An event-driven and large model fine-tuning-based root cause reasoning method and system

Abstract

The application relates to the operation and maintenance field, in particular to a root cause reasoning method and system based on event driving and large model fine tuning. The method comprises the following steps: acquiring real-time running logs of a plurality of running events; determining a fault code according to the real-time running logs; analyzing the real-time running logs and the fault code to determine a cause-effect chain; analyzing the fault code according to the cause-effect chain to determine whether to perform reverse reasoning; if yes, determining a root cause reasoning scheme according to the fault code analysis result. All relevant events and state changes at the time of fault occurrence are captured. The fault code related to the fault is determined, which helps to narrow down the analysis range. By analyzing the cause-effect relationship between events, a complete cause-effect chain is constructed to identify the sequence and cause of fault occurrence. Whether reverse reasoning is needed is evaluated, which helps to decide whether to trace back to the initial cause of the fault from the fault result, thereby improving the reasoning efficiency.

Description

Technical Field

[0001] This application relates to the field of operations and maintenance, and in particular to a root cause reasoning method and system based on event-driven and large model fine-tuning. Background Technology

[0002] In intelligent operations and maintenance, root cause reasoning is one of the key technologies for resolving system failures and optimizing system operating efficiency. As IT infrastructure becomes increasingly complex, failures often involve multiple events and multi-layered causal relationships.

[0003] Existing technologies have significant limitations when dealing with complex and dynamically changing systems. In particular, when event propagation chains are long and intermediate states are missing, traditional methods often require a long time for reasoning, thus affecting operational efficiency and system reliability. Summary of the Invention

[0004] This application provides a root cause reasoning method and system based on event-driven and large model fine-tuning to solve the above problems.

[0005] Firstly, this application provides a root cause reasoning method based on event-driven and large model fine-tuning, the method comprising:

[0006] Obtain real-time operation logs for several operational events; determine fault codes based on the real-time operation logs;

[0007] Analyze the real-time operation logs and the fault codes to determine the causal chain;

[0008] Based on the causal chain, analyze the fault code to determine whether to perform reverse reasoning;

[0009] If performed, a root cause reasoning scheme will be determined based on the fault code analysis results.

[0010] This approach ensures the capture of all relevant events and state changes at the time of a failure. It identifies fault codes associated with the failure, providing crucial clues for root cause analysis and narrowing the scope of the analysis. By analyzing the causal relationships between events, a complete causal chain is constructed to identify the sequence and cause of the failure. Assessing the need for reverse reasoning helps determine whether to start from the failure outcome and trace back to the initial cause, improving reasoning efficiency. Based on the fault code analysis results, a specific root cause analysis scheme is determined, including selecting appropriate inference algorithms and parameters to ensure the accuracy and effectiveness of the reasoning.

[0011] Optionally, analyzing the real-time operation logs and the fault codes to determine the causal chain includes:

[0012] The time of failure is determined based on the real-time operation log;

[0013] Based on the time of the failure, determine the logic for retrieving historical logs;

[0014] Retrieve historical operation logs according to the aforementioned historical log retrieval logic;

[0015] The causal chain is determined based on the historical operation logs and the fault codes.

[0016] This solution enables rapid identification of fault signs through real-time collection and analysis of operational logs. Extracting fault codes from real-time operational logs helps in accurately identifying fault types. Determining the specific time of the fault ensures access to relevant historical operational log data. A logic for retrieving historical logs is constructed based on the fault's occurrence time, ensuring effective retrieval of relevant historical operational log data. Retrieving historical operational logs according to this logic helps identify the causes and consequences of the fault. By analyzing real-time and historical operational logs, a causal chain of events is constructed, revealing the causal relationships between events and providing a logical framework for locating the root cause of the fault. The accuracy and completeness of the causal chain are verified to ensure it accurately reflects the fault occurrence process, and the chain is optimized to improve diagnostic reliability. The final causal chain is confirmed, thereby improving the efficiency and accuracy of fault diagnosis.

[0017] Optionally, the step of analyzing the fault code based on the causal chain to determine whether to perform reverse reasoning includes:

[0018] Based on the causal chain, determine the reverse reasoning time for reverse root cause reasoning based on the fault code;

[0019] Analyze the causal chain to determine the time required for the event to be reproduced;

[0020] The necessity of reverse reasoning is assessed based on the reverse reasoning time and the recurrence time.

[0021] Based on the necessity of reverse reasoning, determine whether to perform reverse reasoning.

[0022] This solution estimates the time cost required for fault diagnosis by measuring the reverse reasoning time. In-depth analysis of the causal relationships between events provides a logical framework for determining the root cause of the fault. Estimating the event reproduction time assesses the feasibility and efficiency of event reproduction. Comparing the reverse reasoning time and event reproduction time evaluates which method is more suitable for the current fault diagnosis needs, leading to a decision based on efficiency and effectiveness. The assessment of the necessity of reverse reasoning determines whether to perform it, helping to optimize the fault diagnosis process and ensure that the most appropriate method is used to locate the root cause of the fault.

[0023] Optionally, determining the reverse reasoning time for reverse root cause reasoning based on the fault code according to the causal chain includes:

[0024] Analyze the causal chain to determine its length;

[0025] Based on the length of the causal chain, determine the number of causal nodes and the reasoning complexity;

[0026] Based on the historical operation logs, determine the analysis time for each causal node;

[0027] Based on the number of causal nodes and the analysis time of each causal node, the reverse reasoning time for reverse root cause reasoning from the fault codes is determined using the following formula:

[0028] ;

[0029] in, This indicates the time required for the reverse reasoning; This indicates the analysis time for each causal node; Indicates the number of causal nodes; This represents the reasoning complexity.

[0030] This approach, by determining the length of the causal chain, allows for a direct analysis of the number of events involved in the failure process, providing a preliminary understanding of the failure's complexity and causes. Determining the number of causal nodes helps quantify the workload during reasoning, while reasoning complexity helps identify the strength of the correlation between each node. Determining the analysis time for each causal node provides a time estimate for detailed analysis of each node, facilitating resource allocation and ensuring the efficiency of the diagnostic process. Formula used: Calculating the time required for reverse reasoning can provide a quantitative metric, which helps to assess the time cost of reverse reasoning.

[0031] Optionally, analyzing the causal chain to determine the recurrence time taken to reproduce the event includes:

[0032] Analyze the historical operation logs to determine the historical operation delays;

[0033] Based on the historical runtime delay, the analysis time of each causal node is corrected to obtain the accurate analysis time.

[0034] Based on the precise analysis time and the causal chain, the recurrence time of each event in the causal chain is determined.

[0035] This solution identifies time delays encountered in actual operation, helping to more accurately simulate the environment in which a fault occurs. By correcting the analysis time, the time consumption of each causal node is made closer to the actual time consumption in operation, improving the accuracy of fault diagnosis. Precise analysis time consumption can more accurately predict the time required for event reproduction. Determining the reproduction time of each event helps the operations team identify the process of fault occurrence, providing a timeline for fault reproduction and root cause analysis.

[0036] Optionally, determining the root cause reasoning scheme based on the fault code analysis results includes:

[0037] Based on the fault code analysis results, determine the fault occurrence time corresponding to the fault code;

[0038] Based on the time of the fault occurrence, the fault occurrence node is determined;

[0039] Obtain the time tree of the aforementioned running events;

[0040] For each running event, based on the time tree and the fault occurrence time, determine the time probability of the fault code being generated by the fault occurrence node corresponding to each running event.

[0041] Based on the aforementioned time probability, determine the optimal reproducible event;

[0042] Retrieve the historical operation logs of the best reproducible event to determine the root cause reasoning scheme.

[0043] This solution clarifies the specific time point of the failure. Identifying the specific events or decision points that led to the failure helps narrow down the scope of fault diagnosis and concentrate resources on in-depth analysis. By calculating time probabilities, the correlation between each event and the node where the failure occurred can be assessed. Selecting the events most likely to reproduce the failure can improve the success rate of failure reproduction, thereby more accurately pinpointing the cause of the failure. Obtaining detailed historical operation logs helps in-depth analysis of the background and environment in which the events occurred. Constructing a root cause reasoning scheme provides clear steps and strategies for fault diagnosis, helping to improve the efficiency and accuracy of diagnosis.

[0044] Optionally, the step of correcting the analysis time of each causal node based on the historical runtime delay to obtain the accurate analysis time includes:

[0045] Based on the historical operation latency, the average environmental latency in the historical operation log is determined using the following formula:

[0046] ;

[0047] in, This represents the average environmental delay. This indicates the number of historical events in the historical operation log; Indicates the first Environmental delay time for each historical event;

[0048] Based on the average environmental delay, the analysis time for each causal node is corrected to obtain the accurate analysis time, using the following formula:

[0049] ;

[0050] in, This indicates the time taken for the precise analysis; This indicates the analysis time for each causal node; This represents the average environmental delay.

[0051] This solution provides foundational data for analyzing environmental latency, helping to identify past performance patterns. By calculating the average environmental latency, the time cost in historical operations can be quantified, providing a basis for refining analysis time consumption. The initial analysis time consumption for each causal node is determined. By refining the analysis time consumption, the time consumption of each causal node is made closer to the actual time consumption in operation, improving the accuracy of the analysis.

[0052] Optionally, determining the optimal reproducible event based on the time probability includes:

[0053] Analyze the causal chain to determine the cause of the failure at each fault-causing node;

[0054] Based on the causal chain, determine the event execution flow corresponding to each fault-causing node;

[0055] Based on the event execution flow and the cause of the fault, determine the causal probability of the fault code being generated by the fault-generating node corresponding to each running event;

[0056] The optimal reproducible event is determined based on the causal probability and the time probability.

[0057] This solution helps identify the sequence of critical events leading to failures. By analyzing the causal chain, the root cause of the failure is determined. The order and conditions of event occurrence are clarified, providing operational guidelines for failure reproduction. The probability of each event causing the failure is assessed, providing a probabilistic basis for selecting events to reproduce. The probability of each event occurring within a time window is determined, providing a temporal basis for failure reproduction. Combining causal probability and temporal probability allows for a more accurate assessment of the reproducibility value of events, improving the targeting of reproduction. Through comprehensive evaluation, the event most likely to cause the failure is selected for reproduction, increasing the success rate of failure reproduction.

[0058] Optionally, determining the recurrence time of each event in the causal chain based on the precise analysis time and the causal chain includes:

[0059] Based on the event execution flow, determine the causal node to which the event corresponds to each fault-causing node belongs;

[0060] Based on the precise analysis time of each causal node and the causal node to which it belongs, the recurrence time of each event in the causal chain is determined.

[0061] This solution provides a framework for fault diagnosis, facilitating the identification of causal relationships between fault events. Clearly defining the key points of fault diagnosis helps focus the analysis. Establishing causal relationships for each event helps identify dependencies between events. Providing accurate time estimates for each causal node helps plan the reproduction process. Ensuring events are reproduced in the correct logical order avoids errors during reproduction. Providing reproduction time points for each event aids in time management.

[0062] Secondly, this application provides a root cause reasoning system based on event-driven and large model fine-tuning, the system comprising:

[0063] The fault code determination module is used to acquire real-time operation logs and determine fault codes based on the real-time operation logs.

[0064] The causal analysis module is used to analyze the real-time operation logs and the fault codes to determine the causal chain;

[0065] The fault code analysis module is used to analyze the fault code according to the causal chain and determine whether to perform reverse reasoning.

[0066] The solution determination module is used to determine the root cause reasoning solution based on the fault code analysis results if the problem is to occur.

[0067] Optionally, when the causal analysis module analyzes the real-time operation log and the fault code to determine the causal chain, it is used for:

[0068] The time of failure is determined based on the real-time operation log;

[0069] Based on the time of the failure, determine the logic for retrieving historical logs;

[0070] Retrieve historical operation logs according to the aforementioned historical log retrieval logic;

[0071] The causal chain is determined based on the historical operation logs and the fault codes.

[0072] Optionally, when the fault code analysis module analyzes the fault code based on the causal chain and determines whether to perform reverse reasoning, it is used to:

[0073] Based on the causal chain, determine the reverse reasoning time for reverse root cause reasoning based on the fault code;

[0074] Analyze the causal chain to determine the time required for the event to be reproduced;

[0075] The necessity of reverse reasoning is assessed based on the reverse reasoning time and the recurrence time.

[0076] Based on the necessity of reverse reasoning, determine whether to perform reverse reasoning.

[0077] Optionally, when the fault code analysis module determines the reverse reasoning time for reverse root cause reasoning based on the causal chain, it is used for:

[0078] Analyze the causal chain to determine its length;

[0079] Based on the length of the causal chain, determine the number of causal nodes and the reasoning complexity;

[0080] Based on the historical operation logs, determine the analysis time for each causal node;

[0081] Based on the number of causal nodes and the analysis time of each causal node, the reverse reasoning time for reverse root cause reasoning from the fault codes is determined using the following formula:

[0082] ;

[0083] in, This indicates the time required for the reverse reasoning; This indicates the analysis time for each causal node; Indicates the number of causal nodes; This represents the reasoning complexity.

[0084] Optionally, when the fault code analysis module analyzes the causal chain and determines the reproduction time taken to reproduce the event, it is used for:

[0085] Analyze the historical operation logs to determine the historical operation delays;

[0086] Based on the historical runtime delay, the analysis time of each causal node is corrected to obtain the accurate analysis time.

[0087] Based on the precise analysis time and the causal chain, the recurrence time of each event in the causal chain is determined.

[0088] Optionally, when the scheme determination module determines the root cause reasoning scheme based on the fault code analysis results, it is used to:

[0089] Based on the fault code analysis results, determine the fault occurrence time corresponding to the fault code;

[0090] Based on the time of the fault occurrence, the fault occurrence node is determined;

[0091] Obtain the time tree of the aforementioned running events;

[0092] For each running event, based on the time tree and the fault occurrence time, determine the time probability of the fault code being generated by the fault occurrence node corresponding to each running event.

[0093] Based on the aforementioned time probability, determine the optimal reproducible event;

[0094] Retrieve the historical operation logs of the best reproducible event to determine the root cause reasoning scheme.

[0095] Optionally, when the fault code analysis module corrects the analysis time of each causal node based on the historical running delay to obtain the accurate analysis time, it is used for:

[0096] Based on the historical operation latency, the average environmental latency in the historical operation log is determined using the following formula:

[0097] ;

[0098] in, This represents the average environmental delay. This indicates the number of historical events in the historical operation log; Indicates the first Environmental delay time for each historical event;

[0099] Based on the average environmental delay, the analysis time for each causal node is corrected to obtain the accurate analysis time, using the following formula:

[0100] ;

[0101] in, This indicates the time taken for the precise analysis; This indicates the analysis time for each causal node; This represents the average environmental delay.

[0102] Optionally, when the scheme determination module determines the optimal reproducible event based on the time probability, it is used to:

[0103] Analyze the causal chain to determine the cause of the failure at each fault-causing node;

[0104] Based on the causal chain, determine the event execution flow corresponding to each fault-causing node;

[0105] Based on the event execution flow and the cause of the fault, determine the causal probability of the fault code being generated by the fault-generating node corresponding to each running event;

[0106] The optimal reproducible event is determined based on the causal probability and the time probability.

[0107] Optionally, when the fault code analysis module determines the recurrence time of each event in the causal chain based on the precise analysis time and the causal chain, it is used to:

[0108] Based on the event execution flow, determine the causal node to which the event corresponds to each fault-causing node belongs;

[0109] Based on the precise analysis time of each causal node and the causal node to which it belongs, the recurrence time of each event in the causal chain is determined. Attached Figure Description

[0110] To more clearly illustrate the technical solutions in the embodiments of this application or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0111] Figure 1 This is a schematic diagram of an application scenario provided in an embodiment of this application;

[0112] Figure 2 A flowchart illustrating a root cause reasoning method based on event-driven and large model fine-tuning, provided as an embodiment of this application;

[0113] Figure 3 This is a schematic diagram of a root cause reasoning system structure based on event-driven and large model fine-tuning, provided as an embodiment of this application. Detailed Implementation

[0114] To make the objectives, technical solutions, and advantages of the embodiments of this application clearer, the technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some, not all, of the embodiments of this application. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0115] Furthermore, the term "and / or" in this article is merely a description of the relationship between related objects, indicating that three relationships can exist. For example, A and / or B can represent: A existing alone, A and B existing simultaneously, or B existing alone. Additionally, the character " / " in this article, unless otherwise specified, generally indicates that the preceding and following related objects have an "or" relationship.

[0116] The embodiments of this application will now be described in further detail with reference to the accompanying drawings.

[0117] Existing technologies have significant limitations when dealing with complex and dynamically changing systems. In particular, when event propagation chains are long and intermediate states are missing, traditional methods often require a long time for reasoning, thus affecting operational efficiency and system reliability.

[0118] Based on this, this application provides a root cause reasoning method and system based on event-driven and large model fine-tuning. The method involves acquiring real-time operation logs of several runtime events; determining fault codes based on the real-time operation logs; analyzing the real-time operation logs and fault codes to determine causal chains; analyzing the fault codes based on the causal chains to determine whether to perform reverse reasoning; and if so, determining a root cause reasoning scheme based on the fault code analysis results. This ensures that all relevant events and state changes at the time of the fault are captured. Identifying fault codes related to the fault is crucial for root cause reasoning and helps narrow down the analysis scope. By analyzing the causal relationships between events, a complete causal chain is constructed to identify the sequence and cause of the fault. Assessing whether reverse reasoning is necessary helps in deciding whether to start from the fault outcome and trace back to the initial cause of the fault, improving reasoning efficiency. Based on the fault code analysis results, a specific root cause reasoning scheme is determined, including selecting appropriate reasoning algorithms and parameters to ensure the accuracy and effectiveness of the reasoning.

[0119] Figure 1 This application provides an illustration of an application scenario. In an operation and maintenance scenario, the method provided in this application is used to analyze real-time operation logs and fault codes to determine whether root cause reasoning should be performed.

[0120] Specifically, the method provided in this application is applied to any maintenance server, which interacts with other servers under maintenance to obtain real-time operation logs during operation, ensuring that all relevant events and state changes at the time of failure are captured. Fault codes related to the failure are identified; these fault codes are key clues for root cause reasoning and help narrow down the analysis scope. By analyzing the causal relationships between events, a complete causal chain is constructed to identify the sequence and cause of the failure. Assessing whether reverse reasoning is necessary helps in deciding whether to start from the failure result and trace back to the initial cause of the failure, improving reasoning efficiency. Based on the analysis results of the fault codes, a specific root cause reasoning scheme is determined, including selecting appropriate reasoning algorithms and parameters to ensure the accuracy and effectiveness of the reasoning. Specific implementation methods can be found in the following embodiments.

[0121] Figure 2 This is a flowchart illustrating a root cause reasoning method based on event-driven and large model fine-tuning, provided as an embodiment of this application. The method of this embodiment can be applied to servers in the above scenarios. Figure 2 As shown, the method includes:

[0122] S201. Obtain real-time operation logs for several operational events; determine fault codes based on the real-time operation logs;

[0123] Runtime events can be events formed by various operations and state changes that occur during the operation of a software system.

[0124] Real-time runtime logs can be logs formed by recording events and status information in real time during the runtime process.

[0125] A fault code can be a code used to indicate an error or abnormal situation that has occurred. This is usually set up proprietaryly before maintenance, either by maintenance personnel or by existing known fault codes.

[0126] Specifically, deploy a log collection database to capture runtime logs in real time. Ensure the completeness and accuracy of log collection information such as timestamps, event types, and event descriptions. Use log analysis tools to perform preliminary analysis on the collected real-time runtime logs. Identify errors or anomalies in the logs. Based on the analysis results, identify fault codes.

[0127] S202. Analyze real-time operation logs and fault codes to determine the cause-and-effect chain;

[0128] A causal chain can be a relationship in which one event causes another event to occur, or a causal chain in which one node in an event causes another node to change.

[0129] Specifically, a detailed analysis of real-time operation logs is conducted to identify log entries related to fault codes. The direct events or abnormal behaviors leading to the fault are identified. These identified fault events are then correlated with known fault codes. The meaning and scope of impact of the fault codes are analyzed. Based on the timestamps and event sequences in the real-time operation logs, the starting point of the fault in the causal chain is determined. Starting from the initial fault node, the event sequence is traced backward to construct a complete causal chain.

[0130] S203. Analyze the fault codes based on the causal chain to determine whether to perform reverse reasoning;

[0131] Specifically, a detailed analysis of each node in the causal chain is conducted to identify the causal relationships between events. The complexity of the causal chain and the difficulty of root cause reasoning are assessed. The meaning of fault codes is analyzed in depth to determine the type of fault they indicate and their impact. Historical and real-time operational log data are combined to analyze the context in which fault codes occur. Based on the analysis results of the causal chain and fault codes, the necessity of reverse reasoning is evaluated.

[0132] S204. If performed, determine the root cause reasoning scheme based on the fault code analysis results.

[0133] Root cause reasoning can be a set of specific reasoning methods and steps developed during the fault diagnosis process, based on the established causal chain and fault codes, to locate the root cause of the fault.

[0134] Specifically, based on the fault code analysis results, the starting point for reverse reasoning is determined. Using causal chains, a path is constructed to trace backwards from the starting point. Each node on the reverse path is identified, determining its role and impact in the fault occurrence process. The path of fault propagation is identified. Each stage of fault propagation is analyzed to determine the root cause and critical nodes. Within the reverse reasoning path, the root cause leading to the fault is identified.

[0135] This approach ensures the capture of all relevant events and state changes at the time of a failure. It identifies fault codes associated with the failure, providing crucial clues for root cause analysis and narrowing the scope of the analysis. By analyzing the causal relationships between events, a complete causal chain is constructed to identify the sequence and cause of the failure. Assessing the need for reverse reasoning helps determine whether to start from the failure outcome and trace back to the initial cause, improving reasoning efficiency. Based on the fault code analysis results, a specific root cause analysis scheme is determined, including selecting appropriate inference algorithms and parameters to ensure the accuracy and effectiveness of the reasoning.

[0136] In some embodiments, the fault time is determined based on the real-time operation log; the historical log retrieval logic is determined based on the fault time; the historical operation log is retrieved based on the historical log retrieval logic; and the causal chain is determined based on the historical operation log and the fault code.

[0137] The fault time can be the specific point in time when the equipment malfunctions.

[0138] The logic for retrieving historical logs can be the process of retrieving relevant historical log data from the log storage based on the time of the failure.

[0139] Historical operation logs can contain information about all events and status changes recorded over a period of time.

[0140] Specifically, real-time operation logs are collected. The characteristics of fault events are identified by analyzing the operation log data. Once a fault event is identified, its timestamp is recorded as the fault moment. Based on the fault moment, the time range of historical logs to be reviewed is determined. Based on the time range, the historical operation log files to be queried are determined. Log management tools are used to identify historical operation logs according to the defined time range. The identified historical operation logs are analyzed, considering the log format and encoding. The historical operation log data is cleaned and transformed. Fault codes are parsed, and relevant documents or databases are consulted to identify the meaning of the fault codes and the causes of the faults. Real-time and historical operation logs are analyzed to find operation log entries related to the fault moment. Based on the operation log entries before and after the fault moment, the cause and process of the fault are inferred. The analysis results are compiled to construct the causal chain of the fault.

[0141] This solution enables rapid identification of fault signs through real-time collection and analysis of operational logs. Extracting fault codes from real-time operational logs helps in accurately identifying fault types. Determining the specific time of the fault ensures access to relevant historical operational log data. A logic for retrieving historical logs is constructed based on the fault's occurrence time, ensuring effective retrieval of relevant historical operational log data. Retrieving historical operational logs according to this logic helps identify the causes and consequences of the fault. By analyzing real-time and historical operational logs, a causal chain of events is constructed, revealing the causal relationships between events and providing a logical framework for locating the root cause of the fault. The accuracy and completeness of the causal chain are verified to ensure it accurately reflects the fault occurrence process, and the chain is optimized to improve diagnostic reliability. The final causal chain is confirmed, thereby improving the efficiency and accuracy of fault diagnosis.

[0142] In some embodiments, the reverse reasoning time for reverse root cause reasoning based on the fault code is determined according to the causal chain; the recurrence time for event reproduction is determined by analyzing the causal chain; the necessity of reverse reasoning is assessed based on the reverse reasoning time and the recurrence time; and whether to perform reverse reasoning is determined based on the necessity of reverse reasoning.

[0143] Reverse reasoning time can be the time required to trace back to the root cause of a failure by analyzing the causal relationships between events, starting from the point of failure.

[0144] Event reproduction can be the re-execution of the event sequence at the time of the failure in a simulated environment to observe the development and outcome of the events, thereby helping to pinpoint the root cause of the failure.

[0145] Reproduction time can be the time required to perform steps such as preparing the test environment, executing the event sequence, recording and analyzing the results.

[0146] The necessity of reverse reasoning can be determined by assessing whether reverse reasoning is necessary based on the actual situation of fault diagnosis.

[0147] Specifically, analyze the number and complexity of nodes in the causal chain to estimate the time required for reverse reasoning. Consider the analysis and verification time for each node, as well as the dependencies between nodes. Determine the time required for reverse reasoning. Analyze the event sequence and dependencies in the causal chain to determine the steps and operations required to reproduce the event. Estimate the reproduction time required to reproduce the event. Determine the total estimated time for event reproduction. Compare the reverse reasoning time and the event reproduction time to evaluate which method is more efficient. If the reverse reasoning time is more efficient, then reverse reasoning is considered necessary; if the event reproduction time is more efficient, then the reasoning is considered unnecessary. Based on the evaluation of the necessity of reverse reasoning, decide whether to perform reverse reasoning.

[0148] This solution estimates the time cost required for fault diagnosis by measuring the reverse reasoning time. In-depth analysis of the causal relationships between events provides a logical framework for determining the root cause of the fault. Estimating the event reproduction time assesses the feasibility and efficiency of event reproduction. Comparing the reverse reasoning time and event reproduction time evaluates which method is more suitable for the current fault diagnosis needs, leading to a decision based on efficiency and effectiveness. The assessment of the necessity of reverse reasoning determines whether to perform it, helping to optimize the fault diagnosis process and ensure that the most appropriate method is used to locate the root cause of the fault.

[0149] In some embodiments, the causal chain is analyzed to determine its length; based on the causal chain length, the number of causal nodes and the reasoning complexity are determined; based on historical operation logs, the analysis time for each causal node is determined; based on the number of causal nodes and the analysis time for each causal node, the reverse reasoning time for reverse root cause reasoning from the fault codes is determined using the following formula:

[0150] ;

[0151] in, Indicates the time required for reverse reasoning; This indicates the analysis time for each causal node; Indicates the number of causal nodes; Indicates the complexity of reasoning.

[0152] The causal chain length can be the number of events involved in tracing back from the fault point to the root cause of the fault during the fault diagnosis process.

[0153] The number of causal nodes can be the number of independent events or decision points identified in a causal chain.

[0154] Reasoning complexity can be defined by the tightness of the connections between events in a causal chain and the difficulty of the reasoning process.

[0155] A causal node can be a single event or decision point in a causal chain, and is the basic unit that constitutes a causal chain.

[0156] Analysis time can be the time required to perform a detailed analysis of each node in the causal chain.

[0157] Specifically, analyze the nodes in the causal chain. Calculate the number of nodes in the causal chain. Count the number of events in the causal chain to determine its length. Identify all independent causal nodes in the causal chain, each node representing an event. Calculate the number of causal nodes in the causal chain, i.e., the number of events. Analyze the degree of correlation between events in the causal chain and the complexity and interdependence of causal relationships to assess the reasoning complexity. Review historical execution logs to analyze the time consumption of log analysis, event correlation, and root cause analysis steps for each causal node. Determine the analysis time for each causal node. Use the formula... Calculate the reverse inference time and adjust the parameters according to the actual situation. , or This allows us to determine the time required for reverse reasoning.

[0158] This approach, by determining the length of the causal chain, allows for a direct analysis of the number of events involved in the failure process, providing a preliminary understanding of the failure's complexity and causes. Determining the number of causal nodes helps quantify the workload during reasoning, while reasoning complexity helps identify the strength of the correlation between each node. Determining the analysis time for each causal node provides a time estimate for detailed analysis of each node, facilitating resource allocation and ensuring the efficiency of the diagnostic process. Formula used: Calculating the time required for reverse reasoning can provide a quantitative metric, which helps to assess the time cost of reverse reasoning.

[0159] In some embodiments, historical operation logs are analyzed to determine historical operation delays; based on the historical operation delays, the analysis time of each causal node is corrected to obtain accurate analysis time; based on the accurate analysis time and the causal chain, the recurrence time of each event in the causal chain is determined.

[0160] Historical operation delays can be the delays in event processing time caused by various reasons such as network latency and resource contention during the historical operation process.

[0161] Accurate analysis time can be obtained by correcting the analysis time of each causal node after taking into account historical running delays and other relevant factors.

[0162] Specifically, historical operation logs are collected and analyzed. Preprocessing of the logs includes standardizing the time format and removing irrelevant information. Log analysis tools are used to detect delays that occurred during historical operations. Based on historical data, the basic analysis time for each causal node is determined. The delay impact on each causal node is analyzed, and delay types such as fixed delay and proportional delay are identified. Based on the delay impact analysis results, the analysis time for each causal node is recalculated and corrected. Events are sorted according to the order of the causal chain. Starting from the first event, the corrected and precise analysis time is progressively accumulated to obtain the cumulative time for each event. Based on the accumulated time, the recurrence time for each event is calculated.

[0163] This solution identifies time delays encountered in actual operation, helping to more accurately simulate the environment in which a fault occurs. By correcting the analysis time, the time consumption of each causal node is made closer to the actual time consumption in operation, improving the accuracy of fault diagnosis. Precise analysis time consumption can more accurately predict the time required for event reproduction. Determining the reproduction time of each event helps the operations team identify the process of fault occurrence, providing a timeline for fault reproduction and root cause analysis.

[0164] In some embodiments, based on the fault code analysis results, the corresponding fault occurrence time of the fault code is determined; based on the fault occurrence time, the fault occurrence node is determined; a time tree of several running events is obtained; for each running event, based on the time tree and the fault occurrence time, the time probability of the fault occurrence node corresponding to each running event generating a fault code is determined; based on the time probability, the best reproducible event is determined; the historical running log of the best reproducible event is retrieved to determine the root cause reasoning scheme.

[0165] Fault code analysis results can be information about the cause, location, and nature of a fault obtained through the interpretation and analysis of fault codes during the fault diagnosis process.

[0166] The time of failure can be the specific moment when the failure occurs.

[0167] The fault-causing node can be a specific location or component that causes the fault to occur.

[0168] A time tree is a data structure that uses a tree-like structure to help identify and analyze causal relationships between events.

[0169] Time probability can be the likelihood of a certain event occurring within a time window.

[0170] The best reproducible event is the one that is most likely to reproduce the failure among a series of possible events.

[0171] Specifically, fault codes are analyzed and compared with historical and real-time logs to determine the exact time the fault code occurred. Based on the fault occurrence time, the causal chain is traced back to identify the corresponding fault-causing node. A time tree displaying the chronological order and interrelationships of operational events is constructed. For each operational event, the probability of its corresponding fault-causing node generating a fault code is calculated based on the time tree and the fault occurrence time. Considering the causal relationships and chronological order between events, the probabilities are adjusted to reflect the actual situation. Based on the calculated time probabilities, the event most likely to reproduce the fault is selected as the optimal reproducible event. Considering the complexity and reproducibility of the event, the optimal reproducible event is selected. The historical operational logs of the optimal reproducible event, along with the fault diagnosis steps, cause analysis, and remedial measures, are obtained for detailed analysis and root cause reasoning.

[0172] This solution clarifies the specific time point of the failure. Identifying the specific events or decision points that led to the failure helps narrow down the scope of fault diagnosis and concentrate resources on in-depth analysis. By calculating time probabilities, the correlation between each event and the node where the failure occurred can be assessed. Selecting the events most likely to reproduce the failure can improve the success rate of failure reproduction, thereby more accurately pinpointing the cause of the failure. Obtaining detailed historical operation logs helps in-depth analysis of the background and environment in which the events occurred. Constructing a root cause reasoning scheme provides clear steps and strategies for fault diagnosis, helping to improve the efficiency and accuracy of diagnosis.

[0173] In some embodiments, the average environmental latency in the historical runtime logs is determined based on historical runtime latency using the following formula:

[0174] ;

[0175] in, This represents the mean environmental delay. This indicates the number of historical events in the historical operation log; Indicates the first The environmental delay time of each historical event; based on the average environmental delay, the analysis time of each causal node is corrected to obtain the accurate analysis time, using the following formula:

[0176] ;

[0177] in, Indicates the time required for precise analysis; This indicates the analysis time for each causal node; This represents the average environmental delay.

[0178] The average environmental latency can be the average of the environmental latency times of multiple historical events recorded in the historical operation log.

[0179] The number of historical events can be the total number of events recorded in the historical operation log.

[0180] Historical events can be recorded and tracked events that occurred within a certain period of time in the past.

[0181] Specifically, relevant historical operation logs are extracted from the operation log data. The logs are then formatted, cleaned, and filtered to extract environmental latency times related to the fault. Calculate the environmental delay time for all historical events. The average value is used to obtain the mean environmental delay. Based on historical and real-time operation logs, each node in the causal chain is identified. For each causal node, its initial analysis time is determined based on historical data and real-time logs. Use the formula: The analysis time for each causal node is corrected to obtain the accurate analysis time. .

[0182] This solution provides foundational data for analyzing environmental latency, helping to identify past performance patterns. By calculating the average environmental latency, the time cost in historical operations can be quantified, providing a basis for refining analysis time consumption. The initial analysis time consumption for each causal node is determined. By refining the analysis time consumption, the time consumption of each causal node is made closer to the actual time consumption in operation, improving the accuracy of the analysis.

[0183] In some embodiments, the causal chain is analyzed to determine the cause of the fault at each fault-generating node; the event execution flow corresponding to each fault-generating node is determined based on the causal chain; the causal probability of the fault code generated by the fault-generating node corresponding to each running event is determined based on the event execution flow and the cause of the fault; and the optimal reproducible event is determined based on the causal probability and the temporal probability.

[0184] The causes of a fault can be fundamental factors such as hardware failure, software error, configuration problem, operational error, and environmental factors.

[0185] An event execution flow can be a series of steps and processes that an event goes through from triggering to completion, including data reception, processing, transmission, and storage.

[0186] Causal probability can be the likelihood that, in a series of events, one event as a cause leads to another event as a result.

[0187] Specifically, a careful analysis of the causal chain is conducted to identify each fault-causing node. For each fault-causing node, its direct causes (configuration errors, insufficient resources, etc.) and indirect causes (user operations, external interruptions, etc.) are analyzed. Based on the event sequence in the causal chain, an event execution flowchart corresponding to each fault-causing node is constructed. Each step in the flowchart is analyzed to determine which steps lead to the fault. Combining the fault causes and the event execution flow, the probability of each fault-causing node generating a fault code during the execution event is evaluated. Statistical methods such as conditional probability and Bayes' theorem are used to calculate the causal probability. The causal probability and temporal probability of each execution event are compared to determine which event combination has the highest probability. The event with both high causal and temporal probabilities is selected as the best reproducible event.

[0188] This solution helps identify the sequence of critical events leading to failures. By analyzing the causal chain, the root cause of the failure is determined. The order and conditions of event occurrence are clarified, providing operational guidelines for failure reproduction. The probability of each event causing the failure is assessed, providing a probabilistic basis for selecting events to reproduce. The probability of each event occurring within a time window is determined, providing a temporal basis for failure reproduction. Combining causal probability and temporal probability allows for a more accurate assessment of the reproducibility value of events, improving the targeting of reproduction. Through comprehensive evaluation, the event most likely to cause the failure is selected for reproduction, increasing the success rate of failure reproduction.

[0189] In some embodiments, the causal node to which each fault-causing node belongs is determined according to the event execution flow; and the reproduction time of each event in the causal chain is determined according to the precise analysis time of each causal node and the causal node to which it belongs.

[0190] The causal node can be a node in the constructed causal chain that is related to the causal relationship of the event.

[0191] Specifically, the process involves reviewing the causal chain to identify each fault-causing node. Analyzing the event execution flow to determine the event corresponding to each fault-causing node. Based on the causal chain, the position of each event within it is determined. The event corresponding to each fault-causing node is identified, and the causal nodes to which these events belong in the causal chain are identified. Based on the previously calculated average environmental latency and historical execution logs, the precise analysis time for each causal node is determined. Considering the dependencies and execution order of each causal node, the precise analysis time is adjusted to reflect the actual situation. Based on the precise analysis time of each causal node and the order of its causal nodes, the reproducibility time of each event is calculated.

[0192] This solution provides a framework for fault diagnosis, facilitating the identification of causal relationships between fault events. Clearly defining the key points of fault diagnosis helps focus the analysis. Establishing causal relationships for each event helps identify dependencies between events. Providing accurate time estimates for each causal node helps plan the reproduction process. Ensuring events are reproduced in the correct logical order avoids errors during reproduction. Providing reproduction time points for each event aids in time management.

[0193] Figure 3 A schematic diagram of the structure of a root cause reasoning system based on event-driven and large model fine-tuning, as provided in an embodiment of this application, is shown below. Figure 3 As shown, the root cause reasoning system 300 based on event-driven and large model fine-tuning in this embodiment includes: a fault code determination module 301, a causal analysis module 302, a fault code analysis module 303, and a solution determination module 304.

[0194] The fault code determination module 301 is used to acquire real-time operation logs and determine fault codes based on the real-time operation logs.

[0195] Causal analysis module 302 is used to analyze the real-time operation log and the fault code to determine the causal chain;

[0196] The fault code analysis module 303 is used to analyze the fault code according to the causal chain and determine whether to perform reverse reasoning.

[0197] The solution determination module 304 is used to determine the root cause reasoning solution based on the fault code analysis results if the problem is to be solved.

[0198] Optionally, when the causal analysis module 302 analyzes the real-time operation log and the fault code to determine the causal chain, it is used for:

[0199] The time of failure is determined based on the real-time operation log;

[0200] Based on the time of the failure, determine the logic for retrieving historical logs;

[0201] Retrieve historical operation logs according to the aforementioned historical log retrieval logic;

[0202] The causal chain is determined based on the historical operation logs and the fault codes.

[0203] Optionally, when the fault code analysis module 303 analyzes the fault code based on the causal chain and determines whether to perform reverse reasoning, it is used to:

[0204] Based on the causal chain, determine the reverse reasoning time for reverse root cause reasoning based on the fault code;

[0205] Analyze the causal chain to determine the time required for the event to be reproduced;

[0206] The necessity of reverse reasoning is assessed based on the reverse reasoning time and the recurrence time.

[0207] Based on the necessity of reverse reasoning, determine whether to perform reverse reasoning.

[0208] Optionally, when the fault code analysis module 303 determines the reverse reasoning time for reverse root cause reasoning based on the fault code according to the causal chain, it is used for:

[0209] Analyze the causal chain to determine its length;

[0210] Based on the length of the causal chain, determine the number of causal nodes and the reasoning complexity;

[0211] Based on the historical operation logs, determine the analysis time for each causal node;

[0212] Based on the number of causal nodes and the analysis time of each causal node, the reverse reasoning time for reverse root cause reasoning from the fault codes is determined using the following formula:

[0213] ;

[0214] in, This indicates the time required for the reverse reasoning; This indicates the analysis time for each causal node; Indicates the number of causal nodes; This represents the reasoning complexity.

[0215] Optionally, when the fault code analysis module 303 analyzes the causal chain and determines the reproduction time taken to reproduce the event, it is used for:

[0216] Analyze the historical operation logs to determine the historical operation delays;

[0217] Based on the historical runtime delay, the analysis time of each causal node is corrected to obtain the accurate analysis time.

[0218] Based on the precise analysis time and the causal chain, the recurrence time of each event in the causal chain is determined.

[0219] Optionally, when the scheme determination module 304 determines the root cause reasoning scheme based on the fault code analysis results, it is used to:

[0220] Based on the fault code analysis results, determine the fault occurrence time corresponding to the fault code;

[0221] Based on the time of the fault occurrence, the fault occurrence node is determined;

[0222] Obtain the time tree of the aforementioned running events;

[0223] For each running event, based on the time tree and the fault occurrence time, determine the time probability of the fault code being generated by the fault occurrence node corresponding to each running event.

[0224] Based on the aforementioned time probability, determine the optimal reproducible event;

[0225] Retrieve the historical operation logs of the best reproducible event to determine the root cause reasoning scheme.

[0226] Optionally, when the fault code analysis module 303 corrects the analysis time of each causal node based on the historical running delay to obtain the accurate analysis time, it is used for:

[0227] Based on the historical operation latency, the average environmental latency in the historical operation log is determined using the following formula:

[0228] ;

[0229] in, This represents the average environmental delay. This indicates the number of historical events in the historical operation log; Indicates the first The environmental latency of each historical event; based on the average environmental latency, the analysis time of each causal node is corrected to obtain the accurate analysis time, using the following formula:

[0230] ;

[0231] in, This indicates the time taken for the precise analysis; This indicates the analysis time for each causal node; This represents the average environmental delay.

[0232] Optionally, when the scheme determination module 304 determines the optimal reproducible event based on the time probability, it is used to:

[0233] Analyze the causal chain to determine the cause of the failure at each fault-causing node;

[0234] Based on the causal chain, determine the event execution flow corresponding to each fault-causing node;

[0235] Based on the event execution flow and the cause of the fault, determine the causal probability of the fault code being generated by the fault-generating node corresponding to each running event;

[0236] The optimal reproducible event is determined based on the causal probability and the time probability.

[0237] Optionally, when the fault code analysis module 303 determines the recurrence time of each event in the causal chain based on the precise analysis time and the causal chain, it is used to:

[0238] Based on the event execution flow, determine the causal node to which the event corresponds to each fault-causing node belongs;

[0239] Based on the precise analysis time of each causal node and its associated causal node, the recurrence time of each event in the causal chain is determined. The system of this embodiment can be used to execute the methods of any of the above embodiments, and its implementation principle and technical effects are similar, so they will not be repeated here.

Claims

1. A root cause reasoning method based on event-driven and large model fine-tuning, characterized in that, include: Obtain real-time operation logs for several operational events; determine fault codes based on the real-time operation logs; Analyze the real-time operation logs and the fault codes to determine the causal chain; Based on the causal chain, analyze the fault code to determine whether to perform reverse reasoning; If performed, a root cause reasoning scheme will be determined based on the fault code analysis results; The step of determining the root cause reasoning scheme based on the fault code analysis results includes: Based on the fault code analysis results, determine the fault occurrence time corresponding to the fault code; Based on the time of the fault occurrence, the fault occurrence node is determined; Obtain the time tree of the aforementioned running events; For each running event, based on the time tree and the fault occurrence time, determine the time probability of the fault code being generated by the fault occurrence node corresponding to each running event. Based on the aforementioned time probability, determine the optimal reproducible event; Retrieve the historical operation log of the best reproducible event to determine the root cause reasoning scheme; The step of determining the optimal reproducible event based on the time probability includes: Analyze the causal chain to determine the cause of the failure at each fault-causing node; Based on the causal chain, determine the event execution flow corresponding to each fault-causing node; Based on the event execution flow and the cause of the fault, determine the causal probability of the fault code being generated by the fault-generating node corresponding to each running event; The optimal reproducible event is determined based on the causal probability and the temporal probability. The step of analyzing the fault code based on the causal chain to determine whether to perform reverse reasoning includes: Based on the causal chain, determine the reverse reasoning time for reverse root cause reasoning based on the fault code; Analyze the causal chain to determine the time required for the event to be reproduced; The necessity of reverse reasoning is assessed based on the reverse reasoning time and the recurrence time. Based on the necessity of reverse reasoning, determine whether to perform reverse reasoning; The analysis of the causal chain to determine the recurrence time required for event reproduction includes: Analyze the historical operation logs to determine the historical operation delays; Based on the historical runtime delay, the analysis time of each causal node is corrected to obtain the accurate analysis time. Based on the precise analysis time and the causal chain, the recurrence time of each event in the causal chain is determined; The step of determining the recurrence time of each event in the causal chain based on the precise analysis time and the causal chain includes: Based on the event execution flow, determine the causal node to which the event corresponds to each fault-causing node belongs; Based on the precise analysis time of each causal node and the causal node to which it belongs, the recurrence time of each event in the causal chain is determined.

2. The method according to claim 1, characterized in that, The analysis of the real-time operation logs and the fault codes to determine the causal chain includes: The time of failure is determined based on the real-time operation log; Based on the time of the failure, determine the logic for retrieving historical logs; Retrieve historical operation logs according to the aforementioned historical log retrieval logic; The causal chain is determined based on the historical operation logs and the fault codes.

3. The method according to claim 2, characterized in that, The step of determining the reverse reasoning time for reverse root cause reasoning based on the fault code according to the causal chain includes: Analyze the causal chain to determine its length; Based on the length of the causal chain, determine the number of causal nodes and the reasoning complexity; Based on the historical operation logs, determine the analysis time for each causal node; Based on the number of causal nodes and the analysis time of each causal node, the reverse reasoning time for reverse root cause reasoning from the fault codes is determined using the following formula: ; in, This indicates the time required for the reverse reasoning; This indicates the analysis time for each causal node; Indicates the number of causal nodes; This represents the reasoning complexity.

4. The method according to claim 3, characterized in that, The step of correcting the analysis time of each causal node based on the historical runtime delay to obtain the accurate analysis time includes: Based on the historical operation latency, the average environmental latency in the historical operation log is determined using the following formula: ； in, This represents the average environmental delay. This indicates the number of historical events in the historical operation log; Indicates the first Environmental delay time for each historical event; Based on the average environmental delay, the analysis time for each causal node is corrected to obtain the accurate analysis time, using the following formula: ; in, This indicates the time taken for the precise analysis; This indicates the analysis time for each causal node; This represents the average environmental delay.

5. A root cause reasoning system based on event-driven and large model fine-tuning, characterized in that, Applied to the method as described in any one of claims 1-4, comprising: The fault code determination module is used to acquire real-time operation logs and determine fault codes based on the real-time operation logs. The causal analysis module is used to analyze the real-time operation logs and the fault codes to determine the causal chain; The fault code analysis module is used to analyze the fault code according to the causal chain and determine whether to perform reverse reasoning. The solution determination module is used to determine the root cause reasoning solution based on the fault code analysis results if the problem is to occur.

Images