Operation and maintenance log self-learning analysis system and method based on large language model

Abstract

The invention discloses an operation and maintenance log self-learning analysis system and method based on a large language model, and relates to the field of information technology operation and maintenance management. Comprising the steps of 1, creating an operation and maintenance log self-learning analysis system based on a large language model, 2, obtaining original operation and maintenance log data from servers, devices or application programs in real time through a log collection module, 3, format standardization, noise filtering and necessary sensitive information desensitization are conducted on the collected original operation and maintenance log data through a preprocessing module, and a standardized log event sequence is formed; 4, semantic understanding and intelligent analysis are conducted on the log event sequence through a large language model analysis module by means of a pre-trained large language model, and abnormal modes, error reasons or important event abstracts are recognized; 5, a readable analysis report or warning notification is generated through a result output module according to output of the analysis module, and a result is provided for operation and maintenance personnel through a local interface or an operation and maintenance warning system; and step 6, receiving the feedback of the operation and maintenance personnel on the analysis result through a feedback learning module.

Description

Technical Field

[0001] The present invention discloses a large language model-based operation and maintenance log self-learning analysis system and method, relating to the field of information technology operation and maintenance management. Background Art

[0002] In enterprise IT operations, logs are crucial records of system operational status. Existing operations log analysis primarily relies on traditional methods, such as rule-based string matching, fixed-format template parsing, and log retrieval platforms like ELK. While these methods have improved log management efficiency to some extent, they suffer from significant deficiencies in intelligence and scalability. First, rule- or template-based analysis methods lack adaptability and are often unable to adapt to emerging log formats or unknown failure modes, requiring manual updates to the rule base. Platforms like ELK primarily provide index search capabilities, relying on operations personnel to write custom queries and analysis, without a deep understanding of log semantics. Second, existing methods struggle to handle massive log volumes in real time. When systems generate massive amounts of log data, relying solely on manual screening and fixed threshold monitoring is not only labor-intensive but also prone to missed or false positives. Third, existing technologies lack intelligent learning capabilities. Most log analysis methods remain at the static rule-based stage. Even some attempts to incorporate machine learning often require large amounts of labeled data to train specific models, making them difficult to adapt to the diverse log sources found in enterprise private environments. When new failures occur, it is difficult to automatically identify the cause or provide diagnostic recommendations.

[0003] Furthermore, regarding security, cloud-based log analysis solutions may require uploading enterprise log data to a third-party platform, posing a risk of data leakage. Even with a self-built platform, data fragmentation across different tools increases management and maintenance complexity. Current O&M log analysis methods generally lack a unified intelligent platform for deep mining and closed-loop utilization of log information, failing to meet the growing demand for automated, efficient, and secure O&M. Summary of the Invention

[0004] In response to the problems of the prior art, the present invention provides an operation and maintenance log self-learning analysis system and method based on a large language model, which has the characteristics of strong versatility and simple implementation, and has broad application prospects.

[0005] The specific scheme proposed by the present invention is:

[0006] The present invention provides a self-learning analysis method for operation and maintenance logs based on a large language model, comprising:

[0007] Step 1: Create an operation and maintenance log self-learning analysis system based on a large language model. The system includes a log collection module, a preprocessing module, a large language model analysis module, a result output module, and a feedback learning module.

[0008] Step 2: Use the log collection module to obtain raw operation and maintenance log data from each server, device or application in real time.

[0009] Step 3: The pre-processing module standardizes the format of the collected raw operation and maintenance log data, filters out noise, and desensitizes necessary sensitive information to form a standardized log event sequence;

[0010] Step 4: The large language model analysis module uses a pre-trained large language model to perform semantic understanding and intelligent analysis of log event sequences to identify abnormal patterns, error causes, or important event summaries.

[0011] Step 5: Generate a readable analysis report or warning notification based on the output of the analysis module through the result output module, and provide the results to the operation and maintenance personnel through the local interface or the operation and maintenance alarm system;

[0012] Step 6: Receive feedback from operators on the analysis results through the feedback learning module, and store the feedback information in the knowledge base or use it to trigger local fine-tuning training of the large language model, thereby achieving adaptive optimization of the model.

[0013] Furthermore, the original operation and maintenance log data acquired in real time by the log collection module in step 2 of the self-learning analysis method for operation and maintenance logs based on a large language model includes: system logs, application logs, and security logs.

[0014] Furthermore, in step 4 of the self-learning analysis method for operation and maintenance logs based on a large language model, the large language model is pre-trained in the log field based on the Transformer architecture through the large language model analysis module to understand the unique format and terminology of the log, identify abnormal patterns and causes of errors in the log, and infer the root cause of the problem or give a brief description of the event.

[0015] Furthermore, in step 5 of the self-learning analysis method for operation and maintenance logs based on a large language model: when a warning notification is output through the result output module, the warning notification includes the detected anomaly and alarm information, and the alarm information includes the occurrence time, the involved components, the anomaly type, and the cause analysis given by the model;

[0016] For daily operation status, the analysis report can provide a log summary report, and the output results are displayed through the operation and maintenance dashboard interface, or notified to the relevant responsible persons via email or SMS.

[0017] The present invention also provides an operation and maintenance log self-learning analysis system based on a large language model, the system includes a log collection module, a preprocessing module, a large language model analysis module, a result output module and a feedback learning module.

[0018] The log collection module obtains raw operation and maintenance log data from each server, device or application in real time.

[0019] The pre-processing module standardizes the format of the collected raw operation and maintenance log data, filters out noise, and desensitizes necessary sensitive information to form a standardized log event sequence;

[0020] The large language model analysis module uses a pre-trained large language model to perform semantic understanding and intelligent analysis of log event sequences to identify abnormal patterns, error causes, or important event summaries;

[0021] The result output module generates a readable analysis report or warning notification based on the output of the analysis module, and provides the results to the operation and maintenance personnel through the local interface or the operation and maintenance alarm system;

[0022] The feedback learning module receives feedback from operation and maintenance personnel on the analysis results, and stores the feedback information in the knowledge base or uses it to trigger local fine-tuning training of the large language model, thereby achieving adaptive optimization of the model.

[0023] Furthermore, the original operation and maintenance log data acquired in real time by the log collection module of the operation and maintenance log self-learning analysis system based on a large language model includes: system logs, application logs, and security logs.

[0024] Furthermore, the large language model analysis module of the self-learning analysis system for operation and maintenance logs based on a large language model performs special pre-training of the large language model in the log field based on the Transformer architecture, understands the unique format and terminology of the log, identifies abnormal patterns and causes of errors in the log, and infers the root cause of the problem or gives a brief description of the event.

[0025] Furthermore, when the result output module of the operation and maintenance log self-learning analysis system based on a large language model outputs a warning notification, the warning notification includes the detected anomaly and alarm information, and the alarm information includes the occurrence time, the components involved, the anomaly type and the cause analysis given by the model;

[0026] For daily operation status, the analysis report can provide a log summary report, and the output results are displayed through the operation and maintenance dashboard interface, or notified to the relevant responsible persons via email or SMS.

[0027] The benefits of the present invention are:

[0028] High Data Security: This system utilizes local deployment, allowing operation and maintenance log data to be processed entirely within the enterprise network without being sent to the cloud or third-party platforms. This closed-loop data loop ensures that sensitive information is not leaked, meeting stringent security compliance requirements.

[0029] Intelligent Analysis: A large language model is introduced to perform in-depth semantic analysis of logs, breaking through the limitations of traditional keyword-based matching. The model can understand the log context, discover hidden problem patterns, and infer the causes, significantly improving the accuracy of anomaly detection and the depth of problem diagnosis.

[0030] Self-learning capability: A self-improvement mechanism is established through the feedback learning module. The system continuously updates the model based on feedback from operations personnel, allowing the analysis algorithm to adapt to new log formats and fault types. Over time, the model's understanding of the environment gradually deepens, reducing the workload of subsequent manual tuning.

[0031] Efficient and Real-Time Processing: The device automatically processes massive amounts of log data in real time. Compared to manual inspection or periodic sampling analysis, this invention can instantly analyze and issue alerts as logs are generated, shortening fault detection and response time. It also supports parallel processing and module expansion, enabling it to handle the massive log volumes generated by large-scale distributed systems.

[0032] Reduce operation and maintenance costs: With the help of the automated analysis of this invention, the operation and maintenance team does not need to spend a lot of manpower on tedious log screening. It automatically provides analysis conclusions and processing suggestions, helping operation and maintenance personnel focus on decision-making and execution, greatly improving work efficiency and saving labor costs.

[0033] Meet Industry Needs: The current IT operations and maintenance landscape is increasingly driven by automation and intelligence, and the features of this invention align closely with this trend. It provides solutions to operational pain points such as an overabundance of alerts and difficulty locating root causes. It can be applied to industries with stringent system reliability requirements, such as finance, telecommunications, and the internet, helping enterprises reduce costs, increase efficiency, and upgrade their operations and maintenance models. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] Figure 1 It is a schematic diagram of the system process interaction of the present invention. DETAILED DESCRIPTION

[0035] The present invention will be further described below with reference to the accompanying drawings and specific embodiments so that those skilled in the art can better understand the present invention and implement it. However, the embodiments are not intended to limit the present invention.

[0036] Example 1

[0037] The present invention provides a self-learning analysis method for operation and maintenance logs based on a large language model, comprising:

[0038] Step 1: Create an operation and maintenance log self-learning analysis system based on a large language model. The system includes a log collection module, a preprocessing module, a large language model analysis module, a result output module, and a feedback learning module.

[0039] Step 2: Use the log collection module to obtain raw operation and maintenance log data from each server, device, or application in real time. The raw operation and maintenance log data includes: system logs, application logs, and security logs.

[0040] Step 3: The pre-processing module standardizes the format of the collected raw operation and maintenance log data, filters out noise, and desensitizes necessary sensitive information to form a standardized log event sequence;

[0041] Step 4: The large language model analysis module uses a pre-trained large language model to perform semantic understanding and intelligent analysis of log event sequences, identifying abnormal patterns, error causes, or important event summaries. The large language model analysis module uses the Transformer architecture to pre-train the large language model specifically for logs. This module understands the unique format and terminology of logs, identifies abnormal patterns and error causes in logs, and infers the root cause of the problem or provides a summary description of the event.

[0042] Step 5: The result output module generates a readable analysis report or warning notification based on the output of the analysis module, and provides the results to the operation and maintenance personnel through the local interface or the operation and maintenance alarm system. When the warning notification is output through the result output module, the warning notification includes the detected anomaly and alarm information. The alarm information includes the occurrence time, the components involved, the anomaly type, and the cause analysis given by the model;

[0043] For daily operation status, the analysis report can provide a log summary report, and the output results are displayed through the operation and maintenance dashboard interface, or notified to the relevant responsible persons via email or SMS.

[0044] Step 6: The feedback learning module receives feedback from operators on the analysis results and stores this information in the knowledge base or triggers local fine-tuning of the large language model, thereby achieving adaptive optimization of the model. For example, when the model issues an alarm, operators can mark the alarm as true, false positive, or missed, and provide an explanation of the actual cause of the failure; or, when the system is operating normally, they can supplement the model with potential hidden danger signals that were not captured.

[0045] Furthermore, during model updates, the feedback learning module organizes and stores collected feedback data, and regularly or in real time updates and trains the large language model. Specifically, incremental learning can be used to fine-tune model parameters using newly annotated data or to update the model's internal knowledge base and prompting strategies, incorporating the latest operational knowledge. The update process can be performed asynchronously in the background. Upon completion, the improved model will be used in subsequent analyses, gradually improving the accuracy and coverage of the analysis, forming a self-evolving closed loop of log input, analysis output, feedback learning, and model optimization.

[0046] For reference Figure 1In the application of the present application, the log collection module is used to obtain original logs generated at various places of a distributed system; the preprocessing module unifies the format of logs from different sources and filters noise; the large language model analysis module performs semantic analysis on the preprocessed logs, locates abnormalities and extracts important information; the result output module presents the obtained alarms and reports to the user; and the feedback learning module optimizes model parameters according to user feedback, so as to realize self-learning and continuous improvement of the system.

[0047] Embodiment 2

[0048] The present application also provides a large language model-based operation and maintenance log self-learning analysis system, which comprises a log collection module, a preprocessing module, a large language model analysis module, a result output module and a feedback learning module,

[0049] The log collection module obtains original operation and maintenance log data in real time from various servers, devices or application programs,

[0050] The preprocessing module performs format standardization, noise filtering and necessary sensitive information desensitization on the collected original operation and maintenance log data, to form a standardized log event sequence;

[0051] The large language model analysis module performs semantic understanding and intelligent analysis on the log event sequence by using a pre-trained large language model, to identify abnormal patterns, error causes or important event summaries;

[0052] The result output module generates readable analysis reports or warning notifications according to the output of the analysis module, and provides the results to operation and maintenance personnel through a local interface or an operation and maintenance alarm system;

[0053] The feedback learning module receives feedback of the operation and maintenance personnel on the analysis results, and stores the feedback information in a knowledge base or uses the feedback information to trigger local fine-tuning training of the large language model, so as to realize adaptive optimization of the model.

[0054] The modules of the system can be connected in a decoupled manner through a standard data interface, the data flow between the modules is sequentially transmitted in a pipeline order, and parallel and distributed deployment is supported to process large-scale log data. Each functional module can be horizontally expanded or independently upgraded as needed, and has good scalability and maintainability. The entire device can be deployed on a user's local server or private cloud environment, and log data is processed in an internal closed loop throughout, without the need to be uploaded to an external platform, so that data security and privacy are ensured.

[0055] The information interaction and execution process between the modules in the above system, and the like, are based on the same concept as the method embodiments of the present application, and specific contents can be referred to the description in the method embodiments of the present application, which will not be described herein again.

[0056] Similarly, the present application system has the following advantages:

[0057] High Data Security: This system utilizes local deployment, allowing operation and maintenance log data to be processed entirely within the enterprise network without being sent to the cloud or third-party platforms. This closed-loop data loop ensures that sensitive information is not leaked, meeting stringent security compliance requirements.

[0058] Intelligent Analysis: A large language model is introduced to perform in-depth semantic analysis of logs, breaking through the limitations of traditional keyword-based matching. The model can understand the log context, discover hidden problem patterns, and infer the causes, significantly improving the accuracy of anomaly detection and the depth of problem diagnosis.

[0059] Self-learning capability: A self-improvement mechanism is established through the feedback learning module. The system continuously updates the model based on feedback from operations personnel, allowing the analysis algorithm to adapt to new log formats and fault types. Over time, the model's understanding of the environment gradually deepens, reducing the workload of subsequent manual tuning.

[0060] Efficient and Real-Time Processing: The device automatically processes massive amounts of log data in real time. Compared to manual inspection or periodic sampling analysis, this invention can instantly analyze and issue alerts as logs are generated, shortening fault detection and response time. It also supports parallel processing and module expansion, enabling it to handle the massive log volumes generated by large-scale distributed systems.

[0061] Reduce operation and maintenance costs: With the help of the automated analysis of this invention, the operation and maintenance team does not need to spend a lot of manpower on tedious log screening. It automatically provides analysis conclusions and processing suggestions, helping operation and maintenance personnel focus on decision-making and execution, greatly improving work efficiency and saving labor costs.

[0062] Meet Industry Needs: The current IT operations and maintenance landscape is increasingly driven by automation and intelligence, and the features of this invention align closely with this trend. It provides solutions to operational pain points such as an overabundance of alerts and difficulty locating root causes. It can be applied to industries with stringent system reliability requirements, such as finance, telecommunications, and the internet, helping enterprises reduce costs, increase efficiency, and upgrade their operations and maintenance models.

[0063] It should be noted that not all steps and modules in the above-mentioned processes and system structures are required, and certain steps or modules can be omitted according to actual needs. The execution order of each step is not fixed and can be adjusted as needed. The system structure described in the above-mentioned embodiments can be a physical structure or a logical structure, that is, some modules may be implemented by the same physical entity, or some modules may be implemented by multiple physical entities, or may be implemented by certain components in multiple independent devices.

[0064] The above embodiments are merely preferred embodiments for the purpose of fully illustrating the present invention, and the scope of protection of the present invention is not limited thereto. Equivalent substitutions or modifications made by those skilled in the art based on the present invention are within the scope of protection of the present invention. The scope of protection of the present invention shall be subject to the claims.

Claims

1. A self-learning analysis method for operation and maintenance logs based on a large language model, characterized by include: Step 1: Create an operation and maintenance log self-learning analysis system based on a large language model. The system includes a log collection module, a preprocessing module, a large language model analysis module, a result output module, and a feedback learning module. Step 2: Use the log collection module to obtain raw operation and maintenance log data from each server, device or application in real time. Step 3: The pre-processing module standardizes the format of the collected raw operation and maintenance log data, filters out noise, and desensitizes necessary sensitive information to form a standardized log event sequence; Step 4: The large language model analysis module uses a pre-trained large language model to perform semantic understanding and intelligent analysis of log event sequences to identify abnormal patterns, error causes, or important event summaries. Step 5: Generate a readable analysis report or warning notification based on the output of the analysis module through the result output module, and provide the results to the operation and maintenance personnel through the local interface or the operation and maintenance alarm system; Step 6: Receive feedback from operators on the analysis results through the feedback learning module, and store the feedback information in the knowledge base or use it to trigger local fine-tuning training of the large language model, thereby achieving adaptive optimization of the model.

2. The self-learning analysis method for operation and maintenance logs based on a large language model according to claim 1 is characterized by: The raw operation and maintenance log data obtained in real time by the log collection module in step 2 includes: system logs, application logs, and security logs.

3. According to the self-learning analysis method of operation and maintenance logs based on a large language model according to claim 1, it is characterized in that in step 4, the large language model analysis module performs special pre-training on the large language model in the log field based on the Transformer architecture, understands the unique format and terminology of the log, identifies abnormal patterns and causes of errors in the log, and infers the root cause of the problem or gives a brief description of the event.

4. The self-learning analysis method for operation and maintenance logs based on a large language model according to claim 1 is characterized by: Step 5: When the result output module outputs a warning notification, the warning notification includes the detected anomaly and alarm information. The alarm information includes the occurrence time, the components involved, the anomaly type, and the cause analysis given by the model; For daily operation status, the analysis report can provide a log summary report, and the output results are displayed through the operation and maintenance dashboard interface, or notified to the relevant responsible persons via email or SMS.

5. A self-learning analysis system for operation and maintenance logs based on a large language model, characterized by The system includes a log collection module, a preprocessing module, a large language model analysis module, a result output module and a feedback learning module. The log collection module obtains raw operation and maintenance log data from each server, device or application in real time. The pre-processing module standardizes the format of the collected raw operation and maintenance log data, filters out noise, and desensitizes necessary sensitive information to form a standardized log event sequence; The large language model analysis module uses a pre-trained large language model to perform semantic understanding and intelligent analysis of log event sequences to identify abnormal patterns, error causes, or important event summaries; The result output module generates a readable analysis report or warning notification based on the output of the analysis module, and provides the results to the operation and maintenance personnel through the local interface or the operation and maintenance alarm system; The feedback learning module receives feedback from operation and maintenance personnel on the analysis results, and stores the feedback information in the knowledge base or uses it to trigger local fine-tuning training of the large language model, thereby achieving adaptive optimization of the model.

6. The self-learning analysis system for operation and maintenance logs based on a large language model according to claim 5 is characterized by: The log collection module obtains raw operation and maintenance log data in real time, including: system logs, application logs, and security logs.

7. The self-learning analysis system for operation and maintenance logs based on a large language model according to claim 5 is characterized by: The large language model analysis module pre-trains large language models specifically for the log field based on the Transformer architecture. It understands the unique format and terminology of logs, identifies abnormal patterns and causes of errors in logs, and infers the root cause of the problem or provides a summary description of the event.

8. The self-learning analysis system for operation and maintenance logs based on a large language model according to claim 5 is characterized by: When the result output module outputs a warning notification, the warning notification includes the detected anomaly and alarm information. The alarm information includes the occurrence time, the components involved, the anomaly type, and the cause analysis given by the model; For daily operation status, the analysis report can provide a log summary report, and the output results are displayed through the operation and maintenance dashboard interface, or notified to the relevant responsible persons via email or SMS.

Images