Artificial intelligence fault root cause analysis method and system fusing multi-modal data and knowledge base

Abstract

This invention provides an AI-based fault root cause analysis method and system that integrates multimodal data and a knowledge base, relating to the field of AI-powered operations and maintenance. The method includes: receiving alarm events and extracting alarm objects and their characteristic information; constructing a dynamic topology graph centered on the alarm objects based on service dependencies; aggregating multimodal observable data from each node in the dynamic topology graph and aligning the time series of the multimodal observable data; constructing a context that integrates a knowledge base, multimodal observable data, and historical processing records; inputting the context into a large language model for root cause reasoning and outputting structured analysis results. This achieves rapid response to fault alarms, automatic root cause analysis and processing suggestions, cross-cluster and multi-service data source correlation analysis, and automatic writing of results into a work order system, forming a closed loop.

Description

Technical Field

[0001] This invention belongs to the field of artificial intelligence operation and maintenance technology, and in particular relates to an AI fault root cause analysis method and system that integrates multimodal observable data and knowledge base. Background Technology

[0002] With the rapid development of information technology, enterprise IT systems are becoming increasingly complex, encompassing new technologies such as distributed architecture, large-scale microservices, cloud computing, and edge computing. Traditional operation and maintenance monitoring and alarm systems rely on rules and static models, and their limitations are mainly reflected in the following aspects:

[0003] 1. Data silos: Metrics, logs, and link data are stored and queried separately, making it impossible to analyze them in conjunction with each other;

[0004] 2. High dependence on manual labor: Fault analysis is highly dependent on human experience, resulting in low efficiency and instability;

[0005] 3. Fixed rules: Some platforms use static rule configurations, which cannot adapt to dynamic and complex cloud-native architectures;

[0006] 4. High algorithm threshold: Manual analysis of problems faces the challenge of inadequate analysis and difficulty in introducing commonly used analysis algorithms;

[0007] 5. High response latency: When faced with high-frequency alarms and complex topologies, the positioning time is difficult to meet the SLA (Service Level Agreement) requirements. Summary of the Invention

[0008] Therefore, the technical problem to be solved by the present invention is to provide an AI fault root cause analysis method and system that integrates multimodal observable data and knowledge base, which overcomes the difficulty of meeting the real-time response requirements of the existing manual fault diagnosis method.

[0009] In a first aspect, the present invention provides an AI fault root cause analysis method that integrates multimodal data and a knowledge base, comprising:

[0010] Receive alarm events and extract alarm objects and their characteristic information;

[0011] A dynamic topology graph centered on the alarm object is constructed based on service dependencies. Furthermore, the service dependencies include: RPC / HTTP call chains, network dependencies, and configuration dependencies.

[0012] Aggregate the multimodal observable data of each node in the dynamic topology graph and align the time series of the multimodal observable data;

[0013] A context is constructed that integrates a knowledge base, the multimodal observable data, and historical processing records. Furthermore, the context is constructed based on a retrieval-enhanced generation mechanism.

[0014] The context is input into a large language model for root cause reasoning, and the structured analysis results are output.

[0015] Furthermore, the time series of the multimodal observable data is aligned using a dynamic time warping algorithm.

[0016] Furthermore, the multimodal observable data can be queried through workflow orchestration via data drill-down, or queried using an agent through dynamic topology;

[0017] The multimodal observable data includes: monitoring metrics, log content, and link tracing data; the monitoring metrics include: CPU utilization, network latency, and QPS; the log content includes critical errors and exception stacks.

[0018] Furthermore, the method also includes: pushing the structured analysis results to the work order system and updating the knowledge base.

[0019] Furthermore, the characteristic information of the alarm object includes: alarm cluster, alarm namespace, resource type, resource name, resource ID, alarm level, alarm start time, alarm title, alarm content, alarm description, alarm additional information, alarm subscriber, alarm manager, and duty officer.

[0020] Furthermore, the structured analysis results include: alarm root causes with confidence levels, handling recommendations ranked by impact, radical remediation plans, and prevention recommendations.

[0021] Secondly, the present invention provides an AI-based root cause analysis system that integrates multimodal data and a knowledge base, comprising:

[0022] The alarm access module receives alarm events and extracts alarm objects and their characteristic information.

[0023] The graph construction module constructs a dynamic topology graph centered on the alarm object based on service dependencies.

[0024] The aggregation and alignment module aggregates the multimodal observable data of each node in the dynamic topology graph and aligns the time series of the multimodal observable data.

[0025] The context generation module constructs a context that integrates the knowledge base, the multimodal observable data, and historical processing records.

[0026] The root cause analysis module inputs the context into a large language model for root cause reasoning and outputs structured analysis results.

[0027] Beneficial effects:

[0028] 1. Integrate multimodal, manually maintainable observable data and knowledge base;

[0029] 2. Based on the RAG (Retrieval Enhanced Generation) mechanism, the SOP (Standard Operating Procedure), knowledge base and context data are integrated to generate the context required for AI prompt words. The final prompt words are generated by calling the "knowledge base" + "interface" and using the prompt word template through the workflow.

[0030] 3. Utilize AI (Artificial Intelligence) expertise for multidimensional analysis;

[0031] 4. Integrate with the work order system to form an automated closed-loop processing capability and automatic knowledge base maintenance;

[0032] 5. The technical architecture is universal and can be extended to any AI (artificial intelligence) development platform and distributed system monitoring scenario. Attached Figure Description

[0033] To make the content of this invention easier to understand, the invention will be further described in detail below with reference to specific embodiments and accompanying drawings.

[0034] Figure 1 This is a flowchart of the root cause analysis method of the present invention;

[0035] Figure 2 This is a flowchart illustrating the processing of a specific embodiment 1 of the present invention;

[0036] Figure 3 This is the workflow for generating contextual prompts in specific embodiment 1 of the present invention. Detailed Implementation

[0037] The present invention will now be described in detail with reference to the accompanying drawings and embodiments. The principles and features of the present invention are described below with reference to the accompanying drawings. It should be noted that, unless otherwise specified, the embodiments and features described in these embodiments can be combined with each other. The embodiments given are only for explaining the present invention and are not intended to limit the scope of the present invention.

[0038] This invention utilizes AI (Artificial Intelligence) to analyze multimodal observable data and quickly pinpoint the root cause of system failures. In simpler terms, when a company's system (such as a server or service) experiences failures, slowdowns, or anomalies, the system collects various types of data, such as metrics, logs, traces, and event information. These data come from different sources and are in various formats, making manual analysis extremely time-consuming. This invention, however, constructs a relationship graph between the data and uses LLM (Large Language Modeling) to automatically understand and analyze this data, quickly identifying the "root cause of the problem" and providing remedial suggestions.

[0039] In a Kubernetes cluster with hundreds of microservices, if a service suddenly becomes slow to respond, the traditional approach requires developers or operations personnel to check alarms, logs, and trace the fault path and dependencies. The method of this invention can automate this process, improving the efficiency of troubleshooting.

[0040] With business growth, the number of system components has increased significantly, and the dependencies between services have become increasingly complex. Traditional manual troubleshooting methods are no longer sufficient to meet the demands for real-time response. Therefore, there is an urgent need to build an AI (Artificial Intelligence) system with automatic root cause analysis capabilities, requiring the following:

[0041] 1. Quick response to fault alarms;

[0042] 2. Automatically analyze root causes and provide suggested solutions;

[0043] 3. Perform correlation analysis across data sources from multiple clusters and services;

[0044] 4. The results can be automatically written into the work order system to form a closed loop.

[0045] Therefore, this invention provides an AI fault root cause analysis method that integrates multimodal observable data and a knowledge base, such as... Figure 1 As shown, it includes:

[0046] Receive alarm events and extract alarm objects and their characteristic information;

[0047] A dynamic topology graph centered on the alarm object is constructed based on service dependencies;

[0048] Aggregate the multimodal observable data of each node in the dynamic topology graph and align the time series of the multimodal observable data;

[0049] Construct a context that integrates a knowledge base, multimodal observable data, and historical processing records;

[0050] The context is input into a large language model for root cause reasoning, and the structured analysis results are output. Example 1

[0051] like Figure 2 As shown, this embodiment discloses an AI fault root cause analysis method that integrates multimodal observable data and a knowledge base, specifically including:

[0052] 1. Alarm Reception and Alarm Object Identification

[0053] Receive alarm events from alarm systems such as Prometheus and Alertmanager;

[0054] Extract the "alarm object" (such as cluster name, namespace, resource type, resource name, etc.) and its characteristic information from the alarm.

[0055] The extraction steps include:

[0056] All alarm records are saved to the database. The root cause analysis process is triggered using the unique alarm ID. The process queries the database to obtain detailed information about the alarm, including: alarm cluster, alarm namespace, resource type, resource name, resource ID, alarm level, alarm start time, alarm title, alarm content, alarm description, additional alarm information, alarm subscriber, alarm manager, and duty officer.

[0057] The following is an example of the definition format for an alarm object:

[0058] Alarm cluster number: foneshare-k8s1;

[0059] Alarm cluster name: Fenxiang Cloud;

[0060] Alarm namespace: foneshare-vip;

[0061] Alarm name: pod-restart;

[0062] Alarm title: Pod restarted;

[0063] Alarm levels: Notification (including three alarm levels: Notification / Warning / Fault);

[0064] Alarm resource type: app (including: app / node / mq and other resource types);

[0065] Alarm resource name: fs-crm-fmcg-service (e.g., application name);

[0066] Alarm resource ID: fs-crm-fmcg-service-59fd9d88d4-8pnxq (e.g., a copy of the application);

[0067] Alarm message: Pod (fs-crm-fmcg-service-59fd9d88d4-8pnxq) experienced an OOM Killed restart;

[0068] Alarm start time: xx-xx-xx xx:xx:xx.

[0069] 2. Topology sensing and dynamic graph construction

[0070] A real-time topology is built based on information such as RPC / HTTP calls, network dependencies, and configuration dependencies between services;

[0071] Include the upstream and downstream dependent services of the alarm object in the analysis scope;

[0072] A dynamic map centered on "alarm points" is constructed.

[0073] Based on the type and resources of the "alarm point," construct the dynamic map of observable data required for that "alarm point," see [link / reference]. Figure 3 .

[0074] 3. Multimodal data acquisition and alignment

[0075] Aggregate the values ​​of each node in this graph:

[0076] Monitoring metrics (such as CPU, latency, and queries per second (QPS));

[0077] Log contents (critical errors, exception stack traces);

[0078] Link tracing (such as Trace ID);

[0079] Time alignment of data from different sources is performed using an improved DTW (Dynamic Time Warping) algorithm:

[0080] The sampling interval was uniformly set to 30 seconds (Prometheus data).

[0081] The log of critical events is generated by the client;

[0082] Alignment window: ±90 seconds dynamic window;

[0083] 4. RAG prompt word construction

[0084] Construct the following context structure and populate it with historical data, knowledge base, alarm information, etc.:

[0085] <context>

[0086] <observable_data>...< / observable_data>

[0087] <alert_sop>...< / alert_sop>

[0088] <alert_info>...< / alert_info>

[0089] <history_result>...< / history_result>

[0090] <basic_knowledge>...< / basic_knowledge>

[0091] < / context>

[0092] The system prompt word structure is as follows:

[0093] Character Description

[0094] Demand and Objectives

[0095] Operating environment description

[0096] User Permissions Description

[0097] Output requirements

[0098] Output template

[0099] <template>

[0100] Monitoring data

[0101] Root cause analysis

[0102] Recommendations for handling

[0103] < / template>

[0104] 5. LLM Inference Analysis

[0105] Input the constructed context into a large language model (such as GPT or a private large model).

[0106] The returned structured analysis results include:

[0107] Alarm root cause (including confidence level);

[0108] Recommended actions (ranked by impact);

[0109] Radical repair solution;

[0110] Prevention recommendations;

[0111] 6. Work order integration and closed-loop tracking

[0112] Push the analysis results to the work order system;

[0113] Supports feedback on whether the analysis results should be added to the knowledge base;

[0114] The valuable analysis results from the feedback will be used to supplement the knowledge base in the future.

[0115] This invention integrates SOP (Standard Operating Procedure), knowledge base, and contextual data based on the RAG (Retrieval Enhanced Generation) mechanism to generate the context required for AI prompt words; and generates the final prompt words by calling the "knowledge base" + "interface" and using the prompt word template through a workflow.

[0116] The example context data in this embodiment is as follows:

[0117] <datas>

[0118] <datas_title> Observable data< / datas_title>

[0119] <data>

[0120] <data_title> Logs before Pod restart< / data_title>

[0121] <data_description> Logs before a Pod restart can be used to analyze the reasons for the Pod restart.< / data_description>

[0122] <data_content> {{ pod_restart_log_text}}< / data_content>

[0123] <data_grafana_link> https: / / k8s-app.foneshare.cn / # / pod / index?app={{resource_name}}&cluster={{ alert_env}}&namespace={{ namespace}}< / data_grafana_link>

[0124] < / data>

[0125] <data>

[0126] <data_title> k8s incident< / data_title>

[0127] <data_description> Kubernetes events can be used to analyze the status of Kubernetes resources.< / data_description>

[0128] <data_content> {{ pod_k8s_event_text}}< / data_content>

[0129] <data_grafana_link> https: / / grafana.foneshare.cn / d / df19b84a-d41f-401c-abfc-9d55fc56ba26 / 7e38081-kubernetes-events?var-datasource={{ clickhouse_uid}}&var-namespace={{ namespace}}&var-name={{ resource_id}}&from={{ from_time}}&to={{ to_time}}< / data_grafana_link>

[0130] < / data>

[0131] <data>

[0132] <data_title> Application error log details< / data_title>

[0133] <data_description> Application error log details can be used to analyze the cause of application errors, including error stack traces, error messages, and error types.< / data_description>

[0134] <data_content> {{ log_error_text}}< / data_content>

[0135] <data_grafana_link> https: / / grafana.foneshare.cn / d / ch-log-error / clickhouse-log-error?var-datasource={{ clickhouse_uid}}&var-app={{ resource_name}}&var-profile={{ namespace}}&from={{ from_time}}&to={{ to_time}}< / data_grafana_link>

[0136] < / data>

[0137] <data>

[0138] <data_title> Pod CPU utilization (percentage)< / data_title>

[0139] <data_description> Pod CPU utilization can be used to analyze the CPU usage of a Pod.< / data_description>

[0140] <data_content> {{ pod_cpu_text}}< / data_content>

[0141] <data_grafana_link> https: / / grafana.foneshare.cn / d / pod-jvm-monitor / pod-jvm-monitor?var-datasource={{ prometheus_uid}}&var-namespace={{namespace}}&var-app={{ resource_name}}&var-pod={{ resource_id}}&from={{from_time}}&to={{ to_time}}< / data_grafana_link>

[0142] < / data>

[0143] <data>

[0144] <data_title> Pod memory usage (percentage)< / data_title>

[0145] <data_description> Pod memory usage can be used to analyze how a Pod uses memory.< / data_description>

[0146] <data_content> {{ pod_memory_text}}< / data_content>

[0147] <data_grafana_link> https: / / grafana.foneshare.cn / d / pod-jvm-monitor / pod-jvm-monitor?var-datasource={{ prometheus_uid}}&var-namespace={{namespace}}&var-app={{ resource_name}}&var-pod={{ resource_id}}&from={{from_time}}&to={{ to_time}}< / data_grafana_link>

[0148] < / data>

[0149] <data>

[0150] <data_title> Pod's JVM memory usage (percentage)< / data_title>

[0151] <data_description> The JVM memory usage of a Pod can be used to analyze the JVM memory usage of a Pod.< / data_description>

[0152] <data_content> {{ pod_jvm_text}}< / data_content>

[0153] <data_grafana_link> https: / / grafana.foneshare.cn / d / pod-jvm-monitor / pod-jvm-monitor?var-datasource={{ prometheus_uid}}&var-namespace={{namespace}}&var-app={{ resource_name}}&var-pod={{ resource_id}}&from={{from_time}}&to={{ to_time}}< / data_grafana_link>

[0154] < / data>

[0155] <data>

[0156] <data_title> Top 1 in various metrics of application error logs< / data_title>

[0157] <data_description> The top-ranked metrics across various dimensions of the application error log, including Exception type, ea, dbName, and uid, allow for further analysis of the underlying causes.< / data_description>

[0158] <data_content> {{ log_error_type_text}}< / data_content>

[0159] <data_grafana_link> https: / / grafana.foneshare.cn / d / ch-log-error / clickhouse-log-error?var-datasource={{ clickhouse_uid}}&var-app={{ resource_name}}&var-profile={{ namespace}}&from={{ from_time}}&to={{ to_time}}< / data_grafana_link>

[0160] < / data>

[0161] <data>

[0162] <data_title> RPC call error details< / data_title>

[0163] <data_description> RPC call error details can be used to analyze the cause of RPC call errors.< / data_description>

[0164] <data_content> {{ log_rpc_text}}< / data_content>

[0165] <data_grafana_link> https: / / grafana.foneshare.cn / d / ch-rpc / clickhouse-rpc?var-datasource={{ clickhouse_uid}}&var-app={{ resource_name}}&var-profile={{ namespace}}&from={{ from_time}}&to={{ to_time}}< / data_grafana_link>

[0166] < / data>

[0167] <data>

[0168] <data_title> Slow query log details< / data_title>

[0169] <data_description> Slow query log details include the type of the top slow query, the database name of the top slow query, the tenant (ea) of the top slow query, the URL of the top slow query, and the UID of the top slow query. This can be used to analyze the causes of slow queries.< / data_description>

[0170] <data_content> {{ slow_sql_type_text}}< / data_content>

[0171] <data_grafana_link> https: / / grafana.foneshare.cn / d / ch-slow-log / clickhouse-slow-log?var-datasource={{ clickhouse_uid}}&var-app={{ resource_name}}&from={{ from_time}}&to={{ to_time}}< / data_grafana_link>

[0172] < / data>

[0173] <data>

[0174] <data_title> Tomcat response error codes< / data_title>

[0175] <data_description> The number of Tomcat response error codes can be analyzed to determine the number of service response errors.< / data_description>

[0176] <data_content> {{ tomcat_error_code_text}}< / data_content>

[0177] <data_grafana_link> https: / / grafana.foneshare.cn / d / ch-tomcat / clickhouse-tomcat-log?var-datasource={{ clickhouse_uid}}&var-app={{resource_name}}&from={{ from_time}}&to={{ to_time}}< / data_grafana_link>

[0178] < / data>

[0179] <data>

[0180] <data_title> Memory usage of the node where the Pod resides< / data_title>

[0181] <data_description> High memory usage on the node hosting the Pod can also cause the Pod to restart due to OOMKilled.< / data_description>

[0182] <data_content> {{ node_mem_text}}< / data_content>

[0183] <data_grafana_link> https: / / grafana.foneshare.cn / d / 9CWBz0bik2 / nodee88a82-e782b9-e79b91-e68ea7?var-datasource={{ prometheus_uid}}&var-job=$__all&var-host={{ host}}&from={{ from_time}}&to={{ to_time}}< / data_grafana_link>

[0184] < / data>

[0185] <data>

[0186] <data_title> Number of VM OOM occurrences on the node where the Pod resides< / data_title>

[0187] <data_description> A VM OutOfMemoryError (OOM) on the node hosting the Pod will also cause the Pod to restart due to OOM Killing.< / data_description>

[0188] <data_content> {{ node_oom_text}}< / data_content>

[0189] <data_grafana_link> https: / / grafana.foneshare.cn / d / 9CWBz0bik2 / nodee88a82-e782b9-e79b91-e68ea7?var-datasource={{ prometheus_uid}}&var-job=$__all&var-host={{ host}}&from={{ from_time}}&to={{ to_time}}< / data_grafana_link>

[0190] < / data>

[0191] <data>

[0192] <data_title> Load on the node where the Pod resides< / data_title>

[0193] <data_description> High load on the node hosting the Pod can also cause the Pod to restart.< / data_description>

[0194] <data_content> {{ node_load1_text}}< / data_content>

[0195] <data_grafana_link> https: / / grafana.foneshare.cn / d / 9CWBz0bik2 / nodee88a82-e782b9-e79b91-e68ea7?var-datasource={{ prometheus_uid}}&var-job=$__all&var-host={{ host}}&from={{ from_time}}&to={{ to_time}}< / data_grafana_link>

[0196] < / data>

[0197] <data>

[0198] <data_title> Tomcat traffic< / data_title>

[0199] <data_description> Tomcat traffic analysis can help you understand service traffic patterns.< / data_description>

[0200] <data_content> {{ tomcat_pv}}< / data_content>

[0201] <data_grafana_link> https: / / grafana.foneshare.cn / d / ch-tomcat / clickhouse-tomcat-log?var-datasource={{ clickhouse_uid}}&var-app={{resource_name}}&from={{ from_time}}&to={{ to_time}}< / data_grafana_link>

[0202] < / data>

[0203] <data>

[0204] <data_title> Pod network inflow traffic< / data_title>

[0205] <data_description> The network inflow traffic of a Pod can be used to analyze the network inflow traffic of a Pod.< / data_description>

[0206] <data_content> {{ network_in}}< / data_content>

[0207] <data_grafana_link> https: / / grafana.foneshare.cn / d / pod-jvm-monitor / pod-jvm-monitor?var-datasource={{ prometheus_uid}}&var-namespace={{namespace}}&var-app={{ resource_name}}&var-pod={{ resource_id}}&from={{from_time}}&to={{ to_time}}< / data_grafana_link>

[0208] < / data>

[0209] <data>

[0210] <data_title> Pod network outflow traffic< / data_title>

[0211] <data_description> The network outflow traffic of a Pod can be used to analyze the network outflow traffic of a Pod.< / data_description>

[0212] <data_content> {{ network_out}}< / data_content>

[0213] <data_grafana_link> https: / / grafana.foneshare.cn / d / pod-jvm-monitor / pod-jvm-monitor?var-datasource={{ prometheus_uid}}&var-namespace={{namespace}}&var-app={{ resource_name}}&var-pod={{ resource_id}}&from={{from_time}}&to={{ to_time}}< / data_grafana_link>

[0214] < / data>

[0215] <data>

[0216] <data_title> JVM thread count< / data_title>

[0217] <data_description> The number of threads in a JVM can be used to analyze the number of threads in the JVM.< / data_description>

[0218] <data_content> {{ jvm_thread}}< / data_content>

[0219] <data_grafana_link> https: / / grafana.foneshare.cn / d / pod-jvm-monitor / pod-jvm-monitor?var-datasource={{ prometheus_uid}}&var-namespace={{namespace}}&var-app={{ resource_name}}&var-pod={{ resource_id}}&from={{from_time}}&to={{ to_time}}< / data_grafana_link>

[0220] < / data>

[0221] <data>

[0222] <data_title> JVM GC count< / data_title>

[0223] <data_description> The number of JVM garbage collections (GC) can be used to analyze the frequency of JVM GC.< / data_description>

[0224] <data_content> {{ jvm_gc}}< / data_content>

[0225] <data_grafana_link> https: / / grafana.foneshare.cn / d / pod-jvm-monitor / pod-jvm-monitor?var-datasource={{ prometheus_uid}}&var-namespace={{namespace}}&var-app={{ resource_name}}&var-pod={{ resource_id}}&from={{from_time}}&to={{ to_time}}< / data_grafana_link>

[0226] < / data>

[0227] < / datas>

[0228] To meet the business needs of automatic fault analysis, this embodiment designs a new AI root cause analysis scheme that combines "multimodal data fusion + graph analysis + large model inference":

[0229] 1. Construct a dynamic graph to automatically identify upstream and downstream related components of the alarm object;

[0230] 2. Employ the DTW (Dynamic Time Warping) algorithm to align various observable data (such as logs and metrics);

[0231] 3. Utilize the RAG (Retrieval Enhanced Generation) mechanism, combined with a knowledge base (alarm handling manual + historical handling method reference + platform basic knowledge, etc.) and graph information, to generate contextual prompts;

[0232] 4. Based on LLM (Large Language Model) professional analytical capabilities, perform multidimensional causal analysis and reasoning, and output structured causes and suggestions. Example 2

[0233] This embodiment provides an AI-based root cause analysis system that integrates multimodal observable data and a knowledge base, including:

[0234] The alarm access module is used to receive alarm events and extract alarm objects and their characteristic information.

[0235] The graph construction module constructs a dynamic topology graph centered on the alarm object based on service dependencies.

[0236] The aggregation and alignment module aggregates the multimodal observable data of each node in the dynamic topology graph and aligns the time series of the multimodal observable data.

[0237] The context generation module constructs a context that integrates a knowledge base, multimodal observable data, and historical processing records;

[0238] The root cause analysis module inputs the context into a large language model for root cause reasoning and outputs structured analysis results.

[0239] Obviously, the above embodiments are merely illustrative examples for clear explanation and are not intended to limit the implementation. Those skilled in the art will recognize that other variations or modifications can be made based on the above description. It is neither necessary nor possible to exhaustively list all possible implementations here. However, obvious variations or modifications derived therefrom are still within the scope of protection of this invention.

Claims

1. An AI-based root cause analysis method integrating multimodal data and a knowledge base, characterized in that, include: Receive alarm events and extract alarm objects and their characteristic information; A dynamic topology graph centered on the alarm object is constructed based on service dependencies, which include: RPC / HTTP call chains, network dependencies, and configuration dependencies; The multimodal observable data of each node in the dynamic topology graph are aggregated, and the time series of the multimodal observable data are aligned; the time series of the multimodal observable data are aligned using a dynamic time warping algorithm; A context is constructed that integrates a knowledge base, the multimodal observable data, and historical processing records, the context being constructed based on a retrieval-enhanced generation mechanism; The context is input into a large language model for root cause reasoning, and the structured analysis results are output.

2. The method according to claim 1, characterized in that, The multimodal observable data can be queried through workflow orchestration by drilling down the data, or by using an agent through dynamic topology. The multimodal observable data includes monitoring metrics, log content, and link tracing data; the monitoring metrics include CPU utilization, network latency, and QPS; the log content includes critical errors and exception stacks.

3. The method according to claim 1, characterized in that, The method further includes: pushing the structured analysis results to the work order system and updating the knowledge base.

4. The method according to claim 1, characterized in that, The characteristic information of the alarm object includes: alarm cluster, alarm namespace, resource type, resource name, resource ID, alarm level, alarm start time, alarm title, alarm content, alarm description, additional alarm information, alarm subscriber, alarm manager, and duty officer.

5. The method according to claim 1, characterized in that, The structured analysis results include: alarm root causes with confidence levels, handling recommendations ranked by impact, radical remediation plans, and prevention recommendations.

6. An AI-based root cause analysis system integrating multimodal data and a knowledge base, characterized in that, include: The alarm access module receives alarm events and extracts alarm objects and their characteristic information. The graph construction module constructs a dynamic topology graph centered on the alarm object based on service dependencies. The service dependencies include: RPC / HTTP call chains, network dependencies, and configuration dependencies. The aggregation and alignment module aggregates the multimodal observable data of each node in the dynamic topology graph and aligns the time series of the multimodal observable data; the time series of the multimodal observable data are aligned using a dynamic time warping algorithm; The context generation module constructs a context that integrates the knowledge base, the multimodal observable data, and historical processing records. The context is constructed based on a retrieval-enhanced generation mechanism. The root cause analysis module inputs the context into a large language model for root cause reasoning and outputs structured analysis results.

Images