Fault processing method and device of service system, electronic equipment and storage medium

Abstract

The invention provides a fault processing method and device of a service system, electronic equipment and a storage medium, and relates to the technical field of computers, in particular to the technical field of fault diagnosis and artificial intelligence. The method comprises the following steps: determining a current fault attribute in response to a current fault event of a service system, and obtaining a sub-fault event monitored in real time; the current fault attribute comprises a current fault time period, a current fault level and a triggering moment of a next fault level; according to the sub-fault event, extracting a current static entity associated with the current fault from a static knowledge graph of the service system; and performing fault positioning according to the current fault attribute and the current static entity to obtain a target fault root cause.

Description

Technical Field

[0001] The present disclosure relates to the fields of computer technology, in particular to fault diagnosis and artificial intelligence technology, and specifically to a method, device, electronic device, and storage medium for troubleshooting a business system. Background Art

[0002] Ad placement primarily involves clients, users, data, and business systems. Clients inject their desired ad content into the business system in the form of a structured data stream. The business system then completes a series of processes, including ad search and matching, effect model estimation, real-time bidding decisions, and ad interface rendering. Ultimately, it generates ad content that meets scenario requirements and presents it to end users.

[0003] Business systems often face various types of online anomalies during operation. These failures can directly lead to reduced advertising revenue or a degraded user experience. Therefore, troubleshooting business system failures is crucial. Summary of the Invention

[0004] The present disclosure provides a fault handling method, device, electronic device, and storage medium for a business system.

[0005] According to one aspect of the present disclosure, a method for handling a fault in a business system is provided, comprising:

[0006] Determine the current fault attributes in response to the current fault event of the business system and obtain the sub-fault events monitored in real time; the current fault attributes include the current fault time period, the current fault level, and the triggering time of the next fault level;

[0007] According to the sub-fault event, extracting a current static entity associated with the current fault from the static knowledge graph of the business system;

[0008] Fault location is performed according to the current fault attribute and the current static entity to obtain a target fault root cause.

[0009] According to one aspect of the present disclosure, a fault handling device for a business system is provided, comprising:

[0010] A fault attribute determination module is used to determine the current fault attribute in response to the current fault event of the business system and obtain the sub-fault events monitored in real time; the current fault attribute includes the current fault time period, the current fault level, and the triggering time of the next fault level;

[0011] A static entity extraction module, configured to extract, based on the sub-fault event, a current static entity associated with the current fault from the static knowledge graph of the business system;

[0012] The fault location module is used to perform fault location according to the current fault attribute and the current static entity to obtain a target fault root cause.

[0013] According to another aspect of the present disclosure, an electronic device is provided, the electronic device comprising:

[0014] at least one processor; and

[0015] a memory communicatively connected to the at least one processor; wherein,

[0016] The memory stores instructions that can be executed by the at least one processor. The instructions are executed by the at least one processor to enable the at least one processor to perform the method provided by any embodiment of the present disclosure.

[0017] According to another aspect of the present disclosure, a non-transitory computer-readable storage medium storing computer instructions is provided, wherein the computer instructions are used to enable a computer to execute the method provided by any embodiment of the present disclosure.

[0018] According to another aspect of the present disclosure, a computer program product is provided, including a computer program. When the computer program is executed by a processor, the computer program implements the method provided according to any embodiment of the present disclosure.

[0019] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present disclosure, nor are they intended to limit the scope of the present disclosure. Other features of the present disclosure will become readily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] Figure 1 This is a flowchart of a method for troubleshooting a business system according to an embodiment of the present disclosure;

[0021] Figure 2 is a flowchart of another method for troubleshooting a business system according to an embodiment of the present disclosure;

[0022] Figure 3 This is a flowchart of another method for troubleshooting a business system according to an embodiment of the present disclosure;

[0023] Figure 4a This is a flowchart of another method for troubleshooting a business system according to an embodiment of the present disclosure;

[0024] Figure 4b This is a schematic diagram of the architecture of a knowledge graph provided according to an embodiment of the present disclosure;

[0025] Figure 5 This is a structural diagram of a fault handling device for a business system provided according to an embodiment of the present disclosure;

[0026] Figure 6 4 is a block diagram of an electronic device used to implement the fault handling method of the business system according to an embodiment of the present disclosure. DETAILED DESCRIPTION

[0027] Figure 1 This is a flowchart of a fault handling method for a business system, according to an embodiment of the present disclosure. This method is applicable to handling online faults during advertising delivery based on a static knowledge graph of the business system. This method can be performed by a fault handling device for the business system, which can be implemented using software and / or hardware and integrated into electronic devices.

[0028] like Figure 1 As shown, the fault handling method of the business system of this embodiment may include:

[0029] S101, in response to a current fault event of a business system, determining current fault attributes and obtaining sub-fault events monitored in real time; the current fault attributes include a current fault time period, a current fault level, and a triggering time of the next fault level;

[0030] S102: extracting a current static entity associated with the current fault from the static knowledge graph of the business system according to the sub-fault event;

[0031] S103: Perform fault location according to the current fault attribute and the current static entity to obtain a target fault root cause.

[0032] For advertising delivery scenarios, various indicators of the business system can be monitored in real time, and a current fault event can be generated when the monitored abnormal indicators meet the fault trigger conditions. For example, real-time monitoring can be performed on traffic and fill indicators, ad display and bidding indicators, click and conversion indicators, business system stability indicators, and computer room characteristics. Among them, traffic and fill indicators may include page views (PV), system return fill rate (Page View Response Rate, PVR), and exposure rate (Exposure Rate, E-Show); ad display and bidding indicators may include average ads served number per page view (ASN); click and conversion indicators may include average cost per click (ACP), average click-through rate (CTR); business system stability indicators may include system response time, error rate, concurrent processing capacity, etc.; computer room characteristics may include CPU utilization, disk I / O utilization, network bandwidth utilization, computer room temperature, humidity, power consumption, etc.

[0033] For each abnormal indicator monitored in real time, a corresponding sub-fault event can be generated, that is, there is a one-to-one correspondence between abnormal indicators and sub-fault events, and the current fault event can correspond to one or more sub-fault events. For the current fault event, at least one corresponding abnormal indicator and a curve of the abnormal indicator changing over time (which can be called a fault curve) can be obtained. The curve of the abnormal indicator changing can be analyzed to obtain the current fault time period, especially the start time of the current fault; the monitoring data within the current fault time period can be analyzed to obtain the current fault level; the triggering time of the next fault level can also be determined based on the preset different fault levels and the monitoring data within the current fault time period. The closer the triggering time of the next fault level is, the higher the priority of handling the current fault. When the current fault event is monitored in real time, by determining the current fault time period and the current fault level of the current fault, especially determining the triggering time of the next fault level in advance, the propagation rate of the fault risk can be quantified, which serves as the basis for subsequent positioning of the current fault, thereby improving the efficiency and accuracy of subsequent positioning of the current fault.

[0034] The various static entities and relationships between them in the Static Knowledge Graph (SKG) can be obtained through static processing such as white-box identification of the business system's code. The Static Knowledge Graph can include at least one of the following entity types: physical entities, business entities, alarm entities, positioning tool entities, indicator entities, and business expert entities. Physical entities can include functional modules and cached lexicons. The cached lexicon can use a key-value format to store data that the business system needs to access, such as the bid coefficient for a specific ad type, the creative parameters of an ad ID, file paths, rendering template IDs, and the account status, budget, and industry classification of an advertiser ID. By retrieving data from the cached lexicon, the business system can improve ad delivery efficiency compared to accessing a database. Business entities can include ad placement types (e.g., short dramas, e-commerce), and ad style types, used to monitor ad display performance. Alarm entities generate alarm signals based on abnormal status triggers driven by pre-set rules, using log tracking, indicator thresholds, and dependency chain monitoring. Positioning tool entities are microservices used to perform positioning analysis on the business system. Indicator entities correspond to indicators in the business system's indicator set. Exemplarily, the sub-fault event can be matched with each static entity in the static knowledge graph to obtain the current static entity associated with the current fault, such as the current alarm entity, current business entity, current physical entity, current indicator entity, etc. associated with the current fault.

[0035] Furthermore, the current fault is located by combining the current fault time period, the current fault level, the triggering time of the next fault level, and the current static entity associated with the current fault to obtain the target fault root cause. On the one hand, by combining the current fault time period, the current fault level, and the triggering time of the next fault level to locate the current fault, the dynamic changes in the fault level on the timeline can be used to predict the remaining deterioration time and quantify the fault risk propagation rate. On the other hand, by matching sub-fault events to specific current static entities, environmental interference can be reduced, thereby achieving rapid pruning and precise attribution of fault causal chains in complex business systems with multi-variable coupling, thereby improving the efficiency and accuracy of fault location.

[0036] The technical solution provided by the embodiments of the present disclosure responds to the current fault event of the business system, determines the current fault time period, current fault level, and triggering time of the next fault level of the current fault, and matches the corresponding sub-fault event with the static knowledge graph of the business system to obtain the current static entity associated with the current fault; combines the current fault time period, current fault level, next fault level, and current static entity of the current fault to locate the current fault and obtain the target fault root cause, which can not only quantify the fault risk propagation rate, but also reduce environmental interference, thereby improving the efficiency and accuracy of fault location.

[0037] Figure 2 This is a flowchart of another method for troubleshooting a business system according to an embodiment of the present disclosure. Figure 2 Based on the above embodiment, the fault handling method of the business system of this embodiment may include:

[0038] S201, in response to a current fault event triggered by a billing anomaly in the business system, obtaining the abnormal time, and analyzing the billing data before the abnormal time to obtain an inflection point time and a current fault time period from the inflection point time to the abnormal time;

[0039] S202: Determine the current loss value based on the benchmark billing data for the benchmark time period, the historical billing data for the same period in the historical time period, and the current billing data for the current fault time period; the benchmark time period is a time interval with a fixed length of time starting from the inflection point;

[0040] S203, determining a current fault level according to the current loss value;

[0041] S204, determining a triggering time for the next fault level according to the current loss value, the current fault time period, and a preset loss threshold for the next level;

[0042] S205: extracting a current static entity associated with the current fault from the static knowledge graph of the business system according to the sub-fault event;

[0043] S206: Perform fault location according to the current fault attribute and the current static entity to obtain a target fault root cause.

[0044] In an embodiment of the present disclosure, the charge of a business system is monitored. Charge refers to the fees generated according to rules for actions such as ad exposure, clicks, and conversions. The charge of a business system can be calculated by multiplying the system's PV, ACP, CTR, PVR, and ASN. For example, the year-on-year and year-on-year values of the charge in the business system can be calculated in real time. If the year-on-year and year-on-year values are lower than a preset year-on-year threshold, a fault trigger condition is determined to have been met, a current fault event is generated, and the abnormal time (which may be referred to as the fault time) and the corresponding sub-fault event are obtained. The year-on-year value is determined by comparing the current period data with the same period last year to reflect long-term fluctuation trends; the year-on-year value is determined by comparing the current period data with the previous period data to reflect short-term fluctuation trends. Using a binary method, the charge change curve before the abnormal time can be analyzed to determine the inflection point at which the charge began to decline, as well as the current fault time period starting and ending at the inflection point and the abnormal time. By focusing on advertising delivery effectiveness and performing real-time fault monitoring on the billing data of the business system, the isolated indicator threshold detection model is abandoned, achieving accurate fault capture and false alarm filtering.

[0045] In the embodiment of the present disclosure, a reference time period is obtained by tracing back a fixed length of time (e.g., 1 hour) with the inflection point as the end point, for example, the time interval from the previous hour to the inflection point time is used as the reference time period; the historical time period of the current fault time period is also obtained, and the current fault time period is taken as today's 17:00-17:30 as an example, and the historical time period of the previous few days can be 17:00-17:30. The benchmark change trend of the billing data can be determined based on the benchmark billing data of the benchmark time period, and the current billing data can be corrected in combination with the benchmark change trend to obtain the corrected current billing data; the current loss value can be determined by combining the corrected current billing data and the historical billing data of the same period. By determining the benchmark change trend of the billing data based on the benchmark billing data, and determining the current loss value by combining the benchmark change trend, the current billing data, and the historical billing data of the same period, the influence of the benchmark change trend on the current loss value can be eliminated, thereby improving the accuracy of the current loss value.

[0046] Furthermore, the current fault level can be determined based on the current loss value, for example, by multiplying the current loss value by a preset level coefficient. The rate of change in billing can also be determined by combining the current loss value, the current fault time period, and the preset loss threshold for the next level. This rate of change in billing can also be used to determine the triggering time for the next fault level. By determining the triggering time for the current and next fault levels based on the current loss value, the accuracy of the current and next fault levels is improved.

[0047] In an optional embodiment, the current loss value is determined based on the benchmark billing data in the benchmark time period, the historical billing data in the historical same period time period, and the current billing data in the current fault time period, including: analyzing the benchmark billing data of the business system in the benchmark time period to obtain a benchmark year-on-year comparison; determining the current loss value based on the historical billing data of the business system in the historical same period time period, the current billing data in the current fault time period, and the benchmark year-on-year comparison.

[0048] In the disclosed embodiment, the benchmark year-on-year and year-on-year ratio of the benchmark time period can be determined based on the benchmark billing data, and the historical billing data for the same period and the current billing data are summarized to obtain the total billing data for the historical period and the total billing data for the current fault; and the current loss value is calculated using the following formula: current loss value = [total billing data for the historical period - total billing data for the current fault × (1 + benchmark year-on-year and year-on-year ratio)] × loss assessment coefficient; wherein the loss assessment coefficient is also an empirical value. The benchmark year-on-year ratio is obtained by analyzing the benchmark billing data, and the current loss value can be accurately obtained by combining the historical billing data for the same period, the current billing data, and the benchmark year-on-year ratio, thereby improving the accuracy of the subsequent determination of the current fault level and the triggering moment of the next fault level.

[0049] In an optional embodiment, determining the triggering moment of the next fault level based on the current loss value, the current fault time period and the preset loss threshold of the next level includes: determining the loss rate based on the current loss value and the current fault time period; determining the loss difference between the preset loss threshold of the next level and the current loss value, and determining the triggering moment of the next fault level based on the loss difference and the loss rate.

[0050] For example, the current fault duration can be determined based on the inflection point and abnormal moment of the current fault time period. The current loss amount is divided by the current fault duration to obtain the loss rate of the billing indicator, thus accurately quantifying the fault risk propagation rate. A preset loss threshold for the next level (e.g., 10W) is also obtained. The loss difference is subtracted from the loss threshold for the next level to obtain the loss difference. The loss difference is divided by the loss rate to obtain the remaining time for fault escalation. The abnormal moment and the remaining time for fault escalation are combined to obtain the trigger time for the next level. By combining the current loss value and the current fault time period to quantify the fault risk propagation rate and using the quantified results to predict the trigger time for the next fault level, the accuracy of the prediction results is improved.

[0051] The technical solution provided by the embodiments of the present disclosure determines the benchmark year-on-year and year-on-year growth according to the benchmark billing data, takes the benchmark year-on-year and year-on-year growth as the benchmark reference system, and determines the current loss value in combination with the historical billing data for the same period. This can eliminate the inherent interference of the benchmark trend on the loss value (such as seasonal fluctuations, cyclical growth, etc.), and significantly improve the quantitative accuracy of the current loss value; based on the precise loss value, not only the current fault level is determined, but also the loss rate of the billing data is calculated in combination with the current fault time period and the loss threshold of the next level, and the triggering time of the next fault level is predicted based on the loss rate, thereby improving the accuracy of the current fault level and the triggering time of the next fault level, thereby improving the accuracy of locating the current fault based on this.

[0052] Figure 3 This is a flowchart of another method for troubleshooting a business system according to an embodiment of the present disclosure. Figure 3 Based on the above embodiment, the fault handling method of the business system of this embodiment may include:

[0053] S301, in response to a current fault event of the business system, determining current fault attributes and obtaining sub-fault events monitored in real time; the current fault attributes include the current fault time period, the current fault level, and the triggering time of the next fault level;

[0054] S302: extracting a current static entity associated with the current fault from the static knowledge graph of the business system according to the sub-fault event;

[0055] S303: Input the current fault attribute and the current static entity into a large language model to obtain a preliminary root cause of the current fault; the current static entity includes a current alarm entity, a current business entity, a current physical entity, and a current indicator entity;

[0056] S304: Generate an event ticket for the current fault based on the current fault attribute, the current business entity, the current physical entity, and the preliminary fault root cause;

[0057] S305: extracting the associated current business expert entity from the static knowledge graph according to the current business entity, and creating a communication group for the event ticket;

[0058] S306: Extract the associated current positioning tool entity from the static knowledge graph according to the current business entity, and call the current positioning tool to perform fault location on the current fault to obtain the target fault root cause.

[0059] Exemplarily, the sub-fault event can be semantically matched with the alarm entity in the static knowledge graph to obtain the associated current alarm entity; the current business entity and / or current physical entity connected to the current alarm entity is extracted from the static knowledge graph, and the current indicator entity connected to the current business entity and / or current physical entity is extracted from the static knowledge graph, that is, the current static entity includes the current alarm entity, the current business entity and / or the current physical entity, and the current indicator entity.

[0060] During the initial attribution phase, the current fault time period, current fault level, trigger time for the next fault level, current alarm entity, current business entity and / or current physical entity, current indicator entity, and so on can be input into a large language model (LLM). Based on the LLM's natural language understanding and logical reasoning capabilities, these data are analyzed to determine the initial root cause of the current fault. Furthermore, the business system's troubleshooting experience can be incorporated into the LLM to further improve the efficiency and quality of initial attribution. Troubleshooting experience can include the relationship between indicator anomalies and functional modules, the order of positioning and troubleshooting, etc. For example, PV anomalies are generally caused by reduced external traffic, ACP anomalies may be caused by advertiser bids or inaccurate conversion rate model estimates, CTR anomalies may be caused by style issues or inaccurate click-through rate model estimates, PVR and ASN anomalies may be caused by system retrieval module filtering issues or filtering caused by model anomalies, etc. CPU positioning is an analysis of stability issues in the business system. Problems with the indicators of certain functional modules will lead to decreased ad returns or inaccurate model estimates. Advertising funnel analysis is used to analyze ad return data for the core retrieval module in the business system. Abnormalities in the module's ad return count will directly cause abnormalities in the PVR and ASN indicators, and will indirectly affect indicators such as ACP or CTR. The order of positioning and troubleshooting can be stability analysis before data center feature analysis.

[0061] In the disclosed embodiment, an incident ticket (Incident Ticket) for the current fault can be automatically generated based on the current fault attributes such as the current fault time period, the current fault level, and the triggering time of the next fault level, the current business entity, the current physical entity, and the preliminary root cause of the fault. An incident ticket is a standardized record document generated when a business system fault occurs, which is used to describe the fault phenomenon, quantify the business impact, track the processing progress, and attribute the fault; and, based on the association relationship between the business entity and the business expert entity in the static knowledge graph, the current business expert entity associated with the current business entity is extracted from the static knowledge graph, and a communication group is quickly created for the current business expert entity through an automated script. For example, an interface of an instant messaging application is called to automatically create a communication group for each current business expert, and the incident ticket for the current fault is displayed in the communication group, thereby achieving instant synchronization of fault information and multi-party collaboration. By automatically extracting the current business expert entity from the static knowledge graph and automatically creating a communication group, the efficiency and accuracy of creating the communication group are improved compared to determining the current business expert entity and creating the communication group through manual experience, thereby improving the efficiency of fault handling.

[0062] Among them, the association relationship between business entities and business expert entities in the static knowledge graph can be obtained by mining the email content and demand cards of the business system, thereby improving the reliability of the association relationship between business entities and business expert entities. For example, the project launch notification emails and business entities of the product line corresponding to the business entity can be collected offline, and the project launch notification emails can be analyzed and matched with the business entity through a large language model to obtain the business expert entity matching the business entity, and the business expert entity and the association relationship between the business expert entity and the business entity can be created in the static knowledge graph. The requirements and business entities of the product line corresponding to the business entity can also be collected offline, and the demand cards can be parsed through a large language model to obtain the demand person in charge and the business entity associated with the demand person in charge; the demand cards can be sorted according to business revenue contribution, customer retention rate, compliance risk, etc., and the demand persons in the top-ranked demand cards can be regarded as business experts, and the business expert entity and the association relationship between the business expert entity and the business entity can be created in the static knowledge graph.

[0063] During the target attribution phase, the current business entity is matched with the positioning tool entities in the static knowledge graph to obtain at least one associated current positioning tool entity. The current positioning tool entity (i.e., the current positioning microservice) is then called to automatically locate and analyze the business system to determine the root cause of the target fault, specifically the target functional module or target cache vocabulary that caused the current fault. The positioning tool set for advertising delivery scenarios can include basic analysis positioning tools, change analysis positioning tools, component analysis positioning tools, and funnel analysis positioning tools. By using a large language model to analyze the current fault attributes and current static entities, a preliminary root cause of the fault is obtained; then, the current fault attribute, current business entity, current physical entity, and preliminary root cause are combined to automatically generate an event ticket for the current fault, and the current business expert entity associated with the current business entity is automatically and accurately extracted from the static knowledge graph. Through automated scripts, a communication group including the current business expert entity is quickly created to achieve instant synchronization of fault information and multi-party collaboration; moreover, the current positioning tool entity adapted to the current fault is called from the static knowledge graph, the fault positioning process is automatically executed, and the target fault root cause is output, forming a full-link automated closed loop of "root cause derivation-event ticket generation-expert collaboration-tool positioning", which significantly improves the efficiency and accuracy of root cause positioning.

[0064] In an optional embodiment, according to the current business entity, the associated current positioning tool entity is extracted from the static knowledge graph, and the current positioning tool is called to locate the current fault to obtain the target fault root cause, including: matching the current business entity with the input parameters of the positioning tool entity in the static knowledge graph to obtain a successfully matched current positioning tool entity, and obtaining the technical dependency relationship between different current positioning tool entities from the static knowledge graph; obtaining the specified calling sequence between different current positioning tool entities, fusing the technical dependency relationship and the specified calling sequence to obtain the target execution sequence; calling the current positioning tool according to the target execution sequence to obtain the target fault root cause.

[0065] In the target attribution stage, semantic feature extraction and matching degree calculation can be performed on the input parameters of the current business entity (such as the current ad slot type, current ad style type, current product line, and other current business data associated with the current fault) and the positioning tool entity to screen out different current positioning tool entities associated with the current business entity; the technical dependency relationships between different current positioning tool entities are parsed from the static knowledge graph, and the specified calling sequence between different current positioning tool entities is obtained from the troubleshooting experience knowledge. The structured dynamic dependency relationship and the empirical rules of the calling sequence are integrated to obtain the target execution sequence, and the cascade call of different current positioning tools is automatically triggered according to the target execution sequence. That is, the intelligent orchestration and precise calling of the positioning tools are realized through the semantic collaboration mechanism, which can avoid positioning blind spots and repeated processing caused by disordered positioning tool calls, and further improve the efficiency of fault positioning.

[0066] In an optional embodiment, after generating the event ticket for the current fault, it also includes: displaying the current indicator entity associated with the current business entity in the form of a chart in the event ticket; extracting other physical entities associated with the current physical entity and other indicator entities associated with the other physical entities from the static knowledge graph, and displaying them in a tree structure in the event ticket.

[0067] In the embodiment of the present disclosure, the current indicator entity can be displayed at the front end of the event list to improve the positioning efficiency. For the current indicator entity connected to the current business entity extracted from the static knowledge graph according to the current business entity (such as advertising type, advertising style, delivery strategy, etc.), it can be displayed according to the type of the current indicator entity, and assembled and rendered into a chart form according to the specified format, and displayed at the front end of the event list, so that the positioning personnel can directly observe the fluctuation of the business layer indicators. For the current indicator entity connected to the current physical entity (such as cache hit rate, module response delay, word list update delay, etc.) extracted from the static knowledge graph according to the current physical entity (such as functional module, cache word list), the upstream and downstream physical entities associated with the current physical entity and the corresponding other indicator entities can be further extracted from the static knowledge graph, and the dependency graph of the corresponding indicators can be dynamically rendered in a tree structure and displayed at the front end of the event list. In addition, the same-chain and month-on-month comparisons of the current indicator entity and other indicator entities can be calculated in real time to obtain abnormal indicator entities that deviate from the threshold, and the abnormal indicator entities can be highlighted in the chart or tree diagram using color highlighting and icon warning light differentiated visual identification to facilitate troubleshooting by the positioning personnel.

[0068] In an optional embodiment, before calling the current positioning tool to locate the current fault, it also includes: displaying the input parameters and positioning function of the current positioning tool in the event sheet; and updating the current positioning tool in response to editing operations on the input parameters and / or positioning function.

[0069] In the disclosed embodiment, a visual interactive interface for positioning tool configuration can also be constructed through the event sheet front end to display the input parameters (such as time range, entity ID, threshold conditions, etc.) and positioning function name of the current positioning tool in real time, so that positioning personnel can initiate parameter adjustment or function optimization in the event sheet interface based on real-time diagnostic results, and update the current positioning tool in response to captured editing operations on any input parameter and / or positioning function of the current positioning tool, thereby further improving the flexibility and positioning quality of the current positioning tool.

[0070] The technical solution provided by the embodiment of the present disclosure uses a large language model to perform semantic analysis on the current fault attributes and current static entities to generate a preliminary root cause of the fault, and automatically generates an event sheet containing context information based on this; and accurately extracts the related current business expert entities from the static knowledge graph according to the current business entity, builds a communication group using an automated script, extracts the matching current positioning tool entities, and automatically arranges the target calling sequence between different current positioning tools, thereby realizing the intelligent arrangement and precise calling of positioning tools; and dynamically displays the current indicator entity on the front end of the event sheet, further improving the convenience of fault handling.

[0071] Figure 4a This is a flowchart of another method for troubleshooting a business system according to an embodiment of the present disclosure. Figure 4a Based on the above embodiment, the fault handling method of the business system of this embodiment may include:

[0072] S401, in response to a current fault event of the business system, determining current fault attributes and obtaining sub-fault events monitored in real time; the current fault attributes include the current fault time period, the current fault level, and the triggering time of the next fault level;

[0073] S402: extracting a current static entity associated with the current fault from the static knowledge graph of the business system according to the sub-fault event;

[0074] S403, performing fault location according to the current fault attribute and the current static entity to obtain a target fault root cause;

[0075] S404: Acquire an actual stop-loss operation for the current fault according to the current fault time period and the current physical entity in the current static entity;

[0076] S405, screening the actual stop-loss operations according to the target fault root cause to obtain a target stop-loss operation associated with the current fault;

[0077] S406: Restore the current fault according to the target stop-loss operation.

[0078] Operation and maintenance personnel can perform stop-loss operations on the current fault to reduce losses. Stop-loss operations include but are not limited to stopping changes, cutting experiments, module rollbacks, vocabulary rollbacks, machine room flow cuts, system downgrades, expansions and contractions, system restarts, recovery changes, recovery experiments, etc. Each stop-loss operation can be stored according to the progress of stop-loss time, product line, operating platform, operator, operation content, and operation content. For example, the actual stop-loss operation for the current fault can be obtained from the stop-loss operations of the business system based on the current fault time period (such as the inflection point time) and the current physical entity; and, semantic matching is performed on the target physical entity in the target fault root cause and the various actual stop-loss operations, filtering out interfering stop-loss operations that are not related to the current fault, and obtaining the target stop-loss operation associated with the current fault, thereby improving the accuracy of the target stop-loss operation; moreover, the recovery operation associated with the target stop-loss operation is determined, and the recovery operation is used to restore the current fault, thereby improving the efficiency and accuracy of the recovery.

[0079] In an optional embodiment, the actual stop-loss operation is filtered according to the target fault root cause to obtain the target stop-loss operation associated with the current fault, including: obtaining the target physical entity associated with the current fault in the target fault root cause, and extracting the target change event associated with the target physical entity from the actual change event of the business system; inputting the target fault root cause, the target change event and the actual stop-loss operation into a large language model to obtain the target stop-loss operation associated with the current fault.

[0080] In the disclosed embodiment, the actual change events of the business system can be obtained through continuous deployment (CD) grading, that is, the functional modules and cached vocabulary of the actual changes in the business system are obtained; the target physical entity in the target fault root cause is combined with the target change event associated with the target physical entity from the actual change event; the target fault root cause, target change event, and actual stop-loss operation are input into the large language model, and the large language model's natural language understanding and logical reasoning capabilities are used to parse and output the target stop-loss operation, thereby improving the accuracy of the target stop-loss operation. In addition, troubleshooting notices can be extracted from the communication group of the current fault, and the troubleshooting notices can also be input into the large language model to further enrich the information source for stop-loss operation screening, thereby improving the accuracy of the target stop-loss operation.

[0081] In an optional embodiment, restoring the current fault according to the target stop-loss operation includes: determining whether the current fault meets the fault recovery condition based on the real-time billing data and / or real-time indicator data of the business system; if the fault recovery condition is met, determining at least one target recovery operation associated with the target stop-loss operation, and executing the target recovery operation.

[0082] In an embodiment of the present disclosure, a trigger can be automatically triggered to determine whether the fault curve has recovered after a preset time period (for example, 2 hours) after the event ticket is created. Exemplarily, the real-time year-on-year and year-on-year comparison of billing can be updated based on the real-time billing data of the business system to determine whether the real-time year-on-year and year-on-year comparison meets the fault recovery conditions; or, the real-time indicator data in the business system can be monitored to determine whether the real-time indicator data meets the fault recovery conditions, such as determining whether abnormal computer room characteristics such as CPU utilization, disk I / O utilization, and network bandwidth utilization have returned to normal. If the fault recovery conditions are met, the target recovery operation sequence associated with the target stop-loss operation is determined based on the association relationship between the pre-constructed stop-loss operation sequence and the recovery operation sequence, and the corresponding recovery operation is executed in accordance with the recovery order in the target recovery operation sequence. By determining at least one target recovery operation when the current fault meets the fault recovery conditions, and executing the target recovery operation in the order between different target recovery operations, the timeliness and accuracy of the recovery process are improved.

[0083] The technical solution provided by the embodiments of the present disclosure determines the actual stop-loss operation and target change event for the current fault based on the target physical entity affected in the target fault root cause, and screens out effective target stop-loss operations from the actual stop-loss operations through multi-source information fusion reasoning such as the target fault root cause, the actual stop-loss operation, and the target change event through a large language model; and, when the fault recovery conditions are met, determines the target recovery operation associated with the target stop-loss operation and executes the target recovery operation, thereby improving the timeliness and accuracy of the recovery processing.

[0084] In the embodiment of the present disclosure, an event knowledge graph (EKG) and a fault knowledge graph (FKG) can also be dynamically constructed based on the processing data of the current fault. Figure 4b, change event entities, fault event entities, positioning event entities, target stop-loss event entities, etc. can be dynamically added to the event knowledge graph. For example, in response to the change event of any functional module or cache word list in the business system monitored during the CD grading process, a corresponding change event entity is created in the event knowledge graph; in response to the current fault event and sub-fault event perceived and identified by real-time monitoring of the business system, a current fault event entity and a sub-fault event entity are dynamically created in the event knowledge graph; for the preliminary fault root cause and the call of the current positioning tool, a corresponding preliminary positioning event entity and a current positioning event entity are dynamically created in the event knowledge graph; and a target stop-loss event entity is created for the target stop-loss operation. The relationship between different event entities in the event knowledge graph and the relationship between event entities and static entities in the static knowledge graph can be established. For example, the relationship between the actual sub-fault entity and the alarm entity in the static knowledge graph can be established; based on the corresponding positioning attribution results, an association relationship between the positioning event entity and the corresponding physical entity and business entity in the static knowledge graph can be established.

[0085] refer to Figure 4b After the current fault is restored, the end time of the current fault can be obtained, resulting in the fault handling period from the inflection point to the end time. Based on the billing data and indicator data during the fault handling period, the loss of the current fault is determined. A standard fault entity is created in the fault knowledge graph, and relationships are established between the fault entity and the static entities in the static knowledge graph and the event entities in the event knowledge graph. The static knowledge graph, event knowledge graph, and fault knowledge graph serve as a knowledge base for fault handling, enabling location, stop-loss, and recovery when similar faults are subsequently triggered.

[0086] Figure 5 This is a schematic diagram of the structure of a fault handling device for a business system according to an embodiment of the present disclosure. The device is suitable for handling online faults during the advertising delivery process based on the static knowledge graph of the business system. The device can be implemented in software and / or hardware and can be integrated into electronic devices. Figure 5 As shown, the fault handling device 500 of the business system of this embodiment may include:

[0087] The fault attribute determination module 510 is configured to determine the current fault attribute in response to the current fault event of the business system and obtain the sub-fault events monitored in real time; the current fault attribute includes the current fault time period, the current fault level, and the triggering time of the next fault level;

[0088] A static entity extraction module 520 is configured to extract, based on the sub-fault event, current static entities associated with the current fault from the static knowledge graph of the business system;

[0089] The fault location module 530 is configured to perform fault location according to the current fault attribute and the current static entity to obtain a target fault root cause.

[0090] In an optional implementation, the fault attribute determination module 510 includes:

[0091] a fault time period unit, configured to obtain the abnormal time in response to the current fault event triggered by the abnormal billing of the business system, and to analyze the billing data before the abnormal time to obtain the inflection point time and the current fault time period from the inflection point time to the abnormal time;

[0092] a loss value unit, configured to determine a current loss value based on benchmark billing data for a benchmark time period, historical billing data for a historical time period for the same period, and current billing data for the current fault time period; the benchmark time period being a time interval with a fixed length of time tracing back from the inflection point;

[0093] a fault level unit, configured to determine a current fault level according to the current loss value;

[0094] The triggering time unit is used to determine the triggering time of the next fault level according to the current loss value, the current fault time period and the preset loss threshold of the next level.

[0095] In an optional implementation, the loss value unit includes:

[0096] A benchmark subunit is used to analyze the benchmark billing data of the business system in the benchmark time period to obtain a benchmark year-on-year comparison;

[0097] The loss value subunit is used to determine the current loss value based on the historical billing data of the business system in the historical period, the current billing data in the current fault period, and the benchmark year-on-year comparison.

[0098] In an optional implementation, the triggering moment unit includes:

[0099] a loss rate subunit, configured to determine a loss rate according to the current loss value and the current fault time period;

[0100] The triggering moment subunit is used to determine the loss difference between the preset loss threshold of the next level and the current loss value, and determine the triggering moment of the next fault level according to the loss difference and the loss rate.

[0101] In an optional implementation, the fault location module 530 includes:

[0102] A preliminary root cause unit is configured to input the current fault attribute and the current static entity into a large language model to obtain a preliminary root cause of the current fault; the current static entity includes a current alarm entity, a current business entity, a current physical entity, and a current indicator entity;

[0103] An event ticket generating unit, configured to generate an event ticket for the current fault according to the current fault attribute, the current business entity, the current physical entity, and the preliminary fault root cause;

[0104] A communication group unit, configured to extract, based on the current business entity, an associated current business expert entity from the static knowledge graph, and create a communication group for the event ticket;

[0105] The target root cause unit is used to extract the associated current positioning tool entity from the static knowledge graph according to the current business entity, and call the current positioning tool to perform fault positioning on the current fault to obtain the target fault root cause.

[0106] In an optional implementation, the target root cause unit includes:

[0107] A positioning tool subunit is used to match the current business entity with the input parameters of the positioning tool entity in the static knowledge graph to obtain a successfully matched current positioning tool entity, and to obtain technical dependency relationships between different current positioning tool entities from the static knowledge graph;

[0108] An execution sequence subunit is used to obtain a specified calling sequence between different current positioning tool entities, and fuse the technical dependency relationship and the specified calling sequence to obtain a target execution sequence;

[0109] The target root factor unit is used to call the current positioning tool according to the target execution sequence to obtain the target fault root cause.

[0110] In an optional implementation, the fault location module 530 further includes an indicator display unit, which is specifically configured to:

[0111] Displaying the current indicator entity associated with the current business entity in the event sheet in the form of a chart;

[0112] Other physical entities associated with the current physical entity and other indicator entities associated with the other physical entities are extracted from the static knowledge graph and displayed in a tree structure in the event list.

[0113] In an optional implementation, the fault location module 530 further includes a location tool updating unit, which is specifically configured to:

[0114] Displaying the input parameters and positioning function of the current positioning tool in the event list;

[0115] In response to an editing operation on the input parameter and / or the positioning function, the current positioning tool is updated.

[0116] In an optional embodiment, the apparatus 500 further includes a stop-loss recovery module, and the stop-loss recovery module includes:

[0117] a stop-loss obtaining unit, configured to obtain an actual stop-loss operation for the current fault according to the current fault time period and the current physical entity in the current static entity;

[0118] a stop-loss screening unit, configured to screen the actual stop-loss operations according to the target fault root cause to obtain a target stop-loss operation associated with the current fault;

[0119] A fault recovery unit is used to recover the current fault according to the target stop-loss operation.

[0120] In an optional embodiment, the stop-loss screening unit is specifically configured to:

[0121] Obtaining a target physical entity associated with the current fault in the target fault root cause, and extracting a target change event associated with the target physical entity from the change event of the business entity;

[0122] The target fault root cause, the target change event, and the actual stop-loss operation are input into a large language model to obtain a target stop-loss operation associated with the current fault.

[0123] In an optional implementation manner, the fault recovery unit is specifically configured to:

[0124] Determine whether the current fault meets the fault recovery conditions based on the real-time billing data and / or real-time indicator data of the business system;

[0125] If the fault recovery condition is met, at least one target recovery operation associated with the target stop-loss operation is determined and the target recovery operation is executed.

[0126] The technical solution provided by the embodiments of the present disclosure performs fault monitoring, positioning, stop-loss and recovery processing based on a static knowledge graph of the business system, and dynamically updates the event knowledge graph and fault knowledge graph according to the positioning processing data as a knowledge base for subsequent fault processing.

[0127] In the technical solutions disclosed herein, the acquisition, storage, and application of user personal information involved comply with the provisions of relevant laws and regulations and do not violate public order and good morals.

[0128] According to an embodiment of the present disclosure, the present disclosure also provides an electronic device, a readable storage medium, and a computer program product.

[0129] Figure 6 4 is a block diagram of an electronic device used to implement the fault handling method of the business system according to an embodiment of the present disclosure. Figure 6 A schematic block diagram of an example electronic device 600 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are provided as examples only and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0130] like Figure 6 As shown, the electronic device 600 includes a computing unit 601, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 602 or a computer program loaded from a storage unit 608 into a random access memory (RAM) 603. Various programs and data required for the operation of the electronic device 600 can also be stored in the RAM 603. The computing unit 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0131] Multiple components in the electronic device 600 are connected to the I / O interface 605, including an input unit 606, such as a keyboard, a mouse, etc.; an output unit 607, such as various types of displays, speakers, etc.; a storage unit 608, such as a magnetic disk, an optical disk, etc.; and a communication unit 609, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 609 allows the electronic device 600 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0132] The computing unit 601 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various computing units that run machine learning model algorithms, digital signal processors (DSPs), and any suitable processors, controllers, microcontrollers, etc. The computing unit 601 performs the various methods and processes described above, such as the fault handling method for the business system. For example, in some embodiments, the fault handling method for the business system can be implemented as a computer software program that is tangibly contained in a machine-readable medium, such as the storage unit 608. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 600 via the ROM 602 and / or the communication unit 609. When the computer program is loaded into the RAM 603 and executed by the computing unit 601, one or more steps of the fault handling method for the business system described above can be performed. Alternatively, in other embodiments, the computing unit 601 can be configured to perform the fault handling method for the business system by any other suitable means (e.g., by means of firmware).

[0133] Figure 6 A schematic block diagram of an example electronic device 600 that can be used to implement embodiments of the present disclosure is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smartphones, wearable devices, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are provided as examples only and are not intended to limit the implementation of the present disclosure described and / or claimed herein.

[0134] like Figure 6 As shown, the electronic device 600 includes a computing unit 601, which can perform various appropriate actions and processes according to a computer program stored in a read-only memory (ROM) 602 or a computer program loaded from a storage unit 608 into a random access memory (RAM) 603. Various programs and data required for the operation of the electronic device 600 can also be stored in the RAM 603. The computing unit 601, the ROM 602, and the RAM 603 are connected to each other via a bus 604. An input / output (I / O) interface 605 is also connected to the bus 604.

[0135] Multiple components in the electronic device 600 are connected to the I / O interface 605, including an input unit 606, such as a keyboard, a mouse, etc.; an output unit 607, such as various types of displays, speakers, etc.; a storage unit 608, such as a magnetic disk, an optical disk, etc.; and a communication unit 609, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 609 allows the electronic device 600 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0136] The computing unit 601 can be any general-purpose and / or specialized processing component with processing and computing capabilities. Some examples of the computing unit 601 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various specialized artificial intelligence (AI) computing chips, various computing units that run machine learning model algorithms, digital signal processors (DSPs), and any suitable processors, controllers, microcontrollers, etc. The computing unit 601 performs the various methods and processes described above, such as the fault handling method for the business system. For example, in some embodiments, the fault handling method for the business system can be implemented as a computer software program that is tangibly contained in a machine-readable medium, such as the storage unit 608. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 600 via the ROM 602 and / or the communication unit 609. When the computer program is loaded into the RAM 603 and executed by the computing unit 601, one or more steps of the fault handling method for the business system described above can be performed. Alternatively, in other embodiments, the computing unit 601 can be configured to perform the fault handling method for the business system by any other suitable means (e.g., by means of firmware).

[0137] Various embodiments of the systems and techniques described above can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), system-on-chip systems (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments can include being implemented in one or more computer programs that are executable and / or interpreted on a programmable system that includes at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0138] The program code for implementing the method of the present disclosure can be written in any combination of one or more programming languages. These program codes can be provided to a processor or controller of a general-purpose computer, a special-purpose computer, or other programmable data processing device so that when the program code is executed by the processor or controller, the functions / operations specified in the flow chart and / or block diagram are implemented. The program code can be executed entirely on the machine, partially on the machine, as a stand-alone software package, partially on the machine and partially on a remote machine, or entirely on a remote machine or server.

[0139] In the context of the present disclosure, a machine-readable medium can be a tangible medium that can contain or store a program for use by or in conjunction with an instruction execution system, device or equipment. A machine-readable medium can be a machine-readable signal medium or a machine-readable storage medium. A machine-readable medium can include, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or equipment, or any suitable combination of the foregoing. A more specific example of a machine-readable storage medium can include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0140] To provide interaction with a user, the systems and techniques described herein can be implemented on a computer having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user can provide input to the computer. Other types of devices can also be used to provide interaction with the user; for example, the feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including acoustic input, audio input, or tactile input).

[0141] The systems and techniques described herein can be implemented in a computing system that includes back-end components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes front-end components (e.g., a user computer with a graphical user interface or a web player through which a user can interact with embodiments of the systems and techniques described herein), or a computing system that includes any combination of such back-end components, middleware components, or front-end components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), and the Internet.

[0142] A computer system may include a client and a server. The client and server are generally remote from each other and typically interact through a communication network. The client-server relationship arises through computer programs running on the respective computers and having a client-server relationship with each other. The server may be a cloud server, a server in a distributed system, or a server integrated with a blockchain.

[0143] Artificial intelligence (AI) is the study of how computers can simulate certain human thought processes and intelligent behaviors (such as learning, reasoning, thinking, and planning). It encompasses both hardware and software technologies. AI hardware technologies generally include sensors, specialized AI chips, cloud computing, distributed storage, and big data processing. AI software technologies primarily encompass computer vision, audio recognition, natural language processing, machine learning / deep learning, big data processing, and knowledge graphs.

[0144] Cloud computing refers to a technology system that provides network access to elastically scalable shared pools of physical or virtual resources. These resources can include servers, operating systems, networks, software, applications, and storage devices, and can be deployed and managed on-demand in a self-service manner. Cloud computing technology provides efficient and powerful data processing capabilities for the application of technologies such as artificial intelligence and blockchain, as well as for model training.

[0145] It should be understood that the various forms of the processes shown above can be used to reorder, add, or delete steps. For example, the steps described in this disclosure can be performed in parallel, sequentially, or in a different order, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved. This is not a limitation herein.

[0146] The above specific embodiments do not constitute a limitation on the scope of protection of this disclosure. Those skilled in the art will appreciate that various modifications, combinations, sub-combinations, and substitutions may be made based on design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this disclosure shall be included within the scope of protection of this disclosure.

Claims

1. A method for troubleshooting a business system, comprising: Determine the current fault attribute in response to the current fault event of the business system and obtain the sub-fault events monitored in real time; The current fault attributes include the current fault time period, the current fault level, and the triggering time of the next fault level; According to the sub-fault event, extracting a current static entity associated with the current fault from the static knowledge graph of the business system; Fault location is performed according to the current fault attribute and the current static entity to obtain a target fault root cause.

2. The method according to claim 1, wherein The determining of the current fault attribute in response to the current fault event of the business system includes: In response to a current fault event triggered by a billing anomaly in the business system, obtaining the abnormal time, and analyzing the billing data before the abnormal time to obtain an inflection point time and a current fault time period from the inflection point time to the abnormal time; Determine the current loss value based on the benchmark billing data for the benchmark time period, the historical billing data for the same period in the historical time period, and the current billing data for the current fault time period; the benchmark time period is a time interval with a fixed length of time tracing back from the inflection point; determining a current fault level according to the current loss value; The triggering moment of the next fault level is determined according to the current loss value, the current fault time period and the preset loss threshold of the next level.

3. The method according to claim 2, wherein: The determining of the current loss value based on the benchmark billing data in the benchmark time period, the historical billing data in the historical time period, and the current billing data in the current fault time period includes: Analyze the benchmark billing data of the business system in the benchmark time period to obtain a benchmark year-on-year comparison; The current loss value is determined based on the historical billing data of the business system in the historical period, the current billing data in the current fault period, and the benchmark year-on-year comparison.

4. The method according to claim 2, wherein: The determining the triggering time of the next fault level according to the current loss value, the current fault time period and the preset loss threshold of the next level includes: determining a loss rate according to the current loss value and the current fault time period; A loss difference between a preset loss threshold of the next level and the current loss value is determined, and a triggering moment of the next fault level is determined according to the loss difference and the loss rate.

5. The method according to any one of claims 1 to 4, wherein The performing fault location according to the current fault attribute and the current static entity to obtain a target fault root cause includes: Inputting the current fault attribute and the current static entity into a large language model to obtain a preliminary root cause of the current fault; the current static entity includes a current alarm entity, a current business entity, a current physical entity, and a current indicator entity; Generate an event ticket for the current fault according to the current fault attribute, the current business entity, the current physical entity, and the preliminary fault root cause; According to the current business entity, extract the associated current business expert entity from the static knowledge graph, and create a communication group for the event ticket; According to the current business entity, the associated current positioning tool entity is extracted from the static knowledge graph, and the current positioning tool is called to perform fault positioning on the current fault to obtain the target fault root cause.

6. The method according to claim 5, wherein: The extracting, from the static knowledge graph according to the current business entity, an associated current positioning tool entity, and calling the current positioning tool to perform fault location on the current fault to obtain the target fault root cause includes: Matching the current business entity with the input parameters of the positioning tool entity in the static knowledge graph to obtain a successfully matched current positioning tool entity, and obtaining technical dependency relationships between different current positioning tool entities from the static knowledge graph; Obtaining a specified calling sequence between different current positioning tool entities, and fusing the technical dependency relationship and the specified calling sequence to obtain a target execution sequence; The current positioning tool is called according to the target execution sequence to obtain the target fault root cause.

7. The method according to claim 5, further comprising: after generating an event ticket for the current fault; Displaying the current indicator entity associated with the current business entity in the event sheet in the form of a chart; Other physical entities associated with the current physical entity and other indicator entities associated with the other physical entities are extracted from the static knowledge graph and displayed in a tree structure in the event list.

8. The method according to claim 5, before calling the current fault location tool to locate the current fault, further comprising: Displaying the input parameters and positioning function of the current positioning tool in the event list; In response to an editing operation on the input parameter and / or the positioning function, the current positioning tool is updated.

9. The method according to any one of claims 1 to 4, after locating the fault according to the current fault attribute and the current static entity to obtain a target fault root cause, further comprising: Acquire an actual stop-loss operation for the current fault according to the current fault time period and the current physical entity in the current static entity; Filtering the actual stop-loss operations according to the target fault root cause to obtain a target stop-loss operation associated with the current fault; The current fault is restored according to the target stop-loss operation.

10. The method according to claim 9, wherein: The screening of the actual stop-loss operations according to the target fault root cause to obtain a target stop-loss operation associated with the current fault includes: Obtaining a target physical entity associated with the current fault in the target fault root cause, and extracting a target change event associated with the target physical entity from the change event of the business entity; The target fault root cause, the target change event, and the actual stop-loss operation are input into a large language model to obtain a target stop-loss operation associated with the current fault.

11. The method according to claim 9, wherein: The recovering the current fault according to the target stop-loss operation includes: Determine whether the current fault meets the fault recovery conditions based on the real-time billing data and / or real-time indicator data of the business system; If the fault recovery condition is met, at least one target recovery operation associated with the target stop-loss operation is determined and the target recovery operation is executed.

12. A fault handling device for a business system, comprising: A fault attribute determination module is used to determine the current fault attribute in response to the current fault event of the business system and obtain the sub-fault events monitored in real time; The current fault attributes include the current fault time period, the current fault level, and the triggering time of the next fault level; A static entity extraction module, configured to extract, based on the sub-fault event, a current static entity associated with the current fault from the static knowledge graph of the business system; The fault location module is used to perform fault location according to the current fault attribute and the current static entity to obtain a target fault root cause.

13. An electronic device comprising: at least one processor; as well as a memory communicatively connected to the at least one processor; wherein, The memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor to enable the at least one processor to perform the method according to any one of claims 1 to 11.

14. A non-transitory computer-readable storage medium storing computer instructions, wherein: The computer instructions are used to enable a computer to execute the method according to any one of claims 1-11.

15. A computer program product comprising a computer program, which, when executed by a processor, implements the method according to any one of claims 1 to 11.

Images