodiment of the present application, when generating the first prompt information, a multimodal large model can also be used to perform statistical analysis on the log text, sensor data, and topology map respectively to obtain log features, sensor features, and topology features, and add the alarm information, log features, sensor features, and topology features to the first prompt template to obtain the first prompt information.

[0074] In some embodiments, log text, sensor data, and topology map can be added to a fourth prompt template to obtain fourth prompt information. The fourth prompt template is used to guide the multimodal large model to generate log text, sensor data, and log features, sensor features, and topology features associated with the alarm information in the topology map.

[0075] For example, the fourth prompt template may be “X alarm information is currently received. Please extract log features, sensor features, and topology features associated with X alarm information from log text, sensor data, and topology map, respectively.”

[0076] According to the embodiments of the present application, by using a multimodal large model to perform statistical analysis on log text, sensor data and topological maps, log features, sensor features and topological features associated with the alarm information can be extracted more accurately, reducing the interference of invalid information on the fault diagnosis process, and making the first prompt information generated based on the alarm information, log features, sensor features and topological features more accurate, thereby improving the efficiency of fault diagnosis.

[0077] In another embodiment of the present application, after the first prompt information is input into the multimodal large model, when the result representation output by the multimodal large model does not require supplementary data, prompt information can be generated based on log features, sensor features, and topological feature maps to use the prompt information to guide the multimodal large model to generate fault diagnosis results.

[0078] For example, the generated prompt message might be, "Please diagnose the fault based on the following information: Text features: Correctable ECC errors are concentrated in slot A2; Sensor features: Memory voltage fluctuations exceed the specification requirement of ±3%; Topology features: This slot shares a power supply module with PCIe_4." Accordingly, the multimodal large model outputs the fault diagnosis result, "Power supply fluctuations may be caused by a sudden high load on the graphics processing unit card in the PCIe_4 slot. Recommendations: Monitor the timing correlation between the graphics processing unit card load and memory voltage; set the bus power priority policy in the basic input and output system (BIOS); and add decoupling capacitors to the power rails."

[0079] According to an embodiment of the present application, in response to receiving supplementary data input by a user for the data to be supplemented, the multimodal large model is used to process the alarm information, log text, sensor data, topology map and supplementary data to obtain a fault diagnosis result, including: adding the alarm information, log text, sensor data, topology map and supplementary data to a second prompt template to generate second prompt information; inputting the second prompt information into the multimodal large model to obtain the cause of the fault; adding the cause of the fault and the topology map to a third prompt template to generate third prompt information; inputting the third prompt information into the multimodal large model to obtain repair suggestions.

[0080] When guiding the multimodal large model to output fault diagnosis results, the multimodal large model can be guided to output the fault cause first, and then guided to output repair suggestions based on the fault cause, so as to improve the accuracy of generating fault diagnosis results.

[0081] In an embodiment of the present application, the second prompt template is used to guide the multimodal large model to generate the cause of the fault. By adding alarm information, log text, sensor data, topology map and supplementary data to the second prompt template, the generated second prompt information is input into the multimodal large model, and the cause of the fault can be obtained accordingly.

[0082] The second prompt template may include placeholders. For example, the second prompt information may be obtained by adding the alarm information, log text, sensor data, topology map, and supplementary data to their corresponding placeholders based on their respective identification information.

[0083] Since the hardware in the faulty server affects each other, the topology map and the cause of the fault can be input into the multimodal big model at the same time when guiding the multimodal big model to generate repair suggestions, so that the multimodal big model can determine other hardware affected by the faulty hardware based on the topology map and generate repair suggestions for the faulty hardware and affected hardware.

[0084] In an embodiment of the present application, the third prompt template is used to guide the multimodal large model to generate repair suggestions. By adding the fault cause and the topology map to the third prompt template, the corresponding repair suggestions can be generated after the generated third prompt information is input into the multimodal large model.

[0085] The third prompt template may include a placeholder. For example, the fault cause and the topology map may be added to the placeholder according to the identification information of the fault cause and the topology map to obtain the third prompt information.

[0086] In some embodiments, after the multimodal large model outputs repair suggestions, alarm information, log text, sensor data, topology map, fault cause and repair suggestions can be displayed on the user terminal at the same time to improve user experience.

[0087] When displaying information such as alarm information, log text, sensor data, topology diagrams, fault causes and repair suggestions, the alarm information, log text, sensor data, topology diagrams, fault causes and repair suggestions can be converted into a standardized form to improve readability.

[0088] According to the embodiments of the present application, by conducting multiple rounds of dialogues with the multimodal large model, the multimodal large model is gradually guided to output the cause of the fault and repair suggestions, so that the obtained fault diagnosis results are more comprehensive and accurate, thereby improving the user experience.

[0089] For example, when stress testing a server, an alarm message is received from a disk array (RAID) card. The log text obtained may include the RAID card's Self-Monitoring Analysis and Reporting Technology (SMART) log (including disk remapping counts and media error rates) at the firmware layer during a preset period, the baseboard management controller's interface event log (such as temperature alarms and abnormal fan speed) at the hardware layer, and the operating system log (such as bus device reset records) at the system layer. Sensor data may include temperature data from the RAID card during a preset period, and a topology map may include the topology map of the server where the faulty RAID card is located.

[0090] Before adding the log text, sensor data, and topology map to the fourth prompt template, the log text can also be standardized. For example, the hexadecimal error code 0x0A (power module failure) can be converted into a readable, lightweight data exchange format: { "Module Type": "Power", "Error Level": "Danger", "Raw Data": "12V Voltage Value is 9.8V", "Timestamp": "X Year X Month X Day X Hour X Minute"}.

[0091] Add the log text, sensor data, and topology map to the fourth prompt template to obtain the fourth prompt information, and input the fourth prompt information into the multimodal large model. The obtained log features include "temperature alarm, abnormal fan speed", sensor features include "RAID card temperature rises sharply by 20°C within 10 minutes", and topology features include "RAID card is located in the PCIe_3 slot of CPU1".

[0092] After adding the alarm information, log features, sensor features, and topology features to the first prompt template, the first prompt information obtained includes "Currently received alarm information from the RAID card, log features: temperature alarm, abnormal fan speed, sensor features: RAID card temperature suddenly increased by 20°C within 10 minutes, topology features: RAID card is located in the PCIe_3 slot of CPU1, please provide the cause of the failure and the data that needs to be supplemented." At this time, the output of the multimodal large model is "12V power supply noise data needs to be supplemented."

[0093] In response to the user input of supplementary 12V power supply noise data, for example, if the user inputs "the ripple noise of the +12V rail reaches 8% and coincides with the peak period of bus bit errors," the second prompt message generated using the second prompt template is "A RAID card alarm message has been received. Log characteristics: temperature alarm, abnormal fan speed. Sensor characteristics: the RAID card temperature suddenly increased by 20°C within 10 minutes. Topology characteristics: the RAID card is located in the PCIe_3 slot of CPU1. Supplementary 12V power supply noise data: the ripple noise of the +12V rail reaches 8% and coincides with the peak period of bus bit errors. Please provide the cause of the fault." At this time, the multimodal large model outputs the fault cause as "ripple interference caused by aging of the power supply filter capacitor (probability 65%); combined effect of gold finger oxidation and power supply problems (probability 30%)."

[0094] Adding the fault cause and topology diagram to the third prompt template results in the following third prompt: "Fault causes include: aging of the power supply filter capacitor causing ripple interference (65% probability); combined effects of gold finger oxidation and power supply issues (30% probability). Please identify the affected hardware based on the topology diagram and generate a step-by-step maintenance plan." The multimodal large model now outputs the following repair recommendations: "Use an oscilloscope to check the 12V output ripple of PSU2. If exceeded, replace the PSU and perform PCIe link diagnostics. Preemptively check the power modules of other servers in the same cabinet."

[0095] Figure 5 A flowchart of fault diagnosis using a multimodal large model according to a specific embodiment of the present application is schematically shown.

[0096] like Figure 5 As shown, the fault diagnosis using the multimodal large model includes operations S510 to S560.

[0097] In operation S510, multi-source initial log text related to faulty hardware is obtained. In operation S520, the initial log text is normalized to obtain log text. In operation S530, a multi-modal large model is used to perform fault diagnosis on the log text, sensor data, topology map, and historical fault data.

[0098] In operation S540, a determination is made as to whether the multimodal large model has output any results. If so, operation S550 is executed; otherwise, operation S560 is executed. In operation S550, a fault diagnosis result is generated based on the fault cause and repair suggestions output by the multimodal large model. In operation S560, the log text, sensor data, and topology map are sent to the user's terminal for manual fault diagnosis.

[0099] According to an embodiment of the present application, log text, sensor data, and topology map are similarly matched with historical fault data in a historical fault library to obtain matching results, including: obtaining a first matching sub-result based on the word frequency of historical log keywords in the log text; similarity matching is performed on sensor time series data with historical sensor time series data to determine a second matching sub-result; similarity matching is performed on the topology map with the historical topology map to determine a third matching sub-result; based on the first sub-similarity, the second sub-similarity, and the third sub-similarity, a target historical fault event is determined from the first historical fault event, the second historical fault event, and the third historical fault event; and matching results are determined based on the similarity of the log text, sensor data, and topology map with the historical log keywords, historical sensor time series data, and historical topology map of the target historical fault event, respectively.

[0100] According to an embodiment of the present application, the sensor data includes sensor time series data within a predetermined period, and the historical fault data includes historical log keywords, historical sensor time series data, and historical topology graphs of respective multiple historical fault events.

[0101] When matching log text, sensor data and topology maps with historical log keywords, historical sensor time series data and historical topology maps respectively, since the log text, sensor data and topology maps cannot be completely matched with the historical log keywords, historical sensor time series data and historical topology maps, a similarity matching method can be adopted to improve the flexibility of matching.

[0102] When matching log text with historical log keywords, we can use Term Frequency-Inverse Document Frequency (TF-IDF) to determine the frequency of each historical log keyword in the log text, and determine the historical log keyword with the highest frequency from multiple historical log keywords.

[0103] The first matching sub-result includes the first historical fault event that matches the log text and the first sub-similarity. After determining the historical log keyword with the highest word frequency, the historical fault event corresponding to the historical log keyword can be determined as the first historical fault event, and the first sub-similarity is determined based on the word frequency.

[0104] Since the length of the preset time period may be different from the length of the historical sensor time series data, when performing similarity matching between the sensor time series data and the historical sensor time series data, in order to reduce the impact of the matching results of the time series data length, a dynamic time warping algorithm can be used to determine the similarity between the sensor time series data and each historical sensor time series data, and determine the historical sensor time series data with the highest similarity from multiple historical sensor time series data.

[0105] The second matching sub-result includes a second historical fault event that matches the sensor time series data and a second sub-similarity. After determining the historical sensor time series data with the highest similarity, the historical fault event corresponding to the historical sensor time series data can be determined as the second fault event, and the similarity between the sensor data and the historical sensor time series data can be determined as the second sub-similarity.

[0106] When matching a topology map with historical topologies, a graph neural network can be used. For example, the topology map and historical topologies can be simultaneously input into the graph neural network to obtain the similarity between the topology map and the historical topologies, and then the historical topology map with the highest similarity can be determined from multiple historical topologies.

[0107] The third matching sub-result includes a third historical fault event that matches the topology graph and a third sub-similarity. After determining the historical topology graph with the highest similarity, the historical fault event corresponding to the historical topology graph can be determined as the third historical fault event, and the similarity between the topology graph and the historical topology graph can be determined as the third sub-similarity.

[0108] In order to improve the fault diagnosis accuracy, the historical fault event most similar to the current fault can be determined as the target historical fault event from the first historical fault event, the second historical fault event and the third historical fault event according to the first sub-similarity, the second sub-similarity and the third sub-similarity.

[0109] After determining the target fault event, the target sub-similarity between the log text, sensor time series data, and topology map and the historical log keywords, historical sensor time series data, and historical topology map of the target fault event can be determined, and a matching result can be determined based on the target sub-similarity. For example, the comprehensive similarity between the current fault and the target historical fault event can be determined based on the average of multiple target sub-similarity values, and the comprehensive similarity can be determined as the matching result.

[0110] According to the embodiments of the present application, by performing similarity matching on the log text, sensor time series data and topology map respectively, and further determining the most similar target historical fault event based on the matching sub-results obtained by matching, the matching accuracy is improved and the accuracy of fault diagnosis is further improved.

[0111] According to an embodiment of the present application, based on the first sub-similarity, the second sub-similarity, and the third sub-similarity, a target historical fault event is determined from the first historical fault event, the second historical fault event, and the third historical fault event, including: in response to determining that the same historical fault event exists among the first historical fault event, the second historical fault event, and the third historical fault event, the same historical fault event is determined as the target historical fault event; in response to determining that the same historical fault event does not exist among the first historical fault event, the second historical fault event, and the third historical fault event, the target historical fault event is determined from the first historical fault event, the second historical fault event, and the third historical fault event based on the first sub-similarity, the second sub-similarity, and the third sub-similarity.

[0112] If the first, second, and third historical fault events contain the same historical fault event, it indicates that the historical fault event is highly similar to the current fault, and the historical fault event can be determined to be the target historical fault event. For example, if two or three of the first, second, and third historical fault events are the same historical fault event, the historical fault event can be determined to be the target historical fault event.

[0113] When there is no identical historical fault event among the first historical fault event, the second historical fault event and the third historical fault event, the maximum value among the first sub-similarity, the second sub-similarity and the third sub-similarity can be determined, and the historical fault event corresponding to the maximum value is determined as the target historical fault event.

[0114] According to an embodiment of the present application, by determining that the same historical fault event exists in the first historical fault event, the second historical fault event, and the third historical fault event as the target historical fault event, the comprehensive matching degree between the target historical fault event and the current fault can be improved, thereby improving the fault diagnosis accuracy.

[0115] In some embodiments of the present application, when the similarity is less than a preset threshold, a visual difference comparison matrix can also be generated and displayed based on the differences between the log text, sensor data, and topology map and the target fault event, so that the user can determine the key features in the log text, sensor data, and topology map based on the difference comparison matrix.

[0116] For example, the difference comparison matrix may include the difference between the fluctuation amplitude of sensor time series data and historical sensor time series data, as well as the hierarchical difference between the topology map and the historical topology map.

[0117] If the historical fault database does not store similar historical fault data to the current fault, other databases can be used to diagnose the current fault. For example, the cloud-based knowledge base of the manufacturer of the faulty hardware can be accessed through an interface to obtain the fault cause and repair suggestions from the cloud-based knowledge base.

[0118] According to an embodiment of the present application, the fault handling method further includes: updating a historical fault library using log text, sensor data, topology diagrams, fault causes, and repair suggestions.

[0119] Since when the similarity is less than the preset threshold, it means that the historical fault library does not store historical fault events related to the current fault. Therefore, after using the multimodal large model to generate fault causes and repair suggestions, the historical fault library can be updated using log text, sensor data, topology map, fault causes and repair suggestions.

[0120] When updating the historical fault library, keywords can be extracted from the log text to obtain log keywords, and the log keywords, sensor timing data, topology diagram, fault causes and repair suggestions can be stored in the historical fault library so that when similar faults occur in the future, fault diagnosis can be performed directly based on the fault causes and repair suggestions stored in the historical fault library.

[0121] According to the embodiments of the present application, by updating the historical fault library using log text, sensor data, topology diagrams, fault causes and repair suggestions, it is possible to dynamically update the historical fault library, improve the flexibility and richness of the historical fault data stored in the historical fault library, and further improve the accuracy of fault diagnosis based on the historical fault library.

[0122] In an embodiment of the present application, before updating the historical fault library, the fault causes and repair suggestions generated by the multimodal large model can also be pushed to the user for review. When the user determines that the fault causes and repair suggestions generated by the multimodal large model are correct, the historical fault library can be updated to ensure the accuracy of the historical fault data in the historical fault library.

[0123] Figure 6 The flowchart of updating the historical fault library according to a specific embodiment of the present disclosure is schematically shown.

[0124] like Figure 6 As shown, updating the historical fault database includes operations S610 to S640.

[0125] In operation S610, the fault cause and repair suggestion generated by the multimodal large model are pushed to the user for review.

[0126] In operation S620, it is determined whether the audit is passed. If the audit is passed, operation S630 is executed, otherwise operation S640 is executed. In operation S630, the historical fault library is updated. In operation S640, the fault is marked as an abnormal diagnosis fault.

[0127] In an embodiment of the present application, after a fault event is marked as an abnormal diagnostic fault, the log text, sensor data, and topology map may be sent to a user's terminal for manual fault diagnosis.

[0128] According to an embodiment of the present application, the historical fault database can also store usage data of various hardware components, such as usage duration, and generate hardware replacement prompts when the hardware usage data meets predetermined conditions. For example, a hard drive replacement prompt is generated when the hard drive power-on time is greater than 30,000 hours and sector reallocation occurs; a fan bearing replacement prompt is generated based on the fan bearing wear curve and fan bearing usage duration; a load-life model is established for the power module to predict the capacitor aging failure point, and a capacitor replacement prompt is generated when the capacitor approaches the aging failure point.

[0129] Based on the above fault handling method, this application also provides a fault handling device. Figure 7 The device is described in detail.

[0130] Figure 7 The structural block diagram of the fault handling device according to an embodiment of the present application is schematically shown.

[0131] like Figure 7 As shown, the fault handling device 700 of this embodiment includes an acquisition module 710 , a matching module 720 and a diagnosis module 730 .

[0132] Acquisition module 710 is configured to, in response to received alarm information regarding faulty hardware, acquire log text, sensor data, and a topology map of the faulty server where the faulty hardware resides. The topology map represents the connection relationships between the hardware in the faulty server. In one embodiment, acquisition module 710 may be configured to perform operation S210 described above, and will not be further described here.

[0133] Matching module 720 is configured to perform similarity matching between the log text, sensor data, and topology map and the historical fault data in the historical fault database, thereby obtaining a matching result. The matching result includes the similarity between the log text, sensor data, and topology map and the historical fault data. In one embodiment, matching module 720 may be configured to perform operation S220 described above, and will not be further described herein.

[0134] Diagnosis module 730 is configured to, in response to determining that the similarity is less than a preset threshold, perform fault diagnosis on the alarm information, log text, sensor data, and topology map using the multimodal large model to obtain a fault diagnosis result. In one embodiment, diagnosis module 730 can be configured to perform operation S230 described above, which will not be further described here.

[0135] According to an embodiment of the present application, the diagnosis module 730 includes a supplementary prompt submodule, a supplementary generation submodule and a diagnosis generation submodule. The supplementary prompt submodule is used to add the alarm information, log text, sensor data and topology map to the first prompt template to generate the first prompt information, and the first prompt template is used to guide the multimodal large model to generate the data to be supplemented for fault diagnosis. The supplementary generation submodule is used to input the first prompt information into the multimodal model to obtain the data to be supplemented. The diagnosis generation submodule is used to process the alarm information, log text, sensor data, topology map and supplementary data using the multimodal large model in response to receiving the supplementary data for the data to be supplemented input by the user to obtain the fault diagnosis result.

[0136] According to an embodiment of the present application, the diagnosis generation submodule includes a cause prompt unit, a cause generation unit block, a suggestion prompt unit and a suggestion generation unit. The cause prompt unit is used to add the alarm information, log text, sensor data, topology map and supplementary data to the second prompt template to generate the second prompt information, and the second prompt template is used to guide the multimodal large model to generate the cause of the fault. The cause generation unit is used to input the second prompt information into the multimodal large model to obtain the cause of the fault. The suggestion prompt unit is used to add the cause of the fault and the topology map to the third prompt template to generate the third prompt information, and the third prompt template is used to guide the multimodal large model to generate a repair suggestion. The suggestion generation unit is used to input the third prompt information into the multimodal large model to obtain a repair suggestion.

[0137] According to an embodiment of the present application, the sensor data includes sensor time series data within a predetermined period, and the historical fault data includes historical log keywords, historical sensor time series data, and historical topology graphs of respective multiple historical fault events.

[0138] According to an embodiment of the present application, the matching module 720 includes a first matching submodule, a second matching submodule, a third matching submodule, a target determination submodule, and a result determination submodule. The first matching submodule is used to obtain a first matching subresult based on the word frequency of the historical log keyword in the log text, and the first matching subresult includes a first historical fault event that matches the log text and a first sub-similarity. The second matching submodule is used to perform similarity matching on the sensor time series data with the historical sensor time series data to determine a second matching subresult, and the second matching subresult includes a second historical fault event that matches the sensor time series data and a second sub-similarity. The third matching submodule is used to perform similarity matching on the topology map with the historical topology map to determine a third matching subresult, and the third matching subresult includes a third historical fault event that matches the topology map and a third sub-similarity. The target determination submodule is used to determine a target historical fault event from the first historical fault event, the second historical fault event, and the third historical fault event based on the first sub-similarity, the second sub-similarity, and the third sub-similarity. The result determination submodule is used to determine the matching result based on the similarity between the log text, sensor data and topology map and the historical log keywords, historical sensor time series data and historical topology map of the target historical fault event respectively.

[0139] According to an embodiment of the present application, the target determination submodule includes a first determination unit and a second determination unit. The first determination unit is configured to, in response to determining that the first historical fault event, the second historical fault event, and the third historical fault event have the same historical fault event, determine the same historical fault event as the target historical fault event. The second determination unit is configured to, in response to determining that the first historical fault event, the second historical fault event, and the third historical fault event do not have the same historical fault event, determine the target historical fault event from the first historical fault event, the second historical fault event, and the third historical fault event based on the first sub-similarity, the second sub-similarity, and the third sub-similarity.

[0140] According to an embodiment of the present application, the fault handling device 700 further includes a history acquisition module and a diagnosis determination module. The history acquisition module is configured to, in response to determining that the similarity is greater than or equal to a preset threshold, acquire historical fault causes and historical repair suggestions that are mapped to the historical fault data from a historical fault database. The diagnosis determination module is configured to generate a fault diagnosis result based on the historical fault causes and historical repair suggestions.

[0141] According to an embodiment of the present application, the fault handling apparatus 700 further includes an update module configured to update the historical fault database using log text, sensor data, topology diagrams, fault causes, and repair suggestions.

[0142] According to embodiments of the present application, any multiple modules among the acquisition module 710, matching module 720, and diagnosis module 730 may be combined into a single module, or any one of these modules may be split into multiple modules. Alternatively, at least part of the functionality of one or more of these modules may be combined with at least part of the functionality of other modules and implemented in a single module. According to embodiments of the present application, at least one of the acquisition module 710, matching module 720, and diagnosis module 730 may be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application-specific integrated circuit (ASIC), or may be implemented in hardware or firmware through any other reasonable means of circuit integration or packaging, or may be implemented in any one of software, hardware, and firmware, or any suitable combination of these. Alternatively, at least one of the acquisition module 710, matching module 720, and diagnosis module 730 may be at least partially implemented as a computer program module that, when executed, performs the corresponding functionality.

[0143] Figure 8 A block diagram of an electronic device suitable for implementing a fault handling method according to an embodiment of the present application is schematically shown.

[0144] like Figure 8 As shown, an electronic device 800 according to an embodiment of the present application includes a processor 801, which can perform various appropriate actions and processes based on a program stored in a read-only memory (ROM) 802 or a program loaded from a storage unit 808 into a random access memory (RAM) 803. The processor 801 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a dedicated microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 801 may also include onboard memory for caching purposes. The processor 801 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present application.

[0145] Various programs and data required for the operation of the electronic device 800 are stored in the RAM 803. The processor 801, ROM 802, and RAM 803 are connected to each other via a bus 804. The processor 801 performs various operations of the method flow according to the embodiment of the present application by executing the programs in the ROM 802 and / or RAM 803. It should be noted that the programs can also be stored in one or more memories other than the ROM 802 and RAM 803. The processor 801 can also perform various operations of the method flow according to the embodiment of the present application by executing the programs stored in one or more memories.

[0146] According to an embodiment of the present application, electronic device 800 may further include an input / output (I / O) interface 805, which is also connected to bus 804. Electronic device 800 may also include one or more of the following components connected to I / O interface 805: an input section 806 including a keyboard, mouse, etc.; an output section 807 including devices such as a cathode ray tube (CRT), liquid crystal display (LCD), and speakers; a storage section 808 including a hard disk; and a communication section 809 including a network interface card such as a LAN card or modem. Communication section 809 performs communication processing via a network such as the Internet. A drive 810 is also connected to I / O interface 805 as needed. Removable media 811, such as a magnetic disk, optical disk, magneto-optical disk, semiconductor memory, etc., is installed in drive 810 as needed, so that computer programs read from the removable media can be installed into storage section 808 as needed.

[0147] This application also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments, or may exist independently and not be incorporated into the device / apparatus / system. The computer-readable storage medium carries one or more programs, and when the one or more programs are executed, the method according to the embodiments of this application is implemented.

[0148] According to an embodiment of the present application, a computer-readable storage medium may be a non-volatile computer-readable storage medium, and may include, for example, but not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present application, a computer-readable storage medium may be any tangible medium that contains or stores a program that can be used by or in conjunction with an instruction execution system, apparatus, or device. For example, according to an embodiment of the present application, a computer-readable storage medium may include the ROM 802 and / or RAM 803 described above and / or one or more memories other than ROM 802 and RAM 803.

[0149] The embodiments of the present application also include a computer program product, which includes a computer program containing program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method provided in the embodiments of the present application.

[0150] The computer program executes the above functions defined in the system / device of the embodiment of the present application when the processor 801 executes the computer program. According to the embodiment of the present application, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0151] In one embodiment, the computer program may be stored on a tangible storage medium such as an optical storage device or a magnetic storage device. In another embodiment, the computer program may be transmitted and distributed in the form of a signal on a network medium, downloaded and installed via the communication portion 809, and / or installed from a removable medium 811. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to wireless, wired, or any suitable combination thereof.

[0152] In such an embodiment, the computer program can be downloaded and installed from the network via the communication section 809, and / or installed from the removable medium 811. When the computer program is executed by the processor 801, the above-mentioned functions defined in the system of the embodiment of the present application are performed. According to the embodiment of the present application, the systems, devices, means, modules, units, etc. described above can be implemented by computer program modules.

[0153] According to an embodiment of the present application, the program code for executing the computer program provided by the embodiment of the present application can be written in any combination of one or more programming languages. Specifically, these computer programs can be implemented using high-level procedural and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages include, but are not limited to, languages such as Java, C++, Python, "C" or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on a remote computing device, or entirely on a remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect via the Internet).

[0154] The flowcharts and block diagrams in the accompanying drawings illustrate the possible implementation architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present application. In this regard, each box in the flowchart or block diagram can represent a module, program segment, or a part of code, and the above-mentioned module, program segment, or a part of code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in an order different from that marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flowchart, and the combination of the boxes in the block diagram or flowchart, can be implemented with a dedicated hardware-based system that performs the specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0155] Those skilled in the art will appreciate that the features described in the various embodiments of this application may be combined and / or coupled in various ways, even if such combinations or couplings are not explicitly described in this application. In particular, the features described in the various embodiments of this application may be combined and / or coupled in various ways without departing from the spirit and teachings of this application. All such combinations and / or couplings fall within the scope of this application.

[0156] The embodiments of the present application have been described above. However, these embodiments are for illustrative purposes only and are not intended to limit the scope of the present application. Although each embodiment has been described separately above, this does not mean that the measures in each embodiment cannot be advantageously used in combination. Without departing from the scope of the present application, those skilled in the art may make various substitutions and modifications, and these substitutions and modifications should all fall within the scope of the present application.

Claims

1. A fault handling method, characterized in that: The method comprises: In response to received alarm information regarding faulty hardware, obtaining log text, sensor data, and a topology diagram of a faulty server where the faulty hardware is located, the topology diagram representing a connection relationship between hardware in the faulty server; Performing similarity matching on the log text, the sensor data, and the topology map with the historical fault data in the historical fault database to obtain a matching result, wherein the matching result includes the similarity between the log text, the sensor data, and the topology map and the historical fault data; and In response to determining that the similarity is less than a preset threshold, a multimodal large model is used to perform fault diagnosis on the alarm information, the log text, the sensor data, and the topology map to obtain a fault diagnosis result.

2. The method according to claim 1, characterized in that The multimodal large model is used to perform fault diagnosis on the alarm information, the log text, the sensor data, and the topology map to obtain a fault diagnosis result, including: Adding the alarm information, the log text, the sensor data, and the topology map to a first prompt template to generate first prompt information, wherein the first prompt template is used to guide the multimodal large model to generate data to be supplemented for fault diagnosis; Inputting the first prompt information into the multimodal model to obtain the data to be supplemented; In response to receiving the supplementary data input by the user for the data to be supplemented, the multimodal large model is used to process the alarm information, the log text, the sensor data, the topology map and the supplementary data to obtain the fault diagnosis result.

3. The method according to claim 2, characterized in that In response to receiving the supplementary data input by the user for the data to be supplemented, processing the alarm information, the log text, the sensor data, the topology map, and the supplementary data using the multimodal large model to obtain the fault diagnosis result, including: Adding the alarm information, the log text, the sensor data, the topology map, and the supplementary data to a second prompt template to generate second prompt information, wherein the second prompt template is used to guide the multimodal large model to generate a fault cause; Inputting the second prompt information into the multimodal large model to obtain the fault cause; Adding the fault cause and the topology map to a third prompt template to generate third prompt information, wherein the third prompt template is used to guide the multimodal large model to generate repair suggestions; The third prompt information is input into the multimodal large model to obtain the repair suggestion.

4. The method according to claim 1, wherein The sensor data includes sensor time series data within a predetermined period, and the historical fault data includes historical log keywords, historical sensor time series data, and historical topology graphs of respective multiple historical fault events; The similarity matching of the log text, the sensor data, and the topology map with the historical fault data in the historical fault database to obtain a matching result includes: Based on the word frequency of the historical log keyword in the log text, obtaining a first matching sub-result, the first matching sub-result including a first historical fault event matching the log text and a first sub-similarity; Performing similarity matching on the sensor time series data and the historical sensor time series data to determine a second matching sub-result, where the second matching sub-result includes a second historical fault event that matches the sensor time series data and a second sub-similarity; Performing similarity matching on the topology map and the historical topology map to determine a third matching sub-result, wherein the third matching sub-result includes a third historical fault event that matches the topology map and a third sub-similarity; determining a target historical fault event from the first historical fault event, the second historical fault event, and the third historical fault event based on the first sub-similarity, the second sub-similarity, and the third sub-similarity; and The matching result is determined based on the similarity between the log text, the sensor data, and the topology map and the historical log keywords, historical sensor time series data, and historical topology map of the target historical fault event, respectively.

5. The method according to claim 4, characterized in that The determining a target historical fault event from the first historical fault event, the second historical fault event, and the third historical fault event based on the first sub-similarity, the second sub-similarity, and the third sub-similarity includes: In response to determining that the first historical fault event, the second historical fault event, and the third historical fault event have the same historical fault event, determining the same historical fault event as the target historical fault event; In response to determining that there is no identical historical fault event among the first historical fault event, the second historical fault event, and the third historical fault event, a target historical fault event is determined from the first historical fault event, the second historical fault event, and the third historical fault event based on the first sub-similarity, the second sub-similarity, and the third sub-similarity.

6. The method according to claim 1, characterized in that The method further comprises: In response to determining that the similarity is greater than or equal to the preset threshold, obtaining historical fault causes and historical repair suggestions that have a mapping relationship with the historical fault data from the historical fault database; Generate a fault diagnosis result based on the historical fault causes and the historical repair suggestions.

7. The method according to claim 3, characterized in that The method further comprises: A historical fault database is updated using the log text, the sensor data, the topology map, the fault cause, and the repair suggestion.

8. A fault handling device, characterized in that: The device comprises: an acquisition module, configured to, in response to received alarm information regarding faulty hardware, acquire log text, sensor data, and a topology map of a faulty server where the faulty hardware is located, wherein the topology map represents a connection relationship between hardware in the faulty server; a matching module, configured to perform similarity matching on the log text, the sensor data, and the topology map with the historical fault data in a historical fault database to obtain a matching result, wherein the matching result includes the similarity between the log text, the sensor data, and the topology map and the historical fault data; and The diagnosis module is used to, in response to determining that the similarity is less than a preset threshold, use a multimodal large model to perform fault diagnosis on the alarm information, the log text, the sensor data and the topology map to obtain a fault diagnosis result.

9. An electronic device comprising: one or more processors; a memory for storing one or more computer programs, It is characterized in that the one or more processors execute the one or more computer programs to implement the steps of the method according to any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program or instruction stored thereon, characterized in that: When the computer program or instruction is executed by a processor, the steps of the method according to any one of claims 1 to 7 are implemented.

Images