Root cause positioning method and device, electronic equipment and storage medium
By parsing alarm work orders and building a feature library, combined with evidence chains and large language models, efficient and accurate root cause location is achieved, solving the time-consuming and resource-consuming problems of existing technologies and improving the location capability in complex fault environments.
Patent Information
- Application Number
- CN202410309156.1
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2024-03-18
- Publication Date
- 2025-09-19
AI Technical Summary
Existing root cause location methods consume a lot of time and resources and are difficult to adapt to complex and irregular fault environments.
By parsing alarm work orders, building a feature library, and using the evidence chain to obtain actual feature data, the large language model is input to locate the root cause, avoiding the manual troubleshooting process, and using artificial intelligence agents and large language models to locate the root cause conclusions.
It improves the efficiency and accuracy of root cause location, reduces fault location time, enhances the location capability in complex scenarios, and avoids differences in inference results caused by different experiences.
Smart Images
Figure CN120670190A_ABST
Abstract
Description
Technical Field
[0001] The present application relates to the technical field of root cause positioning, and in particular to a root cause positioning method and device, electronic equipment, and storage medium. Background Art
[0002] With the development of cloud computing and big data technologies, system complexity continues to increase, making it increasingly difficult to determine the root cause of system problems. Currently, status code alerts are used to organize and standardize operations and maintenance troubleshooting strategies into standardized troubleshooting processes. Each process involves analyzing de-correlated system data, then drawing conclusions (the root cause) based on this data analysis. Existing root cause identification methods require manual labor to search through large amounts of monitoring data, consuming significant time and resources. Furthermore, these standard troubleshooting processes are limited to predefined rules or procedures and are difficult to adapt to complex and irregular fault environments. Therefore, existing root cause identification methods are not only time-consuming and resource-intensive, but also difficult to adapt to complex and irregular fault environments.
[0003] There is currently no effective solution to the above-mentioned problems in related technologies. Summary of the Invention
[0004] The present application provides a root cause location method and device, electronic device and storage medium to solve the problem in the prior art that it not only consumes a lot of time and resources but is also difficult to adapt to complex and irregular fault environments.
[0005] In the first aspect, the present application provides a root cause locating method, comprising: parsing an alarm work order generated by a system to obtain work order information; determining a root cause conclusion associated with the alarm work order based on the work order information, and constructing a feature library corresponding to the root cause conclusion; wherein the feature library includes actual feature data corresponding to the root cause conclusion; obtaining the actual feature data of the root cause conclusion in the feature library through an evidence chain; wherein the evidence chain includes each data interface in the system; inputting the actual feature data of the root cause conclusion and the work order information into the large language model in the artificial intelligence agent to obtain an output result, wherein the output result represents the root cause locating result of the alarm work order.
[0006] In the second aspect, the present application provides a root cause locating device, comprising: a parsing module for parsing the alarm work order generated by the system to obtain work order information; a first processing module for determining the root cause conclusion associated with the alarm work order based on the work order information, and constructing a feature library corresponding to the root cause conclusion; wherein the feature library includes actual feature data corresponding to the root cause conclusion; an acquisition module for acquiring the actual feature data of the root cause conclusion in the feature library through an evidence chain; wherein the evidence chain includes each data interface in the system; a second processing module for inputting the actual feature data of the root cause conclusion and the work order information into a large language model in an artificial intelligence agent to obtain an output result, wherein the output result represents the root cause locating result of the alarm work order.
[0007] In a third aspect, the present application provides an electronic device comprising: at least one communication interface; at least one bus connected to the at least one communication interface; at least one processor connected to the at least one bus; and at least one memory connected to the at least one bus, wherein the processor is configured to execute the root cause locating method described in the first aspect of the present application.
[0008] In a fourth aspect, the present application further provides a computer storage medium storing computer executable instructions, wherein the computer executable instructions are used to execute the root cause locating method described in the first aspect of the present application.
[0009] The above technical solution provided by the embodiment of the present application has the following advantages over the prior art: the method provided by the embodiment of the present application, after constructing the corresponding feature library through the root cause conclusion associated with the alarm work order, obtains the actual feature data corresponding to the alarm work order from the feature library through the evidence chain, and then inputs the actual feature data and the work order information into the large language model. The root cause of the current work order can be located through the large voice model, that is, it can be determined whether there is a problem with the current alarm work order and where the specific problem is. Compared with the prior art, there is no need for manual troubleshooting of the process tree, which improves the troubleshooting efficiency. Moreover, since there is no need for manual troubleshooting of the process tree, different inference results caused by different experiences of different operation and maintenance personnel are avoided, making the root cause location more accurate. In addition, based on artificial intelligence agents and through large language models to locate the root cause conclusion, it is no longer limited to pre-defined rules or processes, which greatly improves the ability to locate the root cause conclusion in complex scenarios and reduces the time for fault location. BRIEF DESCRIPTION OF THE DRAWINGS
[0010] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the invention and, together with the description, serve to explain the principles of the invention.
[0011] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.
[0012] One or more embodiments are exemplarily illustrated by pictures in the corresponding drawings. These exemplifications do not constitute limitations on the embodiments. Elements with the same reference numerals in the drawings are represented as similar elements. Unless otherwise stated, the figures in the drawings do not constitute proportional limitations.
[0013] Figure 1 This is a schematic diagram of the root cause location process in the prior art;
[0014] Figure 2 A flowchart of a root cause location method provided in an embodiment of the present application;
[0015] Figure 3 A flowchart of a root cause location method based on a large language model provided in an embodiment of the present application;
[0016] Figure 4 A schematic diagram of the AI interaction process in the root cause localization method based on a large language model provided in an embodiment of the present application;
[0017] Figure 5 A schematic structural diagram of a root cause positioning device provided in an embodiment of the present application;
[0018] Figure 6 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION
[0019] To make the purpose, technical solutions, and advantages of the embodiments of this application more clear, the technical solutions in the embodiments of this application will be clearly and completely described below in conjunction with the drawings in the embodiments of this application. Obviously, the described embodiments are part of the embodiments of this application, not all of the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative efforts are within the scope of protection of this application.
[0020] The disclosure below provides many different embodiments or examples for implementing different configurations of the present invention. To simplify the disclosure of the present invention, the components and configurations of specific examples are described below. Of course, these are merely examples and are not intended to limit the present invention. In addition, the present invention may repeat reference numerals and / or letters in different examples. Such repetition is for the purpose of simplicity and clarity and does not in itself indicate the relationship between the various embodiments and / or configurations discussed.
[0021] First, the relevant terms in the embodiments of the present application are explained;
[0022] Large Language Models (LLMs) refer to deep learning models trained with large amounts of data, such as GPT-3. These models have powerful data processing and learning capabilities, and can understand and generate human language and perform complex reasoning.
[0023] A root cause location system (ROI) analyzes system status and log information to identify the root cause of system problems. This is a crucial fault diagnosis technology widely used in the operation and maintenance of complex systems.
[0024] The evidence chain refers to the full synergy of multiple systems to provide sufficient troubleshooting evidence. Develop various internal system platforms into interfaces and combine them into an evidence chain. The current evidence chain includes: basic monitoring data interface, quality trend data interface, log analysis data interface, network detection data interface, availability detection data interface, central control platform data interface, scheduling platform data interface, configuration distribution data interface, etc. All the originally independent internal systems are linked together, and data can be retrieved at any time for automatic troubleshooting. The data that can be retrieved includes: Central Processing Unit (CPU), memory, hard disk I / O, network monitoring, topology check, configuration check, error cause check, Domain Name System (DNS) resolution check, Hypertext Transfer Protocol (HTTP) response header check, special business logic check, multi-level and multi-node check, etc. It makes up for the problems of the singleness and superficiality of traditional quality monitoring systems.
[0025] LangChain is an open-source Python library designed to help developers build end-to-end applications using large language models (LLMs). It provides a set of tools, components, and interfaces that simplify the process of creating applications powered by LLMs and chat models.
[0026] An AI agent (artificial intelligence agent) generally refers to a program or system designed to represent or perform specific tasks, simulating human decision-making and behavior. These agents use artificial intelligence techniques, such as machine learning, rule engines, or expert systems, to understand their environment, make decisions, and perform actions to achieve specific goals.
[0027] ReAct is a language model that combines reasoning and action. While LLMs have demonstrated impressive capabilities in language understanding and interactive decision making, their abilities to reason (e.g., chained thought prompts) and act (e.g., action plan generation) have been primarily viewed as two separate topics. The goal of ReAct is to explore how LLMs can be used to generate reasoning traces and task-specific actions in an interleaved manner, thereby achieving greater synergy between the two.
[0028] In this regard, the current alarm for status codes is to sort out the ideas of operation and maintenance troubleshooting and standardize them into a standard troubleshooting process. Each process involves de-correlated system analysis data, and then makes judgments based on data analysis to finally draw conclusions (root causes). For example, the analysis of the 403 status code corresponds to the troubleshooting model (process tree) of 403, and the analysis of the 502 status code corresponds to the troubleshooting model of 502. After the alarm event is connected, the root cause location system will extract relevant information of the alarm event, such as alarm time, status code, domain name, node, customer and other information, match the specific troubleshooting model according to the status code, and then load the specific troubleshooting model through the root cause location engine, perform analysis step by step according to the process of the model, and finally infer the root cause of the fault. The specific process is as follows: Figure 1 As shown in the figure, it can be seen that the existing root cause location method not only consumes a lot of time and resources, but also has difficulty adapting to complex and irregular fault environments.
[0029] In response to existing root cause conclusion locating methods, embodiments of the present application provide a root cause locating method. Figure 2 A flowchart of a root cause location method provided in an embodiment of the present application is shown in FIG. Figure 2 As shown, the execution subject of the method can be an artificial intelligence agent, and the specific steps include:
[0030] Step 201: parse the alarm work order generated by the system to obtain work order information;
[0031] The alarm work order involved in the embodiments of the present application can be any alarm work order generated by the system, such as a fault work order corresponding to a 403 status code or a fault work order corresponding to a 504 status code. The work order information may include the work order number, product line, status code, fault time, domain name, node, customer, work order description, etc. In the embodiments of the present application, the content included in the work order information can be configured accordingly as needed.
[0032] Step 202: Determine the root cause conclusion associated with the alarm work order based on the work order information, and construct a feature library corresponding to the root cause conclusion; wherein the feature library includes actual feature data corresponding to the root cause conclusion;
[0033] It's important to note that different alert tickets correspond to different root cause conclusions. For example, for a 504 status code fault ticket, the root cause conclusions involved include origin server issues, upper-layer node hash ring issues, and Nginx and Dorado shielding bugs (faults). Each root cause conclusion can be used to construct a corresponding root cause conclusion feature, which in turn can be used to construct a corresponding root cause feature library.
[0034] Step 203: Acquire actual feature data of the root cause conclusion in the feature library through the evidence chain; wherein the evidence chain includes each data interface in the system;
[0035] In a specific example, the chain of evidence in the embodiment of the present application may include: basic monitoring data interface, quality trend data interface, log analysis data interface, network detection data interface, availability detection data interface, central control platform data interface, scheduling platform data interface, configuration distribution data interface, etc.
[0036] In step 204, the actual feature data of the root cause conclusion and the work order information are input into the large language model in the artificial intelligence agent to obtain an output result, wherein the output result represents the root cause location result of the alarm work order.
[0037] It can be seen from the above steps 201 to 204 that after constructing the corresponding feature library through the root cause conclusion associated with the alarm work order, the actual feature data corresponding to the alarm work order is obtained from the feature library through the evidence chain, and then the actual feature data and the work order information are input into the large language model. The large voice model can locate the root cause of the current work order, that is, it can determine whether there is a problem with the current alarm work order and where the specific problem is. Compared with the existing technology, there is no need for manual troubleshooting of the process tree, which improves the troubleshooting efficiency. Moreover, since there is no need for manual troubleshooting of the process tree, different inference results caused by different experiences of different operation and maintenance personnel are avoided, making the root cause location more accurate. In addition, based on artificial intelligence agents and using large language models to locate the root cause conclusion, it is no longer limited to pre-defined rules or processes, greatly improving the ability to locate the root cause conclusion in complex scenarios and reducing the time for fault location.
[0038] In an optional implementation of the embodiment of the present application, the method of determining the root cause conclusion associated with the alarm work order based on the work order information and constructing a feature library corresponding to the root cause conclusion involved in step 202 may further include:
[0039] Step 11: Determine the root cause conclusion associated with the alarm work order based on the work order information, wherein each alarm work order generated by the system is associated with one or more root cause conclusions;
[0040] Step 12: determining corresponding root cause conclusion features and root cause conclusion feature descriptions based on the root cause conclusions, and constructing a feature library based on the root cause conclusion features and the root cause conclusion feature descriptions, wherein the root cause conclusion feature descriptions are used to describe the meanings expressed by the root cause conclusion features.
[0041] Regarding steps 11 and 12, in a specific example, in the case where the alarm ticket is a fault ticket with a 504 status code, step 11 may be: determining the root cause conclusion associated with the fault ticket with a 504 status code, wherein the root cause conclusion includes a source station problem, an upper-level node hash ring problem, and an nginx and dorado shielding fault. Then, step 12 may be: determining the corresponding root cause conclusion features and root cause conclusion feature description based on the root cause conclusion, and constructing a feature library based on the root cause conclusion features and the root cause conclusion feature description, wherein the root cause conclusion features include source station problem features, hash ring problem features from this node back to the upper-level node, and nginx and dorado shielding fault features; the root cause conclusion feature description is used to describe the meaning expressed by the root cause conclusion features.
[0042] Furthermore, in a specific example, the source station problem feature in the embodiment of the present application can be: nginx log "field 33, $sent_http_server, response header Server", and the corresponding feature description can be: http_server_header, the number of non-our http_server_headers accounts for >= 50%.
[0043] In a specific example, the characteristic of the hash ring problem of the current node returning to the upper node in the embodiment of the present application can be: the erreason in the nginx log is that the proportion of all-nodes-of-hash-ring-is-down is greater than or equal to 49%, and the corresponding characteristic description can be: the proportion of erreason_hash-ring-is-down.
[0044] In a specific example, the Nginx and dorado shielding fault characteristics in the embodiment of the present application can be: the proportion of clientIp 127.0.0.1 in the nginx log is >= 89%, and the proportion of domain blockurl.kscdn.com in the nginx log is >= 89%. The corresponding feature description can be: clientIp_127.0.0.1 proportion, domain_blockurl.kscdn.com proportion.
[0045] In another optional implementation of the embodiment of the present application, the method of obtaining the actual feature data of the root cause conclusion in the feature library through the evidence chain involved in the above step 203 in the embodiment of the present application may further include:
[0046] Step 21, determining the data interface corresponding to the root cause conclusion;
[0047] Step 22: Send the corresponding request parameters to the data interface, and obtain the corresponding return parameters from the data interface based on the request parameters, wherein the request parameters are used to indicate the fault information associated with the root cause conclusion in the work order information, and the return parameters represent the actual feature data corresponding to the root cause conclusion in the feature library.
[0048] For the above steps 21 and 22, in the specific example, taking the fault ticket with 504 status code as an example, the relevant data interface of the evidence chain module can be called through langchain.
[0049] 1) Data interface related to source site problem characteristics. The corresponding request parameters may include: triggerTime (failure time), httpCode (status code), node (node), domain (domain name), startTime (failure start time, 10 minutes before the failure time), endTime (2 minutes after the failure time). The corresponding return parameters may include: non-user percentage, number of non-user server headers, number of user server headers, number of other server headers.
[0050] 2) This node returns data related to the hash ring problem characteristics of the upper node. The corresponding request parameters may include: triggerTime (failure time), httpCode (status code), node (node), domain (domain name), startTime (failure start time, 10 minutes before the failure time), endTime (failure time pushed back 2 minutes). The corresponding return parameters may include: erreason_hash-ring-is-down ratio, other erreason ratio, whether it is a hash-ring problem
[0051] 3) Data interface related to nginx and dorado shielding fault characteristics, its corresponding request parameters may include triggerTime (fault time), httpCode (status code), node (node), domain (domain name), startTime (fault start time, 10 minutes before the fault time), endTime (2 minutes after the fault time), and its corresponding return parameters may include: clientIp127.0.0.1 ratio, domain name blockurl.kscdn.com ratio.
[0052] In an optional implementation of the embodiment of the present application, the method of inputting the actual feature data of the root cause conclusion and the work order information into the large language model to obtain the output result involved in the above step 104 may further include:
[0053] Step 31: selecting a corresponding tool in the large language model based on the actual feature data of the root cause conclusion, wherein the tool is used to detect whether the root cause conclusion has a fault;
[0054] It should be noted that the tools in the embodiments of the present application can be HashRingTool (hash ring tool), SourceTraceTool (source station tool), and NginxDoradoTool (nginx dorado tool) in specific examples.
[0055] Step 32: When it is determined that the actual characteristic data of the current root cause conclusion does not contain a fault based on the tool detection of the actual characteristic data of the current root cause conclusion, continue to select the tool corresponding to the actual characteristic data of the next root cause conclusion for detection until a root cause conclusion with a fault is detected or all tools have been detected.
[0056] It can be seen that in the embodiment of the present application, natural language can be used to quickly drive the large model to react (reason + action), select the corresponding tool, and obtain the output result. The large language model will detect based on the output result. If the detection meets the expected result, the large model will return the result. If it does not meet the expectations, the tool will continue to be selected and the detection will be repeated until it meets the expectations or the exit condition is met, or all tools are executed. Root cause locating through the large language model makes fault locating no longer limited to pre-defined rules or processes, greatly improving the ability to handle complex scenarios and the time of fault locating.
[0057] The following is an example of the present application, which provides a root cause location method based on a large language model. Figure 3 As shown, the steps of the method include:
[0058] Step 301, obtain the work order number;
[0059] Step 302: Query the work order information. If no work order information is found, the process ends. If the work order information is found, proceed to step 303.
[0060] In this regard, taking the work order with 504 status code as an example to locate the root cause, the corresponding work order fields include work order number, product line, status code, failure time, domain name, node, customer, and work order description information.
[0061] Step 303: Verify the work order information. If there is no status code, node, domain name, or failure time, the process ends. If there is, proceed to step 304.
[0062] Step 304: Obtain the root cause conclusion of the work order;
[0063] Step 305: Obtain a characteristic description of the root cause conclusion and the corresponding actual characteristic data;
[0064] In this specific example, data features are built into the MySQL database based on the root cause and conclusion characteristics of each fault. For example, a fault ticket with a 504 status code has three root cause conclusions: an origin server issue, an upper-layer node hash ring issue, and an Nginx and Dorado blocking issue.
[0065] Origin site problem characteristics include: "Field 33, $sent_http_server, Server response header" in the nginx log. Its corresponding feature description could be: "http_server_header, the proportion of non-user http_server_headers is greater than or equal to 50%."
[0066] A hash ring problem affecting the node back to the upper-level node is characterized by the following: In the Nginx log, the "erreason" message "all-nodes-of-hash-ring-is-down" accounts for ≥ 49%. The corresponding feature description is "erreason_hash-ring-is-down" percentage.
[0067] Nginx and Dorado blocking failure characteristics include: 127.0.0.1 accounts for ≥ 89% of the clientIP in Nginx logs, and blockurl.kscdn.com accounts for ≥ 89% of the domain in Nginx logs. The corresponding descriptions can be: clientIp_127.0.0.1 ratio, domain_blockurl.kscdn.com ratio.
[0068] In addition, in the embodiment of the present application, the relevant data interface of the evidence chain module is called through langchain. For the source station problem evidence chain API, the corresponding request parameters include: triggerTime (fault time), httpCode (status code), node (node), domain (domain name), startTime (fault start time, 10 minutes before the fault time), endTime (2 minutes after the fault time); return parameters include: non-our ratio, non-our server header number, our server header number, and other server header number. This node returns to the upper node hash ring problem feature evidence chain API, and its corresponding request parameters include: triggerTime (fault time), httpCode (status code), node (node), domain (domain name), startTime (fault start time, 10 minutes before the fault time), endTime (2 minutes after the fault time); return parameters include: erreason_hash-ring-is-down ratio, other erreason ratios, and whether it is a hash-ring problem. Nginx and dorado block the bug evidence chain API. The corresponding request parameters include: triggerTime (fault time), httpCode (status code), node (node), domain (domain name), startTime (fault start time, 10 minutes before the fault time), endTime (2 minutes after the fault time). The return parameters include: clientIp127.0.0.1 ratio, domain name blockurl.kscdn.com ratio.
[0069] Step 306: The AI agent selects a tool to determine the root cause conclusion;
[0070] Step 307: Output the root cause conclusion through GPT in the large language model.
[0071] In this regard, Figure 4As shown, the natural language prompt drives the big model to react (reason+act), select the corresponding tool, and obtain the output result. The big model performs detection based on the output result. If the detection meets the expectations, the big model returns the result. If it does not meet the expectations, it will continue to select tools and repeat the detection until it meets the expectations or reaches the exit condition, or all tools are executed. The big language model uses your input, combined with the description of the description field of the tool in the tool set, and through intent recognition, decides which tool to use. In the embodiment of the present application, the AI agent type can be OPENAI_FUNCTIONS, which is the implementation of gpt function_call by langchain. There are currently three encapsulated tools, namely HashRingTool, SourceTraceTool, and NginxDoradoTool, which are used to check hash rings, source stations, and nginx dorado respectively. The processing logic of each tool is to first obtain the evidence chain, and through the information of the evidence chain, let the big language model determine whether the current object is normal.
[0072] As can be seen, the embodiments of this application utilize artificial intelligence and machine learning technologies to more efficiently process large amounts of data. They can also learn from historical data and predict potential faults, thereby quickly locating the root cause of the fault. Furthermore, the emergence of large language models means that fault location is no longer limited to predefined rules or processes, greatly improving the ability to handle complex scenarios.
[0073] Corresponding to the above Figure 2 , the present application provides a root cause positioning device, such as Figure 5 As shown, the steps of the method include:
[0074] Parsing module 502, used to parse the alarm work order generated by the system to obtain work order information;
[0075] A first processing module 504 is configured to determine a root cause conclusion associated with the alarm work order based on the work order information and to construct a feature library corresponding to the root cause conclusion; wherein the feature library includes actual feature data corresponding to the root cause conclusion;
[0076] An acquisition module 506 is configured to acquire actual feature data of the root cause conclusion in the feature library through an evidence chain, wherein the evidence chain includes various data interfaces in the system;
[0077] The second processing module 508 is configured to input the actual feature data of the root cause conclusion and the work order information into the large language model to obtain an output result, wherein the output result represents the root cause location result of the alarm work order.
[0078] In an optional implementation manner of an embodiment of the present application, the first processing module in the embodiment of the present application may further include: a first determination unit, used to determine the root cause conclusion associated with the alarm work order based on the work order information, wherein each alarm work order generated by the system is associated with one or more root cause conclusions; a first processing unit, used to determine the corresponding root cause conclusion characteristics and root cause conclusion feature descriptions based on the root cause conclusions, and construct a feature library based on the root cause conclusion characteristics and the root cause conclusion feature descriptions, wherein the root cause conclusion feature descriptions are used to describe the meaning expressed by the root cause conclusion characteristics.
[0079] In an optional implementation manner of an embodiment of the present application, the acquisition module in the embodiment of the present application may further include: a second determination unit, used to determine the data interface corresponding to the root cause conclusion; a second processing unit, used to send corresponding request parameters to the data interface, and obtain corresponding return parameters from the data interface based on the request parameters, wherein the request parameters are used to indicate the fault information associated with the root cause conclusion in the work order information, and the return parameters represent the actual feature data corresponding to the root cause conclusion in the feature library.
[0080] In an optional implementation manner of an embodiment of the present application, the second processing module in the embodiment of the present application may further include: a selection unit, used to select a corresponding tool in the large language model based on the actual feature data of the root cause conclusion, wherein the tool is used to detect whether the root cause conclusion has a fault; a third processing unit, used to continue selecting the tool corresponding to the actual feature data of the next root cause conclusion for detection when it is determined that the actual feature data of the current root cause conclusion does not have a fault based on the tool detection of the actual feature data of the current root cause conclusion until a root cause conclusion with a fault is detected or all tools have been detected.
[0081] In an optional implementation of an embodiment of the present application, in the case where the alarm work order is a fault work order with a status code, the parsing module in the embodiment of the present application may further include: a parsing unit for parsing the fault work order with a status code generated by the system to obtain at least one of the following work order information: work order number, product line, status code, fault time, domain name, node, customer, and work order description information. The first processing module includes: a fourth processing unit for determining the root cause conclusion associated with the fault work order with the status code based on the work order information, and determining the corresponding root cause conclusion feature and root cause conclusion feature description based on the root cause conclusion, and constructing a feature library based on the root cause conclusion feature and the root cause conclusion feature description; wherein the root cause conclusion includes source station problems, upper node hash ring problems, and nginx and dorado shielding faults; the root cause conclusion features include source station problem features, hash ring problem features of this node back to the upper node, and nginx and dorado shielding fault features; the root cause conclusion feature description is used to describe the meaning expressed by the root cause conclusion feature.
[0082] In an optional implementation manner of an embodiment of the present application, the acquisition module in the embodiment of the present application may include: a third determination unit, used to determine the data interface corresponding to the root cause conclusion; a fourth processing unit, used to send corresponding request parameters to the data interface, and obtain corresponding return parameters from the data interface based on the request parameters, wherein the request parameters are used to indicate the fault information associated with the root cause conclusion in the work order information, and the return parameters represent the actual feature data corresponding to the root cause conclusion in the feature library.
[0083] like Figure 6 As shown, an embodiment of the present application provides an electronic device, including a processor 611, a communication interface 612, a memory 613 and a communication bus 614, wherein the processor 611, the communication interface 612, and the memory 613 communicate with each other through the communication bus 614.
[0084] Memory 613, for storing computer programs;
[0085] In one embodiment of the present application, the processor 611 is used to execute the program stored in the memory 613 to implement the root cause location method provided by any of the aforementioned method embodiments, and its role is similar and will not be repeated here.
[0086] An embodiment of the present application further provides a computer-readable storage medium having a computer program stored thereon. When the computer program is executed by a processor, the steps of the root cause location method provided in any of the aforementioned method embodiments are implemented.
[0087] The device embodiments described above are merely illustrative. The units described as separate components may or may not be physically separate, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of the modules may be selected based on actual needs to achieve the objectives of this embodiment.
[0088] Through the description of the above embodiments, those skilled in the art can clearly understand that each embodiment can be implemented by means of software plus a general hardware platform, or of course, by hardware. Based on this understanding, the above technical solution, in essence, or the part that contributes to the relevant technology, can be embodied in the form of a software product. The computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a magnetic disk, an optical disk, etc., and includes a number of instructions for enabling a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or certain parts of the embodiment.
[0089] It should be understood that the terms used herein are for the purpose of describing specific example embodiments only and are not intended to be limiting. Unless the context clearly indicates otherwise, the singular forms "one", "an" and "said" as used herein may also be meant to include plural forms. The terms "comprise", "include", "contain" and "have" are inclusive and therefore specify the presence of stated features, steps, operations, elements and / or parts, but do not exclude the presence or addition of one or more other features, steps, operations, elements, parts, and / or combinations thereof. The method steps, processes, and operations described herein are not to be construed as necessarily requiring them to be performed in the specific order described or illustrated, unless the order of execution is clearly indicated. It should also be understood that additional or alternative steps may be used.
[0090] The foregoing description is intended only to provide specific embodiments of the present invention, which will enable those skilled in the art to understand and implement the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention is not intended to be limited to the embodiments shown herein, but is intended to be accorded the widest scope consistent with the principles and novel features claimed herein.
Claims
1. A root cause location method, applied to an artificial intelligence agent, characterized in that: include: Parse the alarm work orders generated by the system to obtain work order information; Determining a root cause conclusion associated with the alarm work order based on the work order information, and constructing a feature library corresponding to the root cause conclusion; wherein the feature library includes actual feature data corresponding to the root cause conclusion; Acquiring actual feature data of the root cause conclusion in the feature library through an evidence chain; wherein the evidence chain includes each data interface in the system; The actual feature data of the root cause conclusion and the work order information are input into the large language model in the artificial intelligence agent to obtain an output result, wherein the output result represents the root cause location result of the alarm work order.
2. The method according to claim 1, characterized in that Determining a root cause conclusion associated with the alarm work order based on the work order information, and constructing a feature library corresponding to the root cause conclusion includes: Determining a root cause conclusion associated with the alarm work order based on the work order information, wherein each alarm work order generated by the system is associated with one or more root cause conclusions; Based on the root cause conclusion, corresponding root cause conclusion features and root cause conclusion feature descriptions are determined, and the feature library is constructed based on the root cause conclusion features and the root cause conclusion feature descriptions, wherein the root cause conclusion feature descriptions are used to describe the meaning expressed by the root cause conclusion features.
3. The method according to claim 2, characterized in that The actual feature data of the root cause conclusion in the feature library is obtained through the evidence chain, including: Determining a data interface corresponding to the root cause conclusion; Send corresponding request parameters to the data interface, and obtain corresponding return parameters from the data interface based on the request parameters, wherein the request parameters are used to indicate the fault information associated with the root cause conclusion in the work order information, and the return parameters represent the actual feature data corresponding to the root cause conclusion in the feature library.
4. The method according to claim 1, wherein Inputting the actual feature data of the root cause conclusion and the work order information into the large language model to obtain an output result, including: selecting a corresponding tool in the large language model according to actual feature data of the root cause conclusion, wherein the tool is used to detect whether the root cause conclusion has a fault; When it is determined that there is no fault in the actual characteristic data of the current root cause conclusion based on the tool, continue to select the tool corresponding to the actual characteristic data of the next root cause conclusion for detection until a root cause conclusion with a fault is detected or all tools have been detected.
5. The method according to claim 1, wherein In a case where the alarm work order is a fault work order with a status code, parsing the alarm work order generated by the system to obtain the work order information includes: parsing the fault work order with the status code generated by the system to obtain at least one of the following work order information: work order number, product line, fault time, domain name, node, customer, and work order description information; Determining the root cause conclusion associated with the alarm work order based on the work order information, and constructing a feature library corresponding to the root cause conclusion includes: determining the root cause conclusion associated with the fault work order of the status code based on the work order information, and determining the corresponding root cause conclusion characteristics and root cause conclusion characteristic description based on the root cause conclusion, and constructing the feature library based on the root cause conclusion characteristics and the root cause conclusion characteristic description; wherein, the root cause conclusion includes source station problems, upper node hash ring problems, nginx and dorado shielding faults; the root cause conclusion characteristics include source station problem characteristics, hash ring problem characteristics of this node back to the upper node, nginx and dorado shielding fault characteristics; the root cause conclusion characteristic description is used to describe the meaning expressed by the root cause conclusion characteristics.
6. The method according to claim 5, characterized in that The actual feature data of the root cause conclusion in the feature library is obtained through the evidence chain, including: Determining a data interface corresponding to the root cause conclusion; Send corresponding request parameters to the data interface, and obtain corresponding return parameters from the data interface based on the request parameters, wherein the request parameters are used to indicate the fault information associated with the root cause conclusion in the work order information, and the return parameters represent the actual feature data corresponding to the root cause conclusion in the feature library.
7. A root cause positioning device, characterized in that: include: The parsing module is used to parse the alarm work orders generated by the system and obtain the work order information; A first processing module is configured to determine a root cause conclusion associated with the alarm work order based on the work order information, and to construct a feature library corresponding to the root cause conclusion; wherein the feature library includes actual feature data corresponding to the root cause conclusion; an acquisition module, configured to acquire actual feature data of the root cause conclusion in the feature library through an evidence chain; wherein the evidence chain includes various data interfaces in the system; The second processing module is used to input the actual feature data of the root cause conclusion and the work order information into the large language model in the artificial intelligence agent to obtain an output result, wherein the output result represents the root cause location result of the alarm work order.
8. The device according to claim 7, characterized in that The first processing module includes: a first determining unit, configured to determine a root cause conclusion associated with the alarm work order based on the work order information, wherein each alarm work order generated by the system is associated with one or more root cause conclusions; The first processing unit is configured to determine a corresponding root cause conclusion feature and a root cause conclusion feature description based on the root cause conclusion, and to construct the feature library based on the root cause conclusion feature and the root cause conclusion feature description, wherein the root cause conclusion feature description is used to describe the meaning expressed by the root cause conclusion feature.
9. An electronic device comprising: at least one communication interface; at least one bus connected to the at least one communication interface; at least one processor coupled to the at least one bus; At least one memory connected to the at least one bus, wherein the processor is configured to execute the root cause locating method according to any one of claims 1 to 6 of the present application.
10. A computer storage medium storing computer-executable instructions, wherein the computer-executable instructions are used to execute the root cause location method according to any one of claims 1 to 6 of the present application.