Log analysis and service self-recovery strategy recommendation method, device, equipment and medium

Abstract

The application discloses a log analysis and service self-recovery strategy recommendation method, device, equipment and medium, the method comprises the following steps: acquiring sample log data, and generating log analysis results and self-recovery analysis strategies corresponding to the sample log data based on an online large language model; candidate rules are generated based on the feature description corresponding to the sample log data, the log analysis results and the self-recovery analysis strategies, and a rule library is constructed based on the candidate rules; acquiring log data to be analyzed, and determining a target rule according to the vector matching result between the log data to be analyzed and the candidate in the rule library; a guide prompt word template is constructed based on the target rule, and an offline language model is guided to generate target log analysis results and target self-recovery strategies corresponding to the log data to be analyzed. The technical scheme of the embodiment of the application solves the problem that the existing log analysis cannot simultaneously consider safety and high efficiency and accuracy, realizes safe, efficient and accurate log analysis, and automatically recommends a service self-recovery strategy.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of artificial intelligence, big data analysis and system operation and maintenance, and in particular to a log analysis and service self-healing strategy recommendation method, device, equipment and medium. BACKGROUND

[0002] With the rapid development of enterprise informatization process, the scale and complexity of the system have significantly improved, and operation and maintenance management is facing great challenges. System logs, as an important way to record service running status, contain rich abnormal features and running information. However, in actual scenarios, traditional log analysis methods often have problems such as insufficient real-time performance, low accuracy, heavy burden on operation and maintenance personnel, and often require manual intervention to determine abnormal reasons and fault recovery strategies, which seriously affects the operation and maintenance efficiency.

[0003] In recent years, the rise of artificial intelligence technology, especially large language models (LLMs), has brought new technical approaches to log analysis. However, due to security and privacy protection needs, sensitive industries such as power grids, finance, and healthcare often use offline network isolation environments, which makes it unrealistic to directly use powerful online large models like GPT-4. In contrast, although open-source small models deployed locally have low deployment costs and fast inference speeds, they lack operation and maintenance knowledge, especially when it comes to complex log information, their analysis capabilities are difficult to achieve ideal results.

[0004] Therefore, a method is needed that balances security and efficiently and accurately analyzes logs, and automatically recommends service self-healing strategies. SUMMARY

[0005] The present application provides a log analysis and service self-healing strategy recommendation method, device, equipment and medium to realize safe and efficient and accurate analysis of logs and automatic recommendation of service self-healing strategies.

[0006] According to an aspect of the present application, a log analysis and service self-healing strategy recommendation method is provided, comprising:

[0007] Obtaining sample log data and generating log analysis results and self-healing analysis strategies corresponding to the sample log data based on an online large language model;

[0008] Generating candidate rules based on feature descriptions corresponding to the sample log data, the log analysis results and the self-healing analysis strategies, and constructing a rule library based on the candidate rules;

[0009] Obtaining log data to be analyzed, and determining a target rule according to the vector matching results between the log data to be analyzed and the candidate rules in the rule library;

[0010] Based on the target rules, a guiding prompt word template is constructed, and the offline language model is guided to generate the target log analysis results and target self-healing strategy corresponding to the log data to be analyzed.

[0011] According to another aspect of the present invention, a log analysis and service self-healing strategy recommendation apparatus is provided, comprising:

[0012] The sample log analysis module is used to acquire sample log data and generate log analysis results and self-healing analysis strategies corresponding to the sample log data based on an online large language model.

[0013] The rule base generation module is used to generate candidate rules based on the feature descriptions corresponding to the sample log data, the log analysis results, and the self-healing analysis strategy, and to construct a rule base based on the candidate rules.

[0014] The target rule determination module is used to acquire the log data to be analyzed and determine the target rule based on the vector matching results between the log data to be analyzed and the candidates in the rule base;

[0015] The offline log analysis module is used to construct a guidance prompt word template based on the target rules, and guide the offline language model to generate the target log analysis results and target self-healing strategy corresponding to the log data to be analyzed.

[0016] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0017] At least one processor;

[0018] and a memory communicatively connected to the at least one processor; wherein,

[0019] The memory stores a computer program that can be executed by the at least one processor, the computer program being executed by the at least one processor to enable the at least one processor to perform the log analysis and service self-healing strategy recommendation method according to any embodiment of the present invention.

[0020] According to another aspect of the present invention, a computer-readable storage medium is provided, the computer-readable storage medium storing computer instructions, the computer instructions being configured to cause a processor to execute and implement the log analysis and service self-healing strategy recommendation method according to any embodiment of the present invention.

[0021] The technical solution of this invention involves acquiring sample log data and generating log analysis results and self-healing analysis strategies corresponding to the sample log data based on an online large language model; generating candidate rules based on the feature descriptions, log analysis results, and self-healing analysis strategies corresponding to the sample log data, and constructing a rule base based on the candidate rules; acquiring the log data to be analyzed and determining the target rule based on the vector matching results between the log data to be analyzed and the candidates in the rule base; constructing a guiding prompt word template based on the target rule, and guiding the offline language model to generate the target log analysis results and target self-healing strategies corresponding to the log data to be analyzed. This technical solution, based on an online large language model, constructs a rule base for retrieval enhancement for the offline language model, enabling the offline language model to not only improve the ability to identify abnormal logs but also ensure data security. It solves the problem that existing log analysis methods cannot simultaneously achieve security and high efficiency and accuracy, realizing secure, efficient, and accurate log analysis and automatically recommending service self-healing strategies.

[0022] It should be understood that the description in this section is not intended to identify key or essential features of the embodiments of the present invention, nor is it intended to limit the scope of the invention. Other features of the invention will become readily apparent from the following description. Attached Figure Description

[0023] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0024] Figure 1 A flowchart illustrating a log analysis and service self-healing strategy recommendation method provided in an embodiment of the present invention;

[0025] Figure 2 A flowchart of another log analysis and service self-healing strategy recommendation method provided in an embodiment of the present invention;

[0026] Figure 3 This is a schematic diagram of the overall structure of the RELA-AR framework of the present invention;

[0027] Figure 4 This is a flowchart of the log analysis and service self-healing strategy recommendation process of the present invention;

[0028] Figure 5 This is a schematic diagram of a log analysis and service self-healing strategy recommendation device provided in an embodiment of the present invention;

[0029] Figure 6A schematic diagram of the structure of an electronic device for implementing the log analysis and service self-healing strategy recommendation method of this invention. Detailed Implementation

[0030] To enable those skilled in the art to better understand the present invention, the technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort should fall within the scope of protection of the present invention.

[0031] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover a non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0032] To address the shortcomings of existing technologies, this invention proposes a collaborative online and offline log analysis and service self-healing strategy recommendation method, namely the Rules Enhanced Log Analysis for Autonomous Recovery (REL A-AR) framework.

[0033] Specifically, the RELA framework uses an advanced large language model to extract knowledge and build a rule base in the online phase. Then, in the offline environment, it enhances the analytical capabilities of the offline open-source model through Retrieval-Augmented Generation (RAG) technology and automatically recommends self-healing strategies for services, thus achieving secure, efficient and accurate log analysis.

[0034] Figure 1This is a flowchart illustrating a log analysis and service self-healing strategy recommendation method provided in an embodiment of the present invention. This embodiment is applicable to situations where abnormal log data is identified and service self-healing strategies are recommended. This method can be executed by a log analysis and service self-healing strategy recommendation device, which can be implemented in hardware and / or software and can be configured in a computer device, such as a security server. Figure 1 As shown, the method specifically includes the following steps:

[0035] S110. Obtain sample log data and generate log analysis results and self-healing analysis strategies corresponding to the sample log data based on the online large language model.

[0036] The sample log data can be representative log data selected from the actual operation and maintenance logs of the service system. This service system refers to systems that are highly sensitive to data security and have strict requirements for service reliability. Examples include service systems used in power grid, finance, healthcare, and telecommunications operation and maintenance scenarios. It should also be noted that this embodiment does not specifically limit the types of services provided by the service system. Log analysis results can include anomaly types, root causes, etc., and self-healing analysis strategies can be recovery suggestions for abnormal faults.

[0037] In some embodiments, obtaining sample log data may include: selecting log data including anomaly types and / or typical characteristics from actual operation and maintenance log data as sample log data.

[0038] Among them, the anomaly type and / or typical characteristics include at least one of the following: response timeout, authentication failure, abnormal service call, abnormal traffic pattern, and hardware performance degradation.

[0039] Specifically, typical, representative, and diverse log data can be selected from actual operation and maintenance logs as log sample data to ensure that the sample log data covers various common anomaly types and typical characteristics, including but not limited to response timeouts, authentication failures, abnormal service calls, abnormal traffic patterns, hardware performance degradation, and other scenarios.

[0040] Furthermore, by leveraging the analytical capabilities of the online large model, log analysis results and self-healing analysis strategies corresponding to the sample log data are generated.

[0041] In some embodiments, generating log analysis results and self-healing analysis strategies corresponding to sample log data based on an online large language model includes: inputting sample log data into the online large language model, and using zero-shot hints or thought chain hints to enable the online large language model to generate log analysis results and self-healing analysis strategies corresponding to the sample log data.

[0042] To improve the quality of the rule base subsequently built, zero-shot prompting and chain-of-thought (CoT) methods can be used to guide the online large language model to generate high-quality log analysis results and self-healing analysis strategies, ensuring the integrity and usability of the rule base.

[0043] Specifically, sample log data can be input into an advanced online large language model, such as GPT-4, and a Zero-shot Prompt or Chain-of-Thought Prompt can be constructed. A specific Prompt example is shown below:

[0044] "You are an operations and maintenance log analysis expert. Please analyze the following log data to determine if there are any anomalies. If there are anomalies, please explain the reasons in detail and provide targeted fault recovery suggestions."

[0045] Furthermore, the online large language model performs multi-dimensional analysis and feature decomposition on the input sample log data to obtain feature descriptions, including key information such as timestamp, service name, HTTP request method and status code, and response time. Then, the online large language model automatically provides detailed log decomposition, anomaly cause analysis, and recovery recommendations, i.e., log analysis results and self-healing analysis strategies.

[0046] S120. Generate candidate rules based on the feature descriptions, log analysis results, and self-healing analysis strategies corresponding to the sample log data, and build a rule base based on the candidate rules.

[0047] The feature description includes information such as the timestamp, service name, HTTP request method and status code, and response time corresponding to the sample log data. The rule base includes multiple candidate rules, corresponding to various typical log anomaly cases and recommended recovery solutions.

[0048] In some embodiments, generating candidate rules based on the feature descriptions, log analysis results, and self-healing analysis strategies corresponding to the sample log data may include: combining the feature descriptions, log analysis results, and self-healing analysis strategies to obtain candidate rules.

[0049] Specifically, the analysis results of sample log data can be reviewed by operation and maintenance experts or automatically audited by online large language models. The analysis results that are clear, accurate in cause, and effective in measure can be organized and refined into structured rules. Each rule contains three parts: "Features", "Analysis of anomaly", and "Recommendations".

[0050] Repeat the above process to generate multiple candidate rules covering common anomalies, forming a rule base, which is then stored in a vector database, such as FAISS or Milvus, for subsequent retrieval.

[0051] S130. Obtain the log data to be analyzed, and determine the target rule based on the vector matching results between the log data to be analyzed and the candidates in the rule base.

[0052] Due to security concerns, small open-source language models deployed offline typically cannot directly utilize the analytical capabilities of online models. To address this issue, this invention designs an information retrieval-enhanced analysis method. This method involves using an advanced large language model to extract knowledge and construct a rule base online, and then enhancing the analytical capabilities of the small open-source language model offline through Retrieval-Augmented Generation (RAG) technology. This significantly improves the performance of offline open-source models in log analysis.

[0053] The log data to be analyzed refers to the log data whose anomalies need to be determined. The target rule can be a candidate rule that matches the log data to be analyzed.

[0054] Specifically, in order to analyze the log data to be analyzed, determine whether it is abnormal log data, and provide recommended recovery suggestions, candidate rules that match the log data to be analyzed can be retrieved from the rule base through vector matching and used as target rules.

[0055] S140. Construct a guiding prompt word template based on the target rules, and guide the offline language model to generate the target log analysis results and target self-healing strategy corresponding to the log data to be analyzed.

[0056] The target log analysis results can be the anomaly type, root cause, etc. of the log data to be analyzed, and the target self-healing analysis strategy can be the recovery suggestions for the abnormal faults corresponding to the log data to be analyzed.

[0057] Specifically, the retrieved target rules are used as context examples to construct a structured Prompt input into the offline language model. This model effectively understands the abnormal features in the logs through context learning capabilities, enhances the analysis effect on the current log data to be analyzed, and provides accurate and detailed anomaly judgments.

[0058] In this embodiment, based on the log analysis results described above, the system automatically analyzes the root causes of anomalies in the logs, clarifies the anomaly characteristics and scope of impact, and provides precise target self-healing strategy recommendations based on a rule base. Specifically, the target self-healing strategy includes detailed processing steps, recommended operation and maintenance instructions, service recovery flowcharts, and subsequent monitoring measures.

[0059] To further improve the efficiency of strategy implementation, this invention also provides an automatic execution interface that can be integrated with existing automated operation and maintenance platforms to achieve rapid self-healing operations and shorten service recovery time.

[0060] For example, the analysis results generated by the offline language model clearly identify anomaly characteristics, root causes of failures, and specific impact ranges, and provide precise recovery measures. Based on the analysis results, specific self-healing strategies are automatically recommended, including explicit operational steps (such as service restart commands, load balancing configuration adjustment commands, resource optimization operations, etc.). Service self-healing strategy recommendations can be presented directly to operations personnel through a visual interface, or automatically pushed and implemented via REST APIs, webhooks, or automated operations platforms (such as Ansible, SaltStack, etc.). The automated operations platform reads the recommended strategies, executes specific self-healing operations, achieves rapid fault repair, shortens system anomaly recovery time, and ensures service continuity and stability. The system automatically tracks service status changes and log information during the recovery process, records implementation results, and evaluates the effectiveness of the strategies.

[0061] The technical solution of this invention involves acquiring sample log data and generating log analysis results and self-healing analysis strategies corresponding to the sample log data based on an online large language model; generating candidate rules based on the feature descriptions, log analysis results, and self-healing analysis strategies corresponding to the sample log data, and constructing a rule base based on the candidate rules; acquiring the log data to be analyzed and determining the target rule based on the vector matching results between the log data to be analyzed and the candidates in the rule base; constructing a guiding prompt word template based on the target rule, and guiding the offline language model to generate the target log analysis results and target self-healing strategies corresponding to the log data to be analyzed. This technical solution, based on an online large language model, constructs a rule base for retrieval enhancement for the offline language model, enabling the offline language model to not only improve the ability to identify abnormal logs but also ensure data security. It solves the problem that existing log analysis methods cannot simultaneously achieve security and high efficiency and accuracy, realizing secure, efficient, and accurate log analysis and automatically recommending service self-healing strategies.

[0062] Figure 2 This is a flowchart illustrating another log analysis and service self-healing strategy recommendation method provided by an embodiment of the present invention. This embodiment further specifies the above embodiment. Figure 2 As shown, the method specifically includes the following steps:

[0063] S210. Obtain sample log data and generate log analysis results and self-healing analysis strategies corresponding to the sample log data based on the online large language model.

[0064] S220. Generate candidate rules based on the feature descriptions, log analysis results, and self-healing analysis strategies corresponding to the sample log data, and build a rule base based on the candidate rules.

[0065] S230. Extract features from the log data to be analyzed to obtain the feature description string corresponding to the log data to be analyzed.

[0066] Specifically, for each log data to be analyzed, feature extraction is first performed. Key information in the log data to be analyzed, such as service name, status code, and response time, is extracted and concatenated into a unified feature description string.

[0067] S240. Using a pre-trained semantic embedding model, the feature description string and candidate rules are transformed to obtain the first embedding vector corresponding to the feature description string and the second embedding vector corresponding to the candidate rule.

[0068] Specifically, the aforementioned feature description string is converted into a high-dimensional semantic embedding vector (Embedding), i.e., the first embedding vector, through a pre-trained semantic embedding model (such as Sentence-BERT).

[0069] Correspondingly, each candidate rule can also be transformed using a semantic embedding model to obtain a second embedding vector corresponding to the candidate rule. By utilizing semantic embedding technology, deep semantic features of the log data to be analyzed are extracted, making feature matching more accurate.

[0070] S250. Match the first embedding vector with the second embedding vector to determine the target second vector, and determine the candidate rule corresponding to the target second vector as the target rule.

[0071] Specifically, semantic vector matching algorithms (such as cosine similarity, L2 norm, etc.) are used to calculate the similarity between the first embedding vector and each of the second embedding vectors. The top-k second embedding vectors with the highest similarity are selected as the target second vectors, and the candidate rules corresponding to the target second vectors are determined as the target rules. In other words, the most relevant top-k target rules are accurately retrieved from the rule base.

[0072] S260. Construct a guiding prompt word template based on the target rules, and guide the offline language model to generate the target log analysis results and target self-healing strategy corresponding to the log data to be analyzed.

[0073] The offline language model can be a small, open-source language model (such as Vicuna_13B) deployed in an offline environment. This model does not need to interact with the external network, ensuring data security and compliance.

[0074] Specifically, guided prompt word templates can be built based on target rules, that is, enhanced prompt examples can be constructed based on search results:

[0075] "You are a log analysis expert. Here are some examples of analysis for similar log data: [rules extracted from the retrieved rule base]. Based on these examples, please identify anomalies in the provided new log data and provide a detailed analysis of the causes and recovery suggestions."

[0076] The offline open-source language model reads the enhanced prompt mentioned above and, combined with its built-in in-context learning capabilities, performs precise anomaly analysis on the log data to be analyzed, generating detailed target log analysis results and target self-healing strategies. For example... Figure 3 As shown, this is a schematic diagram of the overall structure of the REL A-AR frame of the present invention. Figure 4 The diagram shown is a flowchart of the log analysis and service self-healing strategy recommendation process of this invention.

[0077] In some optional embodiments, after generating the target log analysis results and target self-healing strategy corresponding to the log data to be analyzed, the method further includes: evaluating the implementation effect of the target self-healing strategy according to a preset period to obtain the evaluation results; determining new training samples based on the evaluation results, and feeding the new training samples back to the online large language model to optimize and update the rule base.

[0078] To maintain the continued effectiveness and adaptability of the embodiments of this invention, a mechanism for continuous optimization and updating is proposed. After the target self-healing strategy is implemented in the offline environment, operations and maintenance personnel regularly evaluate the effectiveness of the self-healing strategy and record information on the effectiveness of the strategy and the accuracy of fault recovery. This feedback information is re-inputted into the online large language model in the next cycle for dynamic optimization and updating of the rule base, ensuring that the rule base continuously meets actual operations and maintenance needs.

[0079] Specifically, to maintain the effectiveness of the rule base, this invention proposes a continuous optimization and update mechanism:

[0080] (1) Regularly conduct retrospective evaluations of the implementation effectiveness of the service self-healing strategy and generate a strategy implementation effectiveness report. The report includes indicators such as strategy execution success rate, recovery timeliness, false alarm rate, and unidentified abnormal scenarios.

[0081] (2) Operation and maintenance experts regularly summarize the evaluation results and feed them back to the large language model in the Online stage as new training samples for incremental updates of the rule base.

[0082] (3) After receiving feedback information, the online large language model re-evaluates and optimizes the rule base, adds new abnormal scenario rules, and corrects or deletes rules that are no longer valid.

[0083] (4) After the rule base is updated, it will be automatically synchronized to the rule base in the offline environment to ensure that the offline analysis is always up-to-date.

[0084] The technical solution of this invention involves acquiring sample log data and generating log analysis results and self-healing analysis strategies corresponding to the sample log data based on an online large language model; generating candidate rules based on the feature descriptions, log analysis results, and self-healing analysis strategies corresponding to the sample log data, and constructing a rule base based on the candidate rules; acquiring the log data to be analyzed and determining the target rule based on the vector matching results between the log data to be analyzed and the candidates in the rule base; constructing a guiding prompt word template based on the target rule, and guiding the offline language model to generate the target log analysis results and target self-healing strategies corresponding to the log data to be analyzed. This technical solution, based on an online large language model, constructs a rule base for retrieval enhancement for the offline language model, enabling the offline language model to not only improve the ability to identify abnormal logs but also ensure data security. It solves the problem that existing log analysis methods cannot simultaneously achieve security and high efficiency and accuracy, realizing secure, efficient, and accurate log analysis and automatically recommending service self-healing strategies.

[0085] This invention offers at least the following technical advantages: 1. High security and compliance: This method is applicable to sensitive data environments, avoiding the risk of sensitive data leakage. 2. Accurate anomaly identification: Utilizing advanced models to build a high-quality rule base effectively improves the ability to identify log anomalies in offline environments. 3. Rapid fault recovery: Based on automatically recommended fault self-healing strategies, it significantly reduces service failure response and recovery time, improving system high availability. 4. Strong scalability: The rule base supports continuous updates and optimization, easily adapting to complex and ever-changing operational needs.

[0086] Figure 5 This is a schematic diagram of a log analysis and service self-healing strategy recommendation device provided in an embodiment of the present invention. Figure 5 As shown, the device includes:

[0087] The sample log analysis module 310 is used to acquire sample log data and generate log analysis results and self-healing analysis strategies corresponding to the sample log data based on the online large language model.

[0088] The rule base generation module 320 is used to generate candidate rules based on the feature descriptions, log analysis results and self-healing analysis strategies corresponding to the sample log data, and to build a rule base based on the candidate rules.

[0089] The target rule determination module 330 is used to acquire the log data to be analyzed and determine the target rule based on the vector matching results between the log data to be analyzed and the candidates in the rule base;

[0090] The log offline analysis module 340 is used to build a guiding prompt word template based on the target rules, and guide the offline language model to generate the target log analysis results and target self-healing strategy corresponding to the log data to be analyzed.

[0091] The technical solution of this invention involves acquiring sample log data and generating log analysis results and self-healing analysis strategies corresponding to the sample log data based on an online large language model; generating candidate rules based on the feature descriptions, log analysis results, and self-healing analysis strategies corresponding to the sample log data, and constructing a rule base based on the candidate rules; acquiring the log data to be analyzed and determining the target rule based on the vector matching results between the log data to be analyzed and the candidates in the rule base; constructing a guiding prompt word template based on the target rule, and guiding the offline language model to generate the target log analysis results and target self-healing strategies corresponding to the log data to be analyzed. This technical solution, based on an online large language model, constructs a rule base for retrieval enhancement for the offline language model, enabling the offline language model to not only improve the ability to identify abnormal logs but also ensure data security. It solves the problem that existing log analysis methods cannot simultaneously achieve security and high efficiency and accuracy, realizing secure, efficient, and accurate log analysis and automatically recommending service self-healing strategies.

[0092] Optionally, the sample log analysis module 310 includes a sample log data acquisition submodule, used for:

[0093] Select log data, including anomaly types and / or typical characteristics, from actual operation and maintenance log data as sample log data;

[0094] Among them, the anomaly type and / or typical characteristics include at least one of the following: response timeout, authentication failure, abnormal service call, abnormal traffic pattern, and hardware performance degradation.

[0095] Optionally, the sample log analysis module 310 includes:

[0096] The sample log data analysis submodule is used to input sample log data into the online large language model, and through zero-shot hints or thought chain hints, enable the online large language model to generate log analysis results and self-healing analysis strategies corresponding to the sample log data.

[0097] Optionally, the rule base generation module 320 is specifically used for:

[0098] By combining feature descriptions, log analysis results, and self-healing analysis strategies, candidate rules are obtained.

[0099] The feature description includes the timestamp, service name, HTTP request method and status code, and response time corresponding to the sample log data.

[0100] Optionally, the target rule determination module 330 is specifically used for:

[0101] Feature extraction is performed on the log data to be analyzed to obtain the feature description string corresponding to the log data to be analyzed;

[0102] By using a pre-trained semantic embedding model, the feature description string and the candidate rule are transformed to obtain the first embedding vector corresponding to the feature description string and the second embedding vector corresponding to the candidate rule.

[0103] The first embedding vector is matched with the second embedding vector to determine the target second vector, and the candidate rule corresponding to the target second vector is determined as the target rule.

[0104] Optionally, the target rule determination module 330 is also specifically used for:

[0105] Determine the similarity between the first embedding vector and each of the second embedding vectors, and select at least one second embedding vector as the target second vector based on the similarity.

[0106] Optionally, the device also includes an optimization module for:

[0107] The effectiveness of the self-healing strategy is evaluated according to a preset cycle, and the evaluation results are obtained.

[0108] Based on the evaluation results, new training samples are determined and fed back to the online large language model to optimize and update the rule base.

[0109] The log analysis and service self-healing strategy recommendation device provided in the embodiments of the present invention can execute the log analysis and service self-healing strategy recommendation method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the method execution.

[0110] Figure 6This is a schematic diagram of an electronic device for implementing the log analysis and service self-healing strategy recommendation method of this invention. The electronic device is intended to represent various forms of digital computers, such as laptops, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframes, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (e.g., helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the invention described and / or claimed herein.

[0111] like Figure 6 As shown, the electronic device 10 includes at least one processor 11 and a memory, such as a read-only memory (ROM) 12 or a random access memory (RAM) 13, communicatively connected to the at least one processor 11. The memory stores computer programs executable by the at least one processor. The processor 11 can perform various appropriate actions and processes based on the computer program stored in the ROM 12 or loaded from storage unit 18 into the RAM 13. The RAM 13 may also store various programs and data required for the operation of the electronic device 10. The processor 11, ROM 12, and RAM 13 are interconnected via a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0112] Multiple components in electronic device 10 are connected to I / O interface 15, including: input unit 16, such as keyboard, mouse, etc.; output unit 17, such as various types of displays, speakers, etc.; storage unit 18, such as disk, optical disk, etc.; and communication unit 19, such as network card, modem, wireless transceiver, etc. Communication unit 19 allows electronic device 10 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0113] Processor 11 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special-purpose artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any suitable processor, controller, microcontroller, etc. Processor 11 performs the various methods and processes described above, such as log analysis and service self-healing strategy recommendation methods.

[0114] In some embodiments, the log analysis and service self-healing strategy recommendation method may be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on electronic device 10 via ROM 12 and / or communication unit 19. When the computer program is loaded into RAM 13 and executed by processor 11, one or more steps of the log analysis and service self-healing strategy recommendation method described above may be performed. Alternatively, in other embodiments, processor 11 may be configured to perform the log analysis and service self-healing strategy recommendation method by any other suitable means (e.g., by means of firmware).

[0115] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays (FPGAs), application-specific integrated circuits (ASICs), application-specific standard products (ASSPs), systems-on-a-chip (SoCs), payload-programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0116] Computer programs used to implement the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be performed. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0117] In the context of this invention, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination thereof. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fibers, portable compact disk read-only memory (CD-ROM), optical storage devices, magnetic storage devices, or any suitable combination thereof.

[0118] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0119] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0120] A computing system can include clients and servers. Clients and servers are generally located far apart and typically interact through communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a hosting product within the cloud computing service system to address the shortcomings of traditional physical hosts and VPS services, such as high management difficulty and weak business scalability.

[0121] It should be understood that the various forms of processes shown above can be used, with steps reordered, added, or deleted. For example, the steps described in this invention can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this invention can be achieved, and this is not limited herein.

[0122] The specific embodiments described above do not constitute a limitation on the scope of protection of this invention. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this invention should be included within the scope of protection of this invention.

Claims

1. A method for log analysis and service self-healing strategy recommendation, characterized in that, The method comprises: acquiring sample log data, and generating log analysis results and self-healing analysis strategies corresponding to the sample log data based on an online large language model; generating candidate rules based on feature descriptions corresponding to the sample log data, the log analysis results, and the self-healing analysis strategies, and constructing a rule library based on the candidate rules; acquiring log data to be analyzed, and determining a target rule according to a vector matching result between the log data to be analyzed and the candidate rules in the rule library, comprising: performing feature extraction on the log data to be analyzed to obtain a feature description string corresponding to the log data to be analyzed; performing conversion processing on the feature description string and the candidate rules respectively through a pre-trained semantic embedding model to obtain a first embedding vector corresponding to the feature description string and a second embedding vector corresponding to the candidate rules; matching the first embedding vector and the second embedding vector to determine a target second vector, and determining the candidate rule corresponding to the target second vector as the target rule; constructing a guided prompt word template based on the target rule, and guiding an offline language model to generate target log analysis results and target self-healing strategies corresponding to the log data to be analyzed; wherein the offline language model is a small open source language model deployed in an offline environment; the generating of the candidate rules based on the feature descriptions corresponding to the sample log data, the log analysis results, and the self-healing analysis strategies comprises: combining the feature descriptions, the log analysis results, and the self-healing analysis strategies to obtain the candidate rules; wherein the feature descriptions comprise timestamps, service names, HTTP request methods, status codes, and response times corresponding to the sample log data.

2. The method of claim 1, wherein, The acquiring of the sample log data comprises: selecting log data including abnormal types and / or typical features from actual operation and maintenance log data as the sample log data; wherein the abnormal types and / or typical features include at least one of response timeout, authentication failure, abnormal service call, abnormal traffic pattern, and hardware performance degradation.

3. The method of claim 1, wherein, The generating of the log analysis results and the self-healing analysis strategies corresponding to the sample log data based on the online large language model comprises: inputting the sample log data into the online large language model, and generating the log analysis results and the self-healing analysis strategies corresponding to the sample log data through zero-shot prompting or thought chain prompting.

4. The method of claim 1, wherein, The matching of the first embedding vector and the second embedding vector to determine a target second vector comprises: determining the similarity of the first embedding vector and each second embedding vector, and selecting at least one second embedding vector as the target second vector according to the similarity.

5. The method of claim 1, wherein, After the generating of the target log analysis results and the target self-healing strategies corresponding to the log data to be analyzed, the method further comprises: evaluating the implementation effect of the target self-healing strategies according to a preset period to obtain an evaluation result; According to the evaluation result, determine new training samples, and feed the new training samples back to the online large language model to optimize and update the rule library.

6. A log analysis and service self-healing policy recommendation apparatus, characterized by, Comprise: A sample log analysis module for obtaining sample log data and generating log analysis results and self-healing analysis strategies corresponding to the sample log data based on an online large language model; A rule library generation module for generating candidate rules based on feature descriptions corresponding to the sample log data, the log analysis results and the self-healing analysis strategies, and constructing a rule library based on the candidate rules; A target rule determination module for obtaining log data to be analyzed and determining target rules according to the vector matching results between the log data to be analyzed and the candidate rules in the rule library; An offline log analysis module for constructing a guided prompt word template based on the target rules, and guiding an offline language model to generate target log analysis results and target self-healing strategies corresponding to the log data to be analyzed; wherein the offline language model is a small open source language model deployed in an offline environment; Wherein, the rule library generation module is specifically used for: Combining the feature descriptions, the log analysis results and the self-healing analysis strategies to obtain the candidate rules; wherein the feature descriptions include timestamps, service names, HTTP request methods, status codes and response times corresponding to the sample log data; Wherein, the target rule determination module is specifically used for: Extracting features from the log data to be analyzed to obtain a feature description string corresponding to the log data to be analyzed; converting the feature description string and the candidate rules through a pre-trained semantic embedding model to obtain a first embedding vector corresponding to the feature description string and a second embedding vector corresponding to the candidate rules; matching the first embedding vector and the second embedding vector to determine a target second vector, and determining the candidate rule corresponding to the target second vector as the target rule.

7. An electronic device, comprising: The electronic device comprises: At least one processor; And a memory connected in communication with the at least one processor; wherein The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor to enable the at least one processor to execute the log analysis and service self-healing strategy recommendation method of any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores computer instructions for enabling the processor to execute the log analysis and service self-healing strategy recommendation method of any one of claims 1-5 when executed.

Images