Location method, system and device based on LLM root cause and storage medium

Abstract

The invention provides an LLM-based root cause positioning method, system and device, and a storage medium, and aims to solve the problem of rapid positioning in a complex alarm scene. According to the root cause positioning method, a prompt word of root cause analysis of an alarm to be analyzed is sent to an LLM for root cause analysis, the LLM queries association instances of alarm nodes to be analyzed and the association relationship between the instances through a topology query tool, and alarm information of the association instances within 10 minutes before and after the alarm to be analyzed is generated is queried through an alarm query tool. And integrating the inquired and returned association instances, the association relationship between the instances and the alarm information of the association instances, and performing deep analysis and reasoning through a root cause positioning module to realize judgment of the alarm root cause. According to the method, by means of the intelligent analysis capability of the LLM and in combination with topological information and associated alarm information, mass alarm data can be efficiently processed, deep root causes behind alarms can be accurately mined, and powerful support is provided for rapid handling and recovery of system faults.

Description

TECHNICAL FIELD

[0001] The present application relates to the field of operation and maintenance, and in particular to a method and system for root cause positioning based on LLM, a device and a storage medium. BACKGROUND

[0002] In today's complex computer systems and network environment, with the continuous expansion of the scale of application systems and the increasing complexity of business logic, a large amount of alarm information will be generated during system operation. These alarm information is often interrelated and complex, and accurately and quickly locating the root cause of the alarm has become a highly challenging task.

[0003] Traditional root cause positioning methods mainly rely on manual experience and simple rule matching. For example, operation and maintenance personnel check possible factors that may cause alarms to appear one by one according to pre-set alarm rules. This approach is inefficient, requires high professional knowledge and experience of operation and maintenance personnel, and is prone to misjudgment and omission.

[0004] At the same time, existing root cause positioning technologies often lack sufficient use of alarm context information when processing alarm information, and cannot fully consider the upstream and downstream relationships of alarm objects in the system topology structure and the alarm conditions of related nodes, resulting in difficulty in ensuring the accuracy and reliability of the root cause positioning results. Therefore, there is an urgent need for a more intelligent, efficient and accurate root cause positioning method to meet the needs of complex system operation and maintenance management. SUMMARY

[0005] The embodiments of the present application provide a method and system for root cause positioning based on LLM, a device and a storage medium, aiming to solve the problems of low efficiency, poor accuracy, high dependence on operation and maintenance personnel and difficulty in adapting to complex and variable system environment of existing root cause positioning technologies. The specific technical solutions are as follows:

[0006] In a first aspect, the embodiments of the present application provide a method for root cause positioning based on LLM, and the specific steps are as follows: Step 1, starting the root cause positioning process: sending a prompt word to the LLM to start the root cause positioning process; the LLM is a Large Language Model (Large Language Model); Step 2, querying the associated instances of the alarm object: extracting the key information of the alarm information in the prompt word, generating a request parameter meeting the requirements, and sending the request parameter to a configuration management database (CMDB) to query the associated instances of the alarm object to be analyzed in the configuration management database and the associated relationship between the instances; the configuration management database is a Configuration Management Database (CMDB), and all related information associated with the alarm object is stored in the configuration management database in advance; Step 3, query alarm information of the associated instance: in combination with the associated instance of the alarm object returned by the configuration management database, query all alarm information lists generated by the associated instance within 10 minutes before and after the alarm of the alarm object to be analyzed; the 10 minutes are example times, which can be adjusted according to actual conditions; Step 4, generate a suspected root cause node list: analyze the above-mentioned returned associated instance, the association relationship between instances, and all alarm lists generated by each associated instance, take the alarm object to be analyzed as the analysis starting point, generate an associated path list according to the associated instance and the association relationship, analyze the association relationship and alarm information of all associated paths, and generate a suspected root cause node list; Step 4, locate the root cause and generate a suggestion: through the screened suspected root cause node list, analyze the related information of the suspected root cause node, and in combination with the context information, generate the root cause of the alarm and the alarm disposal suggestion through semantic analysis and reasoning.

[0007] In an embodiment, the starting root cause positioning process further includes: The LLM receives the prompt word and starts the root cause positioning process; The prompt word is composed of details of the alarm to be analyzed and analysis steps of root cause positioning; The analysis steps of root cause positioning include querying the associated instance of the alarm object, querying the alarm details of the associated instance, analyzing the returned associated instance, association relationship, and alarm list, and outputting the root cause determination and processing suggestion based on the context, and sending the prompt word to the LLM for root cause positioning.

[0008] In an embodiment, the querying the associated instance of the alarm object specifically includes: Step 3.1, the LLM uses a preset semantic analysis algorithm to perform word segmentation, part-of-speech tagging, and syntax analysis on the alarm information in the prompt word, extracts the required parameters for interface query according to the parameter requirements of the topology query API interface of the configuration management database; the required parameters for interface query include CMDB model ID and CMDB instance ID; Step 3.2, use the required parameters for interface query as input for calling the topology query API interface, send the parameters to the configuration management database through a network communication protocol to query and return the associated instance and the association relationship between instances.

[0009] In an embodiment, the querying alarm information of the associated instance specifically includes: Step 4.1, the LLM uses a preset semantic analysis algorithm to perform word segmentation, part-of-speech tagging, and syntax analysis on the returned associated instance information, extracts the required parameters for interface query according to the parameter requirements of the alarm query API interface of the alarm system; Step 4.2, the LLM queries the parameter requirement of the API interface according to the alarm occurrence time of the alarm to be analyzed, alarm of the alarm system, generates a time range required to be queried; Step 4.3, the parameters required by the interface query are taken as the input of the alarm query API interface call, and the parameters are sent to the alarm system through a network communication protocol to query a list of all alarm information of the associated instance.

[0010] In an embodiment, the generating of the suspected root cause node list specifically comprises: Step 5.1, taking the alarm object to be analyzed as the analysis starting point, generating a list of associated paths according to the associated instance and the associated relationship; Step 5.2, for the list of associated paths, analyzing the occurrence time of all alarms in the alarm list of each associated instance in each associated path, obtaining the earliest alarm time, and comparing the earliest alarm time with the alarm time of the alarm object to be analyzed, if the earliest alarm time of the associated instance is earlier than the occurrence time of the alarm of the alarm object to be analyzed, the associated instance is marked as a suspected root cause node; Step 5.3, traversing all associated paths according to the steps of the first step and the second step, and generating a list of suspected root cause nodes.

[0011] In an embodiment, the related information of the suspected root cause node comprises: The associated path where the suspected root cause node is located, the associated relationship between instances, and all alarm information generated by the suspected root cause node, including alarm content, alarm index, and alarm occurrence time; the LLM combines context information to generate a root cause of the alarm and an alarm handling suggestion through semantic analysis and reasoning.

[0012] In a second aspect, the embodiments of the present application further provide a system based on LLM root cause positioning, comprising: A user input module is configured to send a prompt word of root cause positioning of an alarm to be analyzed to an LLM, and start a root cause positioning process; A topology query module is configured to query an API interface of a configuration management database according to semantic recognition and analysis of the content of an alarm to be analyzed, generate request parameters of API interface call according to interface requirements of the API interface of the configuration management database, and send the request parameters to the configuration management database to query associated instances and associated relationships between instances of alarm objects related to the alarm to be analyzed in the topology of the configuration management database. The alarm query module is configured to query alarms generated by the associated instance in the 10 minutes before and after the alarm of the alarm object to be analyzed according to an interface requirement of an alarm information query API interface of the alarm system, generate a request parameter of API interface calling, and send the request parameter to the alarm system to obtain alarm information generated by the associated instance of the alarm object in the time period; The root cause positioning module is configured to generate a suspected root cause node list according to a root cause derivation rule according to the associated instance returned by the query, the association relationship between instances, and the alarm list generated by each associated instance in the 10 minutes before and after the alarm of the alarm object to be analyzed, analyze an associated path where the suspected root cause node is located, an association relationship between instances, and all alarm information generated by the suspected root cause node, and generate a root cause of the alarm and an alarm handling suggestion by combining context information through semantic analysis and reasoning.

[0013] In a third aspect, an electronic device is provided, including a processor and a memory. The memory is configured to store instructions, and the processor is configured to load and execute the instructions stored in the memory to implement the operations of any one of the embodiments of the method for root cause positioning based on LLM. The memory and the processor communicate with each other through an internal connection path to ensure smooth data transmission and instruction execution.

[0014] In a fourth aspect, a computer readable storage medium is provided, and the computer readable storage medium stores a computer program. When the computer program is executed by a computer, the process of any one of the embodiments of the method for root cause positioning based on LLM can be implemented, and software support is provided for root cause positioning.

[0015] The advantages or beneficial effects of the above technical solutions at least include: The LLM is used in the present application, which replaces the traditional mode of relying on artificial experience and simple rule matching by virtue of its powerful semantic understanding and analysis capability, realizes efficient and accurate analysis of complex alarm content, reduces manual intervention, significantly improves the efficiency of root cause positioning, can quickly process massive alarm information, and shortens the troubleshooting time. The present application combines the configuration management database topology information and the context alarm information of the alarm system, comprehensively considers the upstream and downstream relationships of the alarm object in the system and the alarm conditions of related nodes, compared with the existing technology which only analyzes alarm information in isolation, through systematic analysis and deep mining, can more accurately find the potential relationship and abnormal mode between alarm information, greatly improves the accuracy and reliability of root cause positioning, and effectively avoids misjudgment and omission; The application can automatically generate targeted alarm handling suggestions, provide clear operation guidance for operation and maintenance personnel, change the previous situation of high dependence on professional knowledge and experience of operation and maintenance personnel, reduce labor cost, improve system operation efficiency and quality, thereby effectively reducing system operation cost, ensuring system stability and reliability, and improving overall system performance.

[0016] The above summary is merely intended to illustrate the present description and is not intended to limit in any way. In addition to the illustrative aspects, embodiments and features described above, further aspects, embodiments and features will be readily apparent to those skilled in the art by reference to the drawings and the following detailed description. BRIEF DESCRIPTION OF DRAWINGS

[0017] In order to more clearly and accurately explain the technical solutions of the embodiments of the present application, the drawings involved in the embodiments will be described in detail. These drawings mainly serve to illustratively show the core content of the technical solutions, and are not strictly drawn according to the actual proportions. The following drawings only show some typical embodiments of the present application, and should not be regarded as limiting the scope of patent protection. Those skilled in the art can obtain more related implementation details from these drawings without creative labor. Figure 1 A method flowchart of the LLM root cause positioning method according to an embodiment of the present application; Figure 2 A system structure schematic diagram of the LLM root cause positioning method according to an embodiment of the present application; Figure 3 An electronic device hardware structure schematic diagram according to an embodiment of the present application. DETAILED DESCRIPTION

[0018] In the following, only some exemplary embodiments are simply described. As those skilled in the art can recognize, the described embodiments can be modified in various different ways without departing from the spirit or scope of the present application. Therefore, the drawings and the description are considered to be essentially illustrative rather than limiting.

[0019] The present application discloses a LLM root cause positioning method, the method flowchart is as shown in Figure 1 The root cause positioning method can include steps S101-S104: S101, sending a prompt word for root cause analysis of an alarm to be analyzed to an LLM for root cause analysis; S102, the LLM queries the associated instances of the alarm to be analyzed and the association relationship between the instances through a topology query tool; S103, the LLM queries the alarm information of the associated instances within 10 minutes before and after the generation of the alarm to be analyzed through an alarm query tool; S104, the LLM analyzes the root cause according to the topological associated instance of the query, the associated relationship between the instances, and the alarm information of the associated instance through the root cause positioning module.

[0020] The specific steps are as follows: The alarm information to be analyzed and the analysis steps of the root cause positioning are combined into a prompt word and sent to the LLM to start the root cause positioning process. The LLM queries the associated instance of the alarm object according to the analysis steps of the prompt word. First, the alarm information in the prompt word is subjected to semantic recognition. According to the interface requirements of the topology query API interface of the configuration management database, the key information of the alarm to be analyzed is extracted from the alarm information to be analyzed. The LLM performs semantic analysis according to the context information to generate a request parameter meeting the requirements, and sends the request parameter to the configuration management database to query the associated instance of the alarm object in the configuration management database and the associated relationship between the instances. The LLM queries the alarm details of the associated instance according to the analysis steps of the prompt word, and queries all alarms generated by the associated instance within 10 minutes before and after the alarm of the alarm object to be analyzed according to the associated instance of the alarm object returned by the configuration management database. The 10 minutes are example times, which can be adjusted according to actual conditions. According to the interface requirements of the alarm information query API interface of the alarm system, the LLM performs semantic analysis according to the context information to generate a request parameter meeting the requirements, and sends the request parameter to the alarm system to query all alarm lists generated by the associated instance within 10 minutes before and after the alarm of the alarm object to be analyzed. The LLM analyzes the associated instance returned by the configuration management database and the associated relationship between the instances and all alarm lists generated by each associated instance within 10 minutes before and after the alarm of the alarm object to be analyzed according to the analysis steps of the prompt word. Taking the alarm object to be analyzed as the starting point of analysis, the associated path list is generated according to the associated instance and the associated relationship. For the associated path list, the alarm time of the earliest alarm object in the alarm list of each associated instance in each associated path is analyzed, and the alarm time of the earliest alarm object is compared with the alarm time of the alarm object to be analyzed. If the associated instance has occurred alarm before the alarm object to be analyzed, the associated instance is marked as a suspected root cause node. The suspected root cause node list is generated by traversing all associated paths according to the above steps. The LLM analyzes the associated path where the suspected root cause node is located and all alarm information generated by the suspected root cause node according to the analysis steps of the prompt word. The LLM combines the context information to generate the root cause of the alarm and the alarm handling suggestion through semantic analysis and reasoning.

[0021] In a possible implementation, the source of the alarm information to be analyzed is determined, which can be obtained from a third-party monitoring system, to ensure that the obtained alarm information contains key elements such as alarm occurrence time, alarm object, CMDB model ID, CMDB instance ID, alarm content, and alarm index.

[0022] In a possible implementation, the prompt word is constructed according to a preset prompt word template. The prompt word template can be designed as “for {alarm object}, {alarm content} that occurs at {alarm occurrence time}, other alarm details include {CMDB model ID}, {CMDB instance ID}. First, according to the affected object in the original alarm details, the topology query tool for the configuration management database is called to query related topology information, and the input is the alarm object in the original alarm details. The output is the associated instance details and the relationship between instances; second, the information obtained from the topology query tool for the configuration management database is taken as a parameter, and the queried instance information is de-duplicated, the alarm information query tool of the alarm system is called, and the alarm details are queried. The input is the associated instance information obtained from the topology query tool, which constitutes the associated instance alarm query condition, and the query time range is 10 minutes before and after the original alarm time. The output is the associated alarm of the associated instance; third, according to the information returned by the first step and the second step, taking the original alarm object as the analysis starting point, the associated instances and the associated relationships are analyzed, and the associated path list is generated. For the associated path list, the alarm time of the earliest alarm object in the alarm list of each associated instance in each associated path is analyzed, and the alarm time of the earliest alarm object is compared with the alarm time of the alarm object to be analyzed. If the associated instance has occurred before the alarm object to be analyzed, the associated instance is marked as a suspected root cause node; the above steps are traversed for all associated paths to generate a suspected root cause node list; fourth, the context analysis process, root cause determination, and processing suggestions are output.

[0023] In a possible implementation, the alarm information to be analyzed is combined with a preset prompt word template and sent to an LLM to trigger a root cause positioning process. The specific analysis process is as follows.

[0024] The LLM uses a preset semantic analysis algorithm to perform word segmentation, part-of-speech tagging, and syntax analysis on the input alarm content, extracts key information, generates request parameters according to the parameter requirements of the configuration management database topology query API interface, and sends these parameters to the configuration management database by means of a network communication protocol, so as to query the associated instances of the alarm object related to the alarm to be analyzed in the topology of the configuration management database and the associated relationships between instances.

[0025] The LLM extracts the parameter requirement alarm object identifier from the alarm information in the prompt word according to the parameter requirement of the topology query API interface of the configuration management database, including the alarm object, the CMDB model ID, and the CMDB instance ID. Taking a certain enterprise-level configuration management database as an example, the request parameter of the topology query API interface is in JSON format, including the CMDB model ID and the CMDB instance ID. The LLM maps and converts the extracted key information. The CMDB model ID and the CMDB instance ID of the alarm content are taken as the request parameters of the topology query API interface. The converted parameters are checked to ensure that the parameter format and value range meet the requirements of the API interface, avoiding query failure due to parameter errors. Finally, with the help of a network communication protocol (such as the HTTP / HTTPS protocol), the converted request parameters are sent to the configuration management database. After receiving the request, the configuration management database queries the instance information associated with the alarm object and the association relationship between the instances according to all the data of the alarm object stored by itself, and returns the query result in a preset data format to the LLM. The returned result includes the associated instances and the association relationship between the instances.

[0026] The LLM queries the alarms generated by the associated instances in the last 10 minutes and the first 10 minutes before the alarm of the alarm object to be analyzed according to the associated instance list and the details of the instances returned by the configuration management database. This step includes the following sub-steps: The LLM extracts the key field information of each instance according to the associated instances returned by the configuration management database, including the CMDB model ID and the CMDB instance ID, and generates a list of instances to be queried without duplicate identifiers, and constructs a list of instances to be queried.

[0027] The LLM generates the time range of the alarms to be queried according to the occurrence time of the alarm to be analyzed. First, the accurate occurrence time of the alarm to be analyzed is determined, which is accurate to seconds. Then, the start and end times of the time range are calculated. Finally, the time range is converted into a time format that can be recognized by the alarm system. If the alarm system requires a timestamp format, the above time is converted into a corresponding timestamp, which is used for subsequent alarm query.

[0028] The LLM generates request parameters according to the request parameter requirements of the alarm information query API interface of the alarm system, and sends the request parameters to the alarm system to obtain alarm information. Different alarm system API interfaces have great differences in parameters. Taking the alarm management system as an example, the query API interface requires input of an alarm object instance list, including parameters such as CMDB model ID, CMDB instance ID, query start time, query end time, and the parameter format is JSON. Then, the generated request parameters are checked to check whether the parameters are complete, the format is correct, and the value is within the allowed range of the API interface. Finally, the request parameters are sent to the alarm system by means of a network communication protocol (such as an HTTP POST request). After receiving the request, the alarm system retrieves the alarm database stored in itself, queries the alarm information generated by the specified associated instance in the specified time range, including CMDB model ID, CMDB instance ID, alarm object, alarm content, alarm occurrence time, alarm level, alarm state, and returns the query result to the LLM in a preset format.

[0029] The LLM further analyzes the associated instances returned by the configuration management database query and the alarm list returned by the alarm system query, takes the alarm to be analyzed as the starting point, generates an associated path to be analyzed according to the associated relationship between the instances returned by the configuration management database, and sequentially checks the associated path. Starting from the starting point of the associated path, the occurrence time of all alarms of each instance is checked, and the alarm time of each associated instance is sorted to obtain the earliest alarm time. If a certain associated instance has an alarm occurring before the alarm to be analyzed, the associated instance is marked as a suspected root cause node.

[0030] The LLM takes the filtered suspected root cause node information, associated path, and alarm list generated by the suspected root cause node as context information for the next analysis, and generates the process of root cause analysis, the root cause of alarm generation, and alarm handling suggestions through deep analysis and reasoning, fully considering the associated relationship between the associated instances and the alarm characteristics in the reasoning process.

[0031] Please refer to Figure 2 , which shows a structural block diagram of a system for root cause positioning according to an embodiment of the present application. The system can include a user input module 210, a large language model 220, a topology query module 230, an alarm query module 240, and a root cause positioning module 250.

[0032] The user input module 210 is configured to send a prompt word for root cause positioning of an alarm to be analyzed to the LLM, and start a root cause positioning process. The topology query module 230 is configured to, according to the interface requirement of the topology query API interface of the configuration management database, generate a request parameter of API interface calling, and send the request parameter to the configuration management database to query the associated instances of the alarm object associated with the alarm to be analyzed in the topology of the configuration management database and the associated relationship between the instances; The alarm query module 240 is configured to, in combination with the associated instances of the alarm object returned by the configuration management database, query the alarms generated by the associated instances in the previous 10 minutes and the next 10 minutes when the alarm object to be analyzed generates an alarm, according to the interface requirement of the alarm information query API interface of the alarm system, generate a request parameter of API interface calling, and send the request parameter to the alarm system to obtain the alarm information generated by the associated instances of the alarm object in the time period. The root cause positioning module 250 is configured to, according to the associated instances returned by the query, the associated relationship between the instances and the alarm list generated by each associated instance in the previous 10 minutes and the next 10 minutes when the alarm object to be analyzed generates an alarm, generate a suspected root cause node list according to a root cause derivation rule, analyze the associated path where the suspected root cause node is located and all the alarm information generated by the suspected root cause node, and in combination with context information, generate a root cause of the alarm and an alarm handling suggestion through semantic analysis and reasoning.

[0033] The functions of each module in each device in the embodiments of the present application can be referred to the corresponding description in the above method, which will not be repeated here.

[0034] Please refer to Figure 3 The electronic device 300 is taken as a hardware carrier for executing the method based on LLM root cause positioning, and mainly comprises a processor 310, a memory 320 and a bus 330. The components work cooperatively to support the running of the method, and the details are as follows. The processor 310 is the operation core of the electronic device, and can be a central processing unit (CPU), a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic device, a discrete gate or transistor logic device, a discrete hardware component, etc. The general-purpose processor can be a microprocessor or any conventional processor, and can also be a processor supporting an advanced RISC machine (ARM) architecture, responsible for loading and executing machine-readable instructions stored in the memory 320, thereby realizing the logic operation and flow control of the method based on LLM root cause positioning.

[0035] The memory 320 is used to store machine-readable instructions executable by the processor 310, and possibly involved data in the LLM root cause positioning process, such as natural language text, model parameters, intermediate operation results, etc. It can include read-only memory (ROM), random access memory (RAM), etc., wherein the ROM is used to store fixed instructions, data or basic input / output system (BIOS), etc., and the RAM is used as a temporary data storage and cache space for the processor at runtime, supporting fast read / write of data and ensuring high efficiency of data interaction in the method execution process. The number thereof can be set to one or more according to actual needs to meet the needs of data storage and processing of different scales.

[0036] The bus 330 serves as a bridge for communication between the processor 310 and the memory 320, and other components (if any) that can exist inside the electronic device, for transmitting address signals, data signals, control signals, and the like. Common bus types include Industry Standard Architecture (ISA) bus, Peripheral Component Interconnect (PCI) bus, or Extended Industry Standard Architecture (EISA) bus, etc., which can be subdivided into address bus, data bus, and control bus. Different types of buses work together to ensure the orderly transmission of data and instructions between the processor and the memory, maintain the stable operation of the electronic device, and support the smooth execution of the method based on LLM root cause positioning. When the electronic device 300 is running, the processor 310 and the memory 320 establish a communication connection through the bus 330. The processor retrieves instructions from the memory and executes them, and then carries out operations related to root cause positioning based on LLM, such as steps of analyzing natural language text and calling large model algorithm inference root cause.

[0037] When the above machine-readable instructions are executed by the processor 310, the electronic device 300 can perform the steps of the method based on LLM root cause positioning as shown in the corresponding method embodiment. Figure 1 The method uses LLM to deeply understand and analyze the input text information, and through the inference operation of the model, it digs out the root cause of the problem. In specific implementation, many aspects of natural language processing will be involved, such as text segmentation, feature extraction, model inference prediction, etc. These operations rely on the computing power of the processor and the data storage and interaction functions of the memory, and are carried out in an orderly manner on the basis of communication guaranteed by the bus. For details, please refer to the description of the corresponding method embodiment, which will not be repeated here.

[0038] The embodiment of the present application provides a computer readable storage medium, which stores a computer program, and the computer program is executed by a processor to realize the root cause positioning method provided in the above embodiments.

[0039] The embodiment of the present application also provides a chip, which includes a processor, and is used for calling and running instructions stored in the memory, so that the communication device installed with the chip executes the method provided by the embodiment of the present application.

[0040] The embodiment of the present application further provides a chip, comprising: an input interface, an output interface, a processor and a memory, the input interface, the output interface, the processor and the memory are connected through internal connection paths, the processor is used for executing the code in the memory, and when the code is executed, the processor is used for executing the method provided by the embodiment of the present application.

[0041] It should be understood that the processor described above can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), field programmable gate arrays (FPGA) or other programmable logic devices, discrete gates or transistor logic devices, discrete hardware components, etc. The general-purpose processor can be a microprocessor or any conventional processor, etc. It should be noted that the processor can be a processor supporting an advanced RISC machine (ARM) architecture.

[0042] Further, the aforementioned memory can include a read-only memory, and a random access memory, and can further include a non-volatile random access memory. The memory can be a volatile memory or a non-volatile memory, or can include both volatile and non-volatile memory. The non-volatile memory can include a read-only memory (ROM), a programmable ROM (PROM), an erasable PROM (EPROM), an electrically EPROM (EEPROM), or a flash memory. The volatile memory can include a random access memory (RAM) used as an external cache memory. By way of example, and not limitation, many forms of RAM are available. For example, a static RAM (SRAM), a dynamic RAM (DRAM), a synchronous DRAM (SDRAM), a double data rate SDRAM (DDR SDRAM), an enhanced SDRAM (ESDRAM), a synchlink DRAM (SLDRAM), and a direct rambus RAM (DR RAM) are available.

[0043] In the above-described embodiments, all or part of the implementation can be realized by software, hardware, firmware, or any combination thereof. When implemented by software, all or part of the implementation can be realized in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, all or part of the processes or functions according to the present application are generated. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable apparatus. The computer instructions can be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium.

[0044] For those skilled in the art, for the convenience and brevity of description, the specific working process of the above-mentioned system, device and unit for realizing LLM root cause positioning can directly refer to the execution process in the corresponding method embodiment, which will not be repeated here.

[0045] To sum up, through the hardware architecture design of the electronic device, the matching of the computer readable storage medium, and the flexible implementation form of the system unit, a complete technical system from hardware support to software deployment, from single machine execution to distributed expansion is constructed for the method based on LLM root cause positioning, so that the root cause positioning method can stably and efficiently run in various actual scenes, and help accurately mine the problem root.

[0046] Finally, it should be noted that: the above-described embodiments are only specific embodiments of the present application, used to illustrate the technical solutions of the present application, and not to limit them. The protection scope of the present application is not limited thereto. Although the present application has been described in detail with reference to the foregoing embodiments, it should be understood by those skilled in the art that any skilled person in the art can modify or easily think of changes to the technical solutions recorded in the foregoing embodiments, or make equivalent replacements to some technical features thereof, within the technical scope disclosed by the present application. Such modifications, changes or replacements do not make the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application, and should be covered within the protection scope of the present application. Therefore, the protection scope of the present application should be subject to the protection scope of the claims.

Claims

1. A method for root cause location based on LLM, characterized in that: include: Step 1: Start the root cause location process: Send the prompt word to LLM to start the root cause location process; The LLM is a Large Language Model. Step 2: Querying the associated instances of the alarm object: Extracting key information of the alarm information in the prompt word, generating request parameters that meet the requirements, and sending the request parameters to the configuration management database to query the associated instances of the alarm object to be analyzed in the configuration management database and the association relationship between the instances; the configuration management database is a Configuration Management Database (CMDB), which pre-stores all relevant information associated with the alarm object; Step 3: Query the alarm information of the associated instance: Combine the associated instance of the alarm object returned by the configuration management database and query the list of all alarm information generated by the associated instance 10 minutes before and 10 minutes after the alarm object to be analyzed generates an alarm; the 10 minutes mentioned above is an example time and can be adjusted according to actual conditions; Step 4: Generate a list of suspected root cause nodes: Analyze the returned association instances, the association relationships between instances, and a list of all alarms generated by each association instance. Using the alarm object to be analyzed as the analysis starting point, generate a list of association paths based on the association instances and the association relationships. Analyze the association relationships and alarm information of all association paths to generate a list of suspected root cause nodes. Step 5: Locate the root cause and generate suggestions: Analyze the relevant information of the suspected root cause nodes through the filtered list, and combine it with the context information. Through semantic analysis and reasoning, generate the root cause of the alarm and alarm handling suggestions.

2. The method for root cause location based on LLM according to claim 1, characterized in that: The process of starting the root cause location process also includes: The LLM receives the prompt word and starts the root cause location process; The prompt word is composed of the details of the alarm to be analyzed and the process steps of the root cause location analysis; The process steps of the root cause location analysis include querying the associated instances of the alarm object, querying the alarm details of the associated instances, analyzing the returned associated instances, association relationships, and alarm lists, and outputting root cause judgments and processing suggestions based on the context, and sending the prompt words to LLM for root cause location.

3. The method for root cause location based on LLM according to claim 1, characterized in that: The query of the associated instance of the alarm object specifically includes: Step 3.1: The LLM uses a preset semantic analysis algorithm to perform word segmentation, part-of-speech tagging, and grammatical analysis on the alarm information in the prompt word, and extracts the parameters required for the interface query based on the parameter requirements of the configuration management database topology query API interface; the parameters required for the interface query include the CMDB model ID and the CMDB instance ID; Step 3.2: Use the parameters required for the interface query as input for calling the topology query API interface, send the parameters to the configuration management database through the network communication protocol to query and return the associated instances and the association relationships between the instances.

4. The method for root cause location based on LLM according to claim 1, characterized in that: The query of the alarm information of the associated instance specifically includes: Step 4.1: The LLM uses a preset semantic analysis algorithm to perform word segmentation, part-of-speech tagging, and grammatical analysis on the returned associated instance information, and extracts the parameters required for the interface query according to the parameter requirements of the alarm query API interface of the alarm system; Step 4.2: The LLM queries the parameter requirements of the API interface based on the alarm occurrence time of the alarm to be analyzed and the alarm of the alarm system, and generates the time range to be queried; Step 4.3: Use the parameters required for the interface query as input for calling the alarm query API interface, and send the parameters to the alarm system through the network communication protocol to query the list of all alarm information of the associated instance.

5. The method for root cause location based on LLM according to claim 1, characterized in that: Generating a list of suspected root cause nodes specifically includes: Step 5.1: Taking the alarm object to be analyzed as the analysis starting point, generate a list of associated paths based on the associated instances and associated relationships; Step 5.2: Analyze the occurrence time of all alarms in the alarm list of each associated instance in each associated path, obtain the earliest alarm time, and compare the earliest alarm time with the alarm time of the alarm object to be analyzed. If the earliest alarm time of the associated instance is earlier than the occurrence time of the alarm of the alarm object to be analyzed, mark the associated instance as a suspected root cause node; Step 5.3: Traverse all associated paths according to steps 5.1 and 5.2 to generate a list of suspected root cause nodes.

6. The method for root cause location based on LLM according to claim 1, characterized in that: The relevant information of the suspected root cause node includes: The associated path where the suspected root cause node is located, the association relationship between instances, and all alarm information generated by the suspected root cause node, including alarm content, alarm indicators, and alarm occurrence time; the LLM combines context information with semantic analysis and reasoning to generate the root cause of the alarm and alarm handling suggestions.

7. A system based on LLM root cause location, characterized in that: include: The user input module is used to send the prompt word for locating the root cause of the alarm to be analyzed to the LLM to start the root cause locating process; The topology query module is used by the LLM to perform semantic recognition and analysis based on the alarm content to be analyzed, generate request parameters for the API interface call according to the interface requirements of the configuration management database topology query API interface, and send the request parameters to the configuration management database to query the alarm objects associated with the alarm to be analyzed in the configuration management database topology for associated instances and the association relationships between instances; The alarm query module is used to query the alarm objects associated with the alarm object returned by the LLM in conjunction with the configuration management database for alarms generated by the associated instances within the 10 minutes before and 10 minutes after the alarm object to be analyzed generates an alarm. Based on the interface requirements of the alarm information query API interface of the alarm system, the module generates request parameters for the API interface call and sends the request parameters to the alarm system to obtain the alarm information generated by the associated instances of the alarm object within the time period. The root cause location module is used by LLM to generate a list of suspected root cause nodes based on the associated instances returned by the query, the association relationships between instances, and the alarm list generated by each associated instance 10 minutes before and 10 minutes after the alarm object to be analyzed generates an alarm. According to the root cause deduction rules, the module analyzes the association paths where the suspected root cause nodes are located, the association relationships between instances, and all alarm information generated by the suspected root cause nodes. The LLM combines context information and generates the root cause of the alarm and alarm handling suggestions through semantic analysis and reasoning.

8. An electronic device, characterized in that: include: A processor and a memory, wherein the memory stores instructions, and the instructions are loaded and executed by the processor to implement the method according to any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, which implements the method according to any one of claims 1 to 6 when executed.

Images