System, method and device for realizing database fault root cause analysis based on multi-layer monitoring and causal reasoning, processor and storage medium
By combining a multi-layered monitoring and causal reasoning system with a large language model (Agent) and a RAG knowledge base, a cross-layered causal graph is constructed to perform root cause analysis of database failures. This solves the problems of incomplete knowledge coverage and delayed root cause location in traditional methods, and achieves highly accurate fault diagnosis and database stability assurance.
Patent Information
- Authority / Receiving Office
- CN · China
- Patent Type
- Applications(China)
- Current Assignee / Owner
- Filing Date
- 2025-10-31
- Publication Date
- 2026-03-31
AI Technical Summary
Traditional database fault diagnosis relies on human experience or rule engines, which suffers from incomplete knowledge coverage and delays in root cause location, making it difficult to achieve full coverage and high accuracy in fault root cause analysis in complex scenarios.
The system employs multi-layered monitoring and causal reasoning, including a detection index collection module, a multi-agent analysis module, a causal graph reasoning module, and a root cause localization and explanation module. It combines a large language model agent, MCP tool, and RAG knowledge base to construct a cross-layer causal graph for fault link tracing and explanation, and performs verification in a security sandbox.
It achieves comprehensive and accurate root cause analysis of database failures, improves the accuracy and interpretability of root cause location, can adapt to changes in complex scenarios, and provides efficient and reliable database stability assurance.
Smart Images
Figure CN121764709A_ABST
Abstract
Description
Technical Field
[0001] This invention relates to the field of database faults, and more particularly to the field of fault diagnosis. Specifically, it relates to a system, method, apparatus, processor, and computer-readable storage medium for database fault root cause analysis based on multi-layer monitoring and causal reasoning. Background Technology
[0002] The stability of a database system directly impacts a company's core business. However, in complex scenarios, database failures can stem from multiple factors: View layer (query and visibility layer): such as SQL query logic exceptions, view permission conflicts, etc.; Code layer (application logic layer): for example, stored procedure defects, ORM framework bugs; System resource layer (hardware / OS / network layer): such as disk I / O bottlenecks, insufficient memory, and CPU overload.
[0003] Traditional troubleshooting relies on human experience or rule engines, which suffers from incomplete knowledge coverage and delays in root cause identification. Summary of the Invention
[0004] The purpose of this invention is to overcome the shortcomings of the prior art and provide a system, method, device, processor and computer-readable storage medium for database fault root cause analysis based on multi-layer monitoring and causal reasoning, which is comprehensive, highly accurate and widely applicable.
[0005] To achieve the above objectives, the present invention provides a system, method, apparatus, processor, and computer-readable storage medium for database fault root cause analysis based on multi-layer monitoring and causal reasoning, as follows: This system, which uses multi-layered monitoring and causal reasoning to perform root cause analysis of database failures, is characterized by the following features: The indicator collection module is used to collect indicators from the database view layer, code layer, and system resource layer respectively. The multi-agent analysis module, connected to the detection index collection module, is used to configure the large language model agent and perform analysis in conjunction with the MCP tool and RAG knowledge base; The causal graph reasoning module, connected to the multi-agent analysis module, is used to establish a cross-layer causal graph for tracing and explaining fault links. The root cause localization and explanation module is connected to the causal graph reasoning module and is used to integrate the LLM analysis conclusions and causal reasoning results to output the root cause and explanation chain. The security sandbox execution verification module is connected to the detection index collection module, multi-Agent analysis module, cause-effect graph reasoning module, and root cause localization and interpretation module to construct a security sandbox environment for security control.
[0006] Preferably, the multi-Agent analysis module calls the operation and maintenance tools and database interface through the MCP tool, and the multi-Agent analysis module introduces the operation and maintenance case library and historical fault library through the RAG knowledge base.
[0007] Preferably, the security sandbox execution verification module constructs a security sandbox environment, executes in a sandbox isolated from the production environment, calls tools initiated through MCP, analyzes the execution results and behaviors of commands, and decides whether to execute in the production environment after confirming safety and harmlessness; based on the security control tools oriented towards MCP, it uses predefined execution commands and matching operation operators.
[0008] Preferably, the causal graph reasoning module performs root cause analysis on data with abnormal indicators using intervention theory, specifically as follows: Root cause analysis using intervention theory is based on the following formula: ; in, Due to query delay, This refers to CPU utilization.
[0009] Preferably, the causal graph reasoning module corrects for confounding factors through a backdoor adjustment formula, specifically as follows: The confounding factors are corrected according to the following formula: ; in, Due to query delay, For CPU utilization, This refers to memory usage.
[0010] Preferably, the root cause localization and explanation module performs semantic analysis and abnormal pattern recognition on the original indicators of each layer through the LLM Agent, and infers and verifies cross-layer relationships through the causal graph, outputting the explanatory natural language analysis of LLM and the inference link of the causal graph.
[0011] The method for database fault root cause analysis based on multi-layer monitoring and causal reasoning is characterized by the following steps: (1) Collect metrics for the database view layer, code layer and system resource layer respectively; (2) Configure the large language model agent and perform analysis using the MCP tool and RAG knowledge base; (3) Establish a cross-layer cause-effect graph to trace and explain the fault links; (4) Integrate the conclusions of LLM analysis with the results of causal reasoning to output the root cause and the explanatory link; (5) Build a sandbox environment to execute database commands and analyze the execution results and behavior of the commands.
[0012] Preferably, step (3) further includes root cause analysis of the data with abnormal indicators using intervention theory, specifically: Root cause analysis using intervention theory is based on the following formula: ; in, Due to query delay, This refers to CPU utilization.
[0013] Preferably, step (3) further includes correcting for confounding factors using a backdoor adjustment formula, specifically: The confounding factors are corrected according to the following formula: ; in, Due to query delay, For CPU utilization, This refers to memory usage.
[0014] Preferably, step (4) specifically includes the following steps: (4.1) Perform semantic analysis and abnormal pattern identification on the original indicators of each layer through LLM Agent; (4.2) Reasoning and verifying cross-level relationships using cause-effect graphs; (4.3) Output the explanatory natural language analysis and reasoning links of the causal graph of the LLM.
[0015] The device for database fault root cause analysis based on multi-layer monitoring and causal reasoning is characterized in that the device includes: A processor is configured to execute computer-executable instructions; The memory stores one or more computer-executable instructions, which, when executed by the processor, implement the various steps of the method described above for database fault root cause analysis based on multi-layer monitoring and causal reasoning.
[0016] The processor for database fault root cause analysis based on multi-layer monitoring and causal reasoning is characterized in that the processor is configured to execute computer-executable instructions, and when the computer-executable instructions are executed by the processor, the various steps of the above-mentioned method for database fault root cause analysis based on multi-layer monitoring and causal reasoning are implemented.
[0017] The main feature of this computer-readable storage medium is that it stores a computer program thereon, which can be executed by a processor to implement the various steps of the above-described method for database fault root cause analysis based on multi-layer monitoring and causal reasoning.
[0018] This paper presents a system, method, device, processor, and computer-readable storage medium for database fault root cause analysis based on multi-layer monitoring and causal reasoning. By integrating Large Language Model (LLM) agents and causal graph reasoning technology, it performs semantic analysis and abnormal pattern recognition through multi-layer LLM agents and combines cross-layer reasoning verification with causal graph models. This effectively avoids the "illusion" risk of LLM and significantly improves the accuracy and interpretability of root cause localization. With the dynamic adaptation capabilities of the RAG knowledge base and MCP tools, the system can comprehensively track multiple indicators such as SQL latency, transaction conflict rate, and CPU utilization, and adapt to changes in complex scenarios. With a closed loop of "intelligent analysis - causal verification - secure execution," it provides an efficient and reliable solution for ensuring database stability. Attached Figure Description
[0019] Figure 1 This is a schematic diagram of the system for database fault root cause analysis based on multi-layer monitoring and causal reasoning, according to the present invention.
[0020] Figure 2 This is a flowchart of the database fault root cause analysis based on multi-layer monitoring and causal reasoning according to the present invention. Detailed Implementation
[0021] To more clearly describe the technical content of the present invention, the following description is provided in conjunction with specific embodiments.
[0022] The system for database fault root cause analysis based on multi-layer monitoring and causal reasoning of the present invention includes: The indicator collection module is used to collect indicators from the database view layer, code layer, and system resource layer respectively. The multi-agent analysis module, connected to the detection index collection module, is used to configure the large language model agent and perform analysis in conjunction with the MCP tool and RAG knowledge base; The causal graph reasoning module, connected to the multi-agent analysis module, is used to establish a cross-layer causal graph for tracing and explaining fault links. The root cause localization and explanation module is connected to the causal graph reasoning module and is used to integrate the LLM analysis conclusions and causal reasoning results to output the root cause and explanation chain. The security sandbox execution verification module is connected to the detection index collection module, multi-Agent analysis module, cause-effect graph reasoning module, and root cause localization and interpretation module to construct a security sandbox environment for security control.
[0023] In a preferred embodiment of the present invention, the multi-Agent analysis module calls the operation and maintenance tools and database interface through the MCP tool, and the multi-Agent analysis module introduces the operation and maintenance case library and historical fault library through the RAG knowledge base.
[0024] As a preferred embodiment of the present invention, the security sandbox execution verification module constructs a security sandbox environment and executes in a sandbox isolated from the production environment. It calls tools initiated through MCP to analyze the execution results and behaviors of commands, and decides whether to execute in the production environment after confirming that the commands are safe and harmless. Based on the security control tools oriented towards MCP, it uses predefined execution commands and matching operation operators.
[0025] In a preferred embodiment of the present invention, the causal graph reasoning module performs root cause analysis on data with abnormal indicators using intervention theory, specifically as follows: Root cause analysis using intervention theory is based on the following formula: ; in, Due to query delay, This refers to CPU utilization.
[0026] In a preferred embodiment of the present invention, the causal graph reasoning module corrects for confounding factors through a backdoor adjustment formula, specifically as follows: The confounding factors are corrected according to the following formula: ; in, Due to query delay, For CPU utilization, This refers to memory usage.
[0027] In a preferred embodiment of the present invention, the root cause localization and explanation module performs semantic analysis and abnormal pattern recognition on the original indicators of each layer through an LLM Agent, and performs reasoning and verification on cross-layer relationships through a causal graph, outputting the explanatory natural language analysis of LLM and the reasoning link of the causal graph.
[0028] The method for database fault root cause analysis based on multi-layer monitoring and causal reasoning is characterized by the following steps: (1) Collect metrics for the database view layer, code layer and system resource layer respectively; (2) Configure the large language model agent and perform analysis using the MCP tool and RAG knowledge base; (3) Establish a cross-layer cause-effect graph to trace and explain the fault links; (4) Integrate the conclusions of LLM analysis with the results of causal reasoning to output the root cause and the explanatory link; (5) Build a sandbox environment to execute database commands and analyze the execution results and behavior of the commands.
[0029] In a preferred embodiment of the present invention, step (3) further includes root cause analysis of the data with abnormal indicators using intervention theory, specifically: Root cause analysis using intervention theory is based on the following formula: ; in, Due to query delay, This refers to CPU utilization.
[0030] In a preferred embodiment of the present invention, step (3) further includes correcting the confounding factors using a backdoor adjustment formula, specifically: The confounding factors are corrected according to the following formula: ; in, Due to query delay, For CPU utilization, This refers to memory usage.
[0031] In a preferred embodiment of the present invention, step (4) specifically includes the following steps: (4.1) Perform semantic analysis and abnormal pattern identification on the original indicators of each layer through LLM Agent; (4.2) Reasoning and verifying cross-level relationships using cause-effect graphs; (4.3) Output the explanatory natural language analysis and reasoning links of the causal graph of the LLM.
[0032] The apparatus of the present invention for database fault root cause analysis based on multi-layer monitoring and causal reasoning includes: A processor is configured to execute computer-executable instructions; The memory stores one or more computer-executable instructions, which, when executed by the processor, implement the various steps of the method described above for database fault root cause analysis based on multi-layer monitoring and causal reasoning.
[0033] The processor of the present invention for implementing database fault root cause analysis based on multi-layer monitoring and causal reasoning is configured to execute computer-executable instructions, which, when executed by the processor, implement the various steps of the above-described method for implementing database fault root cause analysis based on multi-layer monitoring and causal reasoning.
[0034] The computer-readable storage medium of the present invention stores a computer program that can be executed by a processor to implement the various steps of the above-described method for database fault root cause analysis based on multi-layer monitoring and causal reasoning.
[0035] In a specific embodiment of this invention, a database fault root cause analysis method based on Large Language Model (LLM) Agent and causal graph reasoning is proposed, which consists of five modules: detection index collection module, multi-agent analysis module, causal graph reasoning module, root cause localization and interpretation module, and security sandbox execution verification module. Here, LLM stands for Large Language Model.
[0036] The indicator collection module collects indicators (such as SQL latency, transaction conflict rate, stored procedure execution time, CPU utilization, IOPS, etc.) from the database view layer, code layer, and system resource layer respectively.
[0037] (1) Database view layer The database view layer focuses on the operational status and interaction behavior of logical objects within the database instance (such as tables, indexes, views, stored procedures, etc.), reflecting the health of the core database functions. The metrics at this layer are directly related to the database's own operational efficiency and logical correctness, and are key evidence for locating internal database faults (such as query performance degradation and resource contention). The core monitoring metrics of the database view layer include: SQL execution metrics: average execution time of a single SQL statement, 95th / 99th percentile latency, number of rows scanned (logical / physical reads), number of rows returned, and number of temporary table / file sorts (reflecting index usage efficiency); Transaction and lock metrics: transaction commit / rollback time, number of active transactions, number of lock waits (row locks / table locks), frequency of deadlocks and the SQL statements involved; Cache and memory metrics: Buffer Pool Hit Ratio, Shared Memory Usage Ratio, and Update Frequency of Failed Index / Table Statistics (which affects optimizer decisions). View / object status: frequency of changes to the underlying table on which the view depends (e.g., structural modifications causing the view to fail), and hotspot distribution of partitions in the partitioned table (local data skew). Replication and high availability metrics (if applicable): Master-slave replication latency, standby database synchronization error rate, and read-write separation routing success rate.
[0038] (2) Code layer The code layer focuses on the logical implementation of application-database interactions, covering the entire code behavior chain from SQL generation and connection management to result processing. Metrics at this layer are used to identify indirect database failures caused by application code defects (such as inefficient SQL or resource leaks) or improper framework / middleware configurations (such as unreasonable connection pool parameters). Core monitoring metrics at the code layer include: SQL generation and execution logic: number of slow SQL queries (application-defined threshold, such as >1s), number of times the same SQL is executed repeatedly (possibly due to cache invalidation or code loop calls), and the proportion of hard parsing caused by dynamic SQL concatenation (increasing the burden on the database optimizer). Connection and resource management: active / idle connections in the database connection pool, connection wait time (time spent by the application to acquire a connection), and connection leak detection (number of connections not released in time). Error and exception handling: Database-related exception types in application logs (such as specific subclasses of SQLException, such as timeout, connection refusal, and data integrity constraint violation), and failure rates of batch operations (such as Batch Insert); Caching and ORM behavior: First-level / second-level cache hit rate of ORM frameworks (such as Hibernate, MyBatis), and the number of N+1 query problems (extra SQL calls caused by lazy loading). Business logic correlation metrics: The length of the database call chain triggered by a specific business operation (such as order submission or user login) (reflecting the pressure on the database due to the complexity of the business logic).
[0039] (3) System resource layer The system resource layer focuses on the operational status of the underlying infrastructure of the database server, covering the resource consumption of hardware, operating system, and database processes. The metrics at this layer are used to determine whether a failure is caused by underlying resource bottlenecks (such as CPU overload or disk I / O latency), and are a key boundary distinguishing between "database-specific problems" and "infrastructure problems." The core monitoring metrics of the system resource layer include: CPU resources: Database process CPU utilization (user mode / kernel mode), CPU wait time for I / O (%iowait, reflecting disk pressure), number of context switches (excessive numbers may cause performance jitter). Memory resources: Database process memory usage (such as MySQL's InnoDB Buffer Pool, PostgreSQL's Shared Buffers), system swap space (Swap) usage (signals of insufficient memory), OOM Killer trigger records (extreme memory pressure); Disk and Storage: Read / write latency (await), IOPS / throughput (tps / b / s), disk queue length (reflecting IO queuing status), and RAID card cache hit rate of the disk where data files / transaction logs (such as MySQL's ibdata and ib_logfile) are located; Network resources: network bandwidth usage of database listening ports (such as 3306, 5432), TCP retransmission rate (due to network instability), and network latency of client connections (such as RTT when deployed across data centers). Processes and Kernel: The number of threads in the database process (too many may cause scheduling overhead), kernel parameter limits (such as whether open_files_limit has been reached), and the number of file descriptors used.
[0040] Multi-Agent Analysis Module: Each layer is configured with a large language model agent, combined with: MCP tools: call operation and maintenance tools and database interfaces to enhance contextual capabilities; RAG Knowledge Base: Introduces an operations and maintenance case library and a historical fault library to provide enhanced knowledge for LLM.
[0041] Causal Graph Reasoning Module: Creates cross-layer causal graphs for tracing and explaining faulty links.
[0042] Root Cause Locator and Explanation Module: Integrates LLM analysis conclusions with causal reasoning results, and outputs the root cause and explanation chain.
[0043] Security Sandbox Execution Verification Module: 1. Execution: A secure sandbox environment is built, implemented using a Docker container environment. All tool calls initiated through MCP, such as calls to OceanBase's obdiag command or GaussDB's DBmind command, are first executed in a sandbox isolated from the production environment. The system analyzes the execution results and behavior of the command, and only after confirming its safety and harmlessness does the administrator or automated script decide whether to execute it in the production environment.
[0044] 2. Security Control: Based on Google MCPToolbox for Databases, an open-source security control tool for MCP, it protects against MCP operation risks by predefined execution commands and matching operation operators.
[0045] This solution provides a method for large models to call MCP. By allowing large models to call mature tools, such as encapsulating MCP into an MCP server, the behavior of large models can be constrained, making their operations fixed and controllable. This part can control the scope of commands called when implementing the MCP server.
[0046] The core technology of this invention is as follows: 1) Multi-Agent Mechanism: Based on different problem domains, three layers of agents were designed, and corresponding RAG knowledge bases and MCP tools were configured for each layer. Each layer of agents has a domain knowledge base.
[0047] 2) Introduction of causal graph: A causal graph model was constructed, including: setting three sets of hierarchical variables and causal reasoning.
[0048] 3) Interaction between LLM Agent and Cause-effect Graph: The cause-effect graph is responsible for reasoning and verifying cross-layer relationships, avoiding the "illusionary" conclusions of LLM.
[0049] 4) MCP Security Sandbox Mechanism: Construct a security sandbox environment and pre-execute judgment results; introduce Google's MCP Toolbox for Databases, a database operation risk control module based on MCP, to protect MCP operation risks through predefined execution commands, matching operation operators, etc.
[0050] The cause-effect graph modeling of this invention is as follows: Define three hierarchical sets of variables: For view layer metrics (such as query latency) View error rate ), For code-level metrics (such as stored procedure execution time) Transaction rollback rate ), For system-level metrics (such as CPU utilization) Memory usage Disk I / O ).
[0051] Directed Acyclic Graph (DAG) for Resume: ; Among them, the edge set To express a cause-and-effect relationship, for example: ; The formula for causal reasoning is as follows: In a cause-effect graph, an anomaly occurs in a certain layer of the data (e.g., ...). When the levels are too high, root cause analysis can be performed using the do-operation (intervention theory): ; If the difference is significant, it indicates that CPU load is the causal factor causing query latency, rather than just a related factor.
[0052] Adjusting the formula via a backdoor to account for confounding factors (such as memory usage) Corrections will be made: ; This allows for a more scientific determination of the root cause.
[0053] IV. Interaction between LLM Agent and Cause-Effect Graph The LLM Agent is responsible for performing semantic analysis and anomaly pattern recognition on the raw metrics of each layer (e.g., identifying SQL execution timeouts as being caused by lock waiting).
[0054] Cause-effect graphs are responsible for reasoning and verifying cross-level relationships, avoiding the "illusory" conclusions of LLM.
[0055] The final output combines LLM-based interpretive natural language analysis with causal graph reasoning links.
[0056] For the specific implementation scheme of this embodiment, please refer to the relevant descriptions in the above embodiments, which will not be repeated here.
[0057] It is understood that the same or similar parts in the above embodiments can be referred to each other, and the contents not described in detail in some embodiments can be referred to the same or similar contents in other embodiments.
[0058] It should be noted that in the description of this invention, the terms "first," "second," etc., are used for descriptive purposes only and should not be construed as indicating or implying relative importance. Furthermore, in the description of this invention, unless otherwise stated, "a plurality of" means at least two.
[0059] Any process or method description in the flowchart or otherwise herein can be understood as representing a module, segment, or portion of code comprising one or more executable instructions for implementing a particular logical function or process, and the scope of the preferred embodiments of the invention includes additional implementations in which functions may be performed not in the order shown or discussed, including substantially simultaneously or in reverse order depending on the functions involved, as will be understood by those skilled in the art to which embodiments of the invention pertain.
[0060] It should be understood that various parts of the present invention can be implemented in hardware, software, firmware, or a combination thereof. In the above embodiments, multiple steps or methods can be implemented in software or firmware stored in memory and executed by a suitable instruction execution device. For example, if implemented in hardware, as in another embodiment, it can be implemented using any one or a combination of the following techniques known in the art: discrete logic circuits having logic gates for implementing logical functions on data signals, application-specific integrated circuits (ASICs) having suitable combinational logic gates, programmable gate arrays (PGAs), field-programmable gate arrays (FPGAs), etc.
[0061] Those skilled in the art will understand that all or part of the steps of the methods in the above embodiments can be implemented by a program instructing related hardware. The corresponding program can be stored in a computer-readable storage medium. When the program is executed, it includes one or a combination of the steps of the method embodiments.
[0062] Furthermore, the functional units in the various embodiments of the present invention can be integrated into a processing module, or each unit can exist physically separately, or two or more units can be integrated into a module. The integrated module can be implemented in hardware or as a software functional module. If the integrated module is implemented as a software functional module and sold or used as an independent product, it can also be stored in a computer-readable storage medium.
[0063] The storage media mentioned above can be read-only memory, disk, or optical disk, etc.
[0064] In the description of this specification, references to terms such as "one embodiment," "some embodiments," "example," "specific example," or "some examples," etc., indicate that a specific feature, structure, material, or characteristic described in connection with that embodiment or example is included in at least one embodiment or example of the invention. In this specification, the illustrative expressions of the above terms do not necessarily refer to the same embodiment or example. Furthermore, the specific features, structures, materials, or characteristics described may be combined in any suitable manner in one or more embodiments or examples.
[0065] This paper presents a system, method, device, processor, and computer-readable storage medium for database fault root cause analysis based on multi-layer monitoring and causal reasoning. By integrating Large Language Model (LLM) agents and causal graph reasoning technology, it performs semantic analysis and abnormal pattern recognition through multi-layer LLM agents and combines cross-layer reasoning verification with causal graph models. This effectively avoids the "illusion" risk of LLM and significantly improves the accuracy and interpretability of root cause localization. With the dynamic adaptation capabilities of the RAG knowledge base and MCP tools, the system can comprehensively track multiple indicators such as SQL latency, transaction conflict rate, and CPU utilization, and adapt to changes in complex scenarios. With a closed loop of "intelligent analysis - causal verification - secure execution," it provides an efficient and reliable solution for ensuring database stability.
[0066] In this specification, the invention has been described with reference to specific embodiments thereof. However, it will be apparent that various modifications and variations can be made without departing from the spirit and scope of the invention. Therefore, the specification and drawings should be considered illustrative rather than restrictive.
Claims
1. A system for implementing database fault root cause analysis based on multi-layer monitoring and causal reasoning, characterized in that, The system comprises: The detection index collection module is used for collecting indexes of a database view layer, a code layer and a system resource layer respectively; The multi-Agent analysis module is connected with the detection index collection module and is used for configuring a large language model Agent, combining an MCP tool and an RAG knowledge base for analysis; The causal diagram reasoning module is connected with the multi-Agent analysis module and is used for establishing a cross-layer causal diagram, tracing and explaining a fault link; The root cause positioning and explanation module is connected with the causal diagram reasoning module and is used for fusing LLM analysis conclusions and causal reasoning results, outputting a root cause and an explanation link; The security sandbox execution verification module is connected with the detection index collection module, the multi-Agent analysis module, the causal diagram reasoning module and the root cause positioning and explanation module, and is used for constructing a security sandbox environment for security prevention and control.
2. The system for database fault root cause analysis based on multi-layer monitoring and causal reasoning of claim 1, wherein, The multi-Agent analysis module calls operation and maintenance tools and a database interface through an MCP tool, and the multi-Agent analysis module introduces an operation and maintenance case library and a historical fault library through an RAG knowledge base.
3. The system for database fault root cause analysis based on multi-layer monitoring and causal reasoning of claim 1, wherein, The security sandbox execution verification module constructs a security sandbox environment, executes in the sandbox isolated from a production environment, calls tools initiated through an MCP, analyzes execution results and behaviors of commands, and confirms whether a decision is executed in the production environment; based on an MCP-oriented security prevention and control tool, a pre-defined execution command and a matching operation operator are matched.
4. The system for database fault root cause analysis based on multi-layer monitoring and causal reasoning of claim 1, wherein, The causal diagram reasoning module performs root cause analysis on abnormal data of indexes through an intervention theory, specifically as follows: The root cause is analyzed through the intervention theory according to the following formula: ； wherein, is the query latency, is the CPU utilization.
5. The system for database fault root cause analysis based on multi-layer monitoring and causal reasoning of claim 1, wherein, The causal diagram reasoning module corrects mixed factors through a backdoor adjustment formula, specifically as follows: The mixed factors are corrected according to the following formula: ； wherein, is a query latency, is a CPU utilization, is a memory footprint.
6. The system for database fault root cause analysis based on multi-layer monitoring and causal reasoning of claim 1, wherein, The root cause positioning and explanation module performs semantic analysis and abnormal pattern recognition on original indexes of each layer through an LLM Agent, performs reasoning and verification on cross-layer relationships through a causal diagram, and outputs explanatory natural language analysis of an LLM and reasoning links of a causal diagram.
7. A method for database fault root cause analysis based on multi-layer monitoring and causal reasoning based on the system of claim 1, characterized in that, The method comprises the following steps: (1) Collecting indexes of a database view layer, a code layer and a system resource layer respectively; (2) Configuring a large language model Agent, combining an MCP tool and an RAG knowledge base for analysis; (3) Establishing a cross-layer causal diagram, tracing and explaining a fault link; (4) Fusing LLM analysis conclusions and causal reasoning results, outputting a root cause and an explanation link; (5) Constructing a sandbox environment to execute a database command, and analyzing execution results and behaviors of the command.
8. The method for database fault root cause analysis based on multi-layer monitoring and causal reasoning of claim 7, wherein, The step (3) further comprises performing root cause analysis on abnormal data of indexes through an intervention theory, specifically as follows: The root cause is analyzed through the intervention theory according to the following formula: ； wherein, is the query latency, is the CPU utilization.
9. The method for database fault root cause analysis based on multi-layer monitoring and causal reasoning of claim 7, wherein, The step (3) further comprises correcting mixed factors through a backdoor adjustment formula, specifically as follows: The mixed factors are corrected according to the following formula: ； wherein, is a query latency, is a CPU utilization, is a memory footprint.
10. The method for database fault root cause analysis based on multi-layer monitoring and causal reasoning of claim 7, wherein, The step (4) specifically comprises the following steps: (4.1) Performing semantic analysis and abnormal pattern recognition on original indexes of each layer through an LLM Agent; (4.2) Performing reasoning and verification on cross-layer relationships through a causal diagram; (4.3) output the explanatory natural language analysis and the reasoning link of the causal graph of the LLM.
11. An apparatus for implementing database fault root cause analysis based on multi-layer monitoring and causal reasoning, the apparatus comprising: The apparatus comprises: a processor configured to execute computer executable instructions; a memory storing one or more computer executable instructions that, when executed by the processor, implement the steps of the method of any one of claims 7 to 10 for database fault root cause analysis based on multi-layer monitoring and causal reasoning.
12. A processor for implementing database fault root cause analysis based on multi-layer monitoring and causal reasoning, the processor comprising: The processor is configured to execute computer executable instructions that, when executed by the processor, implement the steps of the method of any one of claims 7 to 10 for database fault root cause analysis based on multi-layer monitoring and causal reasoning.
13. A computer-readable storage medium, characterized in that, a computer program stored thereon, the computer program being executable by a processor to implement the steps of the method of any one of claims 7 to 10 for database fault root cause analysis based on multi-layer monitoring and causal reasoning.