A computer fault rapid positioning method

Abstract

The application discloses a computer fault rapid positioning method, and relates to the technical field of intelligent operation and maintenance.Firstly, global monitoring data of a target computer is acquired, layered topology modeling is carried out on the target computer, and a candidate monitoring point set and node data are constructed according to the layered topology model.Secondly, the RCO algorithm is used to perform optimization positioning calculation on the monitoring point set and the node data, and a monitoring point subset is obtained; a layered fault positioning model is constructed based on the layered topology model and the monitoring point subset, backtracking layered positioning is performed on the global monitoring data, and the fault probability of each component of the computer is obtained; finally, a diagnosis dispatcher is constructed and distributed to each monitoring point in a distributed manner, and a fault priority scheduling queue is generated in a closed loop, so that the positioning fault tolerance rate in a complex fault scenario is significantly improved, and the resource occupancy rate is reduced.

Description

Technical Field

[0001] This invention relates to the field of intelligent operation and maintenance technology, and in particular to a method for rapid computer fault location. Background Technology

[0002] The stability and reliability of computer systems are the cornerstones for ensuring the normal operation of society and the continuity of core business operations. However, the scale and complexity of systems are expanding at an unprecedented rate. From macro-level data centers to micro-level Internet of Things devices, from monolithic applications to complex distributed systems composed of thousands of microservices, failures are becoming more frequent and unpredictable. Software fault location, that is, the process of accurately identifying the root cause of abnormal behavior in a program or system, has always been the most time-consuming and costly critical link in software debugging and system operation and maintenance.

[0003] Currently, Chinese invention patent application number CN202410690925.7 discloses a method and apparatus for locating computer hardware faults. This method is applied to the client where the computer hardware is located. It synchronously transmits traffic data from the computer hardware corresponding to each front-end image detection module to the corresponding virtual component in the digital twin server simulator; synchronously transmits internal data from the computer hardware corresponding to each built-in detection module to the corresponding virtual component in the digital twin server simulator; sends snapshots of the traffic data and internal data of each computer hardware to the digital twin server simulator; determines the faulty computer hardware based on fault alarm information; bridges the front-end image detection module of the faulty computer hardware to the digital twin server simulator, performs simulation based on the snapshot data to obtain the fault location result; and receives the fault location result determined by the digital twin server simulator.

[0004] Related technologies struggle to balance the conflict between monitoring resources and performance overhead; monitoring point coverage is incomplete, fault signals on critical paths are easily missed, and the waiting time for fault alarms is long, making it difficult to capture fault location points in real time. Summary of the Invention

[0005] The technical problem solved by this invention is that existing technologies have difficulty balancing the contradiction between monitoring resources and performance overhead; monitoring point coverage is incomplete, fault signals on critical paths are easily missed, and the waiting time for fault alarms is long, making it difficult to capture fault location points in real time.

[0006] To solve the above-mentioned technical problems, the present invention provides the following technical solution: A method for rapid computer fault location includes the following steps: Step S1: Obtain global monitoring data of the target computer, perform hierarchical topology modeling on the target computer to obtain a hierarchical topology model, and construct a set of candidate monitoring points and node data based on the hierarchical topology model; Step S2: Use the RCO algorithm to perform optimization and location calculations on the monitoring point set and node data to obtain a subset of monitoring points; Step S3: Construct a hierarchical fault location model based on the hierarchical topology model and a subset of monitoring points, and perform backtracking hierarchical location on the global monitoring data to obtain the fault probability of each computer component. Step S4: Construct a diagnostic scheduler based on the failure probability of each computer component, distribute it to each monitoring point, and generate a fault priority scheduling queue in a closed loop.

[0007] Preferably, step S1 includes the following sub-steps: Step S11: Deploy a lightweight data acquisition agent on the target computer, call the configuration management database interface of the target computer, and obtain the global monitoring data of the target computer. The global monitoring data includes operating system data, application log data, network connection data, and application performance data. Step S12: Based on the call relationships and corresponding timestamp synchronization information in the global monitoring data, a layered topology model is constructed using graph theory. The layered topology model is a directed acyclic graph and is divided into a physical layer, a virtualization layer, a service layer, and an interface layer from top to bottom. Each node of the directed acyclic graph is a component of the target computer, and the edges of the directed acyclic graph point to the data flow between the components. The components of the target computer include physical components, virtualization and operating system components, middleware and platform layer components, and application logic components. Step S13: Traverse all nodes in the hierarchical topology model, perform multimodal interface detection on each node, and extract a set of candidate monitoring points. The multimodal interface detection includes: When a node can respond to a preset monitoring protocol command, it is determined that the current node has the ability to send data back and is regarded as a node with data transmission. The circuit breaker mechanism is further used to mark the node with data transmission to obtain node labels. The node labels include observable and unobservable. The node labels are traversed, and the nodes with the node labels being observable are extracted as candidate monitoring points to generate a set of candidate monitoring points. The identity data, access protocol data, resource overhead data, and circuit breaker status data of candidate monitoring points in the hierarchical topology model are determined and used as node data; The identity data includes identifiers, component categories, hierarchical levels, upstream nodes, and downstream nodes; Access protocol data includes access endpoints, collection protocol types, and permission indexes; Resource overhead data includes computing overhead, network overhead, storage overhead, and path coverage center data; The circuit breaker status data includes a comprehensive pressure index and node labels.

[0008] Preferably, the step of using a circuit breaker mechanism to mark the nodes with feedback specifically includes: Security circuit breaking based on dynamic trust scoring and load circuit breaking based on multi-dimensional resource pressure are used to determine all nodes with backhaul and obtain the first state and the second state. The first state is a secure isolation state, and the second state is a high resource load state; Security circuit breaker processing based on dynamic trust scoring includes: A dynamic trust score is initialized for all backhaul nodes. The behavior dimensions of the backhaul nodes within a preset historical time window are monitored in real time. The behavior dimensions include diagnostic task response failure rate, security threat log records, and configuration violations. When the behavior dimensions of the backhaul node in the current historical time window exceed the preset behavior threshold, the dynamic trust score of the current node is deducted. The backhaul nodes with dynamic trust scores lower than the security threshold are determined to be in the first state, which is the security isolation state. Load circuit breaker handling based on multidimensional resource pressure includes: The utilization rate of key resources of the backhaul nodes is collected. These key resources include CPU, memory, and disk I / O. The dynamic baseline range of each key resource is calculated based on a time series model. Based on the deviation of the current key resource utilization rate from the dynamic baseline range, the degree of deviation of a single-dimensional resource is calculated.

[0009] in, Let be the deviation of the r-th resource. Let r be the current utilization rate of the r-th resource. Let r be the upper limit of the dynamic baseline range for the r-th resource. The maximum value of resource r, when Less than hour, =0, where r is the ID of the critical resource. , The overall pressure index of a node is calculated using a resource contention penalty factor. The formula for calculating the overall pressure index is as follows:

[0010] in, The overall stress index, Let be the weight coefficient corresponding to the r-th resource. To compete for resources, use penalty factors. It is a Boolean indicator variable; When the comprehensive pressure index is greater than the dynamic pressure threshold or the utilization rate of any key resource exceeds the absolute safety threshold, and the duration is greater than twice the historical time window, the current node with feedback will be determined to be in the second state. When the node with feedback is not in the first state or the second state at the same time, the node label of the node with feedback is marked as observable. When the node with feedback is in either the first state or the second state, the node label of the node with feedback is marked as unobservable.

[0011] Preferably, step S2 includes the following sub-steps: Step S21: Extract the candidate monitoring point set and node data, map the candidate monitoring point set to the position vector of the RCO algorithm, define the population size as N, and the position vector of each candidate monitoring point is the position of the potential monitoring point in the hierarchical topology model. Set the position vector of the i-th individual in the t-th iteration as... Where D is the total number of candidate monitoring points, the location vector is mapped using a discretization function to... The status, where 1 indicates that a monitoring point is deployed at this location, and 0 indicates that no monitoring point is deployed; Step S22: Construct a bi-objective fitness function, which includes calculating fault coverage and resource overhead. The fault coverage is calculated based on the path coverage centrality of candidate monitoring points, and the resource overhead is calculated based on the resource overhead data of candidate monitoring points to obtain individual scalar values. Step S23: The position vector of each candidate monitoring point is iteratively updated using the RCO optimization algorithm to obtain the individual position vector; Step S24: Through the discretization mapping mechanism, the individual position vector is mapped to a binary state using the sigmoid transfer function to generate a subset of monitoring points; Step S25: Preset the number of iterations. When the number of iterations of the RCO optimization algorithm reaches the preset number of iterations, output a subset of monitoring points.

[0012] Preferably, step S23 further includes: The location vector of each candidate monitoring point is iteratively updated using the RCO optimization algorithm, including global exploration and local exploration. The calculation expression for the global exploration is as follows:

[0013] in, Let the position vector of the candidate monitoring points be the position vector after the (t+1)th iteration. Let be the position vector of the optimal candidate monitoring point in the t-th iteration. It is a random number. Environmental wind disturbance factor, Let be a random variable that follows a normal distribution; The calculation expression for the local exploration is:

[0014] in, The convergence factor decreases with the number of iterations. It is a random number. To simulate the perturbation term of periodic local exploration actions, The location of the individual is randomly selected.

[0015] In this embodiment, step S23 simulates the natural behavior of the red-crowned crane to perform a global exploration iteration: In the early stages of iteration, wind interference factors were utilized. Perform a wide-area search. Follows a standard normal distribution Necessary random perturbations are introduced to prevent premature entrapment in a complex multimodal search space.

[0016] In the later stages of iteration, for individuals with high fitness, the algorithm simulates the periodic actions during courtship to conduct local exploration. An oscillating operator between [-1, 1] is generated, so that the individual does not approach the optimal solution in a straight line, but performs a fine search near the optimal solution along a spiral trajectory. The nonlinear approximation strategy greatly improves the solution accuracy of the algorithm in discrete combinatorial optimization problems.

[0017] Preferably, the specific process of the discretization mapping mechanism is as follows: Using S-type transfer function Calculate the probability of each value in the location vector of consecutive candidate monitoring points:

[0018] in, Let i be the probability of taking a value, j be the number of the population size, j be the number of the candidate monitoring point, and e be the mathematical natural constant. Call the pseudo-random number generator to generate a random floating-point number that follows a distribution in the interval [0,1]. ,like Determine that the current random event has occurred, and set the corresponding binary bits. Set to 1, if Determine that the current random event has not occurred; set the corresponding binary bits. Set to 0.

[0019] Preferably, step S3 specifically includes the following sub-steps: Step S31: Standardize the subset of monitoring points to obtain the global feature monitoring matrix, construct the first neural network model, input the global feature monitoring matrix into the first neural network model, output the set of hierarchical probability distributions, traverse the set of hierarchical probability distributions, and select the corresponding level with the highest probability value as the first positioning level. The first neural network model is a fully connected neural network. The number of output layer nodes is equal to the number of layers in the hierarchical topology model. The number of coarse nodes corresponds to the physical layer, virtualization layer, service layer and interface layer in the hierarchical topology model. The probability value of a fault occurring at each layer is calculated using the Softmax function. Step S32: Construct a second neural network model. The second neural network model includes a physical layer sub-model, a virtualization and operating system layer sub-model, a middleware and platform layer sub-model, and an application logic layer sub-model. Based on the first positioning level, extract the feature subset corresponding to the global feature monitoring matrix in the attributes of the first positioning level as the first sub-vector. The first sub-vector is the sub-vector of the corresponding level feature. Input the first sub-vector into the second neural network model and use the Softmax function to calculate the failure probability of the first positioning level component. Step S33: Preset confidence threshold. When the failure probabilities output by the second neural network model are all lower than the confidence threshold, trigger the backtracking correction mechanism, return to step S31 to remove the current level, select the level with the second highest probability, and re-execute step S32 to obtain the failure probabilities of each computer component.

[0020] Preferably, step S33 further includes: Obtain the fault probability output in step S32, and extract the maximum value of the fault probability; If the maximum value is greater than the confidence threshold, the current fault location is determined to be valid, and the identifier corresponding to the fault probability is output as the fault location result. If the maximum value is less than the confidence threshold, it is determined that there is a misjudgment at the first positioning level, and a backtracking correction mechanism is executed: Call the probability distribution set in step S31, reset the probability value corresponding to the currently traversed level to 0, update the probability distribution set, and reselect the level with the largest probability value as the new first positioning level; Jump to step S32. Based on the new first positioning level, extract the feature subset corresponding to the global feature monitoring matrix in the first positioning level attribute as the first sub-vector. Input the first sub-vector into the second neural network model and use the Softmax function to calculate the failure probability of the first positioning level component. Repeat the above process. When the maximum value of the fault probability is greater than the confidence threshold, stop the loop and output the identifier corresponding to the fault probability as the fault location result. When all levels have been traversed and the confidence threshold is still not met, output the component with the highest probability among all traversal results as the suspected fault point and mark it as a low confidence state.

[0021] Preferably, step S4 includes the following sub-steps: Step S41: Obtain the failure probability of each computer component and sort them in descending order. Set a failure hazard threshold and divide the sorted failure probabilities into failure response levels to obtain a three-level response queue. The three-level response queue includes a high-priority emergency queue, a general inspection queue, and a silent monitoring queue. Step S42, set up the diagnostic scheduler: traverse the high-priority emergency queue, match the pre-set deep probing scripts according to the component's identity data, and generate deep probing instructions. The deep probing instructions include enabling the full log stream, triggering memory stack dump, and executing SQL execution plan analysis. Traverse the ordinary inspection queue to generate maintenance detection instructions. The maintenance detection instructions include port connectivity testing and basic resource indicator polling. Through a distributed message middleware, encapsulate the deep probing instructions and maintenance detection instructions into message packets, and route them to the corresponding lightweight collection agent for execution according to the component ID.

[0022] Preferably, the processing logic for classifying the fault response levels based on the sorted fault probabilities is as follows: A fault risk threshold is set, which includes a first threshold and a second threshold, when the fault probability... When the first threshold is reached, the component identifier corresponding to the failure probability is added to the high-priority emergency queue. When the second threshold Failure probability When the first threshold is reached, the component identifier corresponding to the failure probability is added to the ordinary inspection queue. When the probability of failure When the second threshold is reached, the component identifier corresponding to the failure probability is added to the silent monitoring queue. The beneficial effects of this invention are as follows: Addressing the technical pain points of existing large-scale distributed computer systems in end-to-end monitoring and fault root cause localization, such as high data acquisition overhead, low localization accuracy, and scheduling lag, this invention resolves the contradiction between full data acquisition and system performance, achieving adaptive and lightweight configuration of monitoring resources. Traditional monitoring solutions often struggle to balance the business interruption caused by full data acquisition with the fault underreporting caused by sampling monitoring. This invention innovatively introduces a monitoring point optimization mechanism based on an improved RCO (Resource Cost of Operations). By constructing a dual-objective fitness function of fault coverage and resource overhead, the algorithm is forced to automatically avoid high-cost nodes with huge overhead but small marginal benefits during the search process. Simultaneously, this invention utilizes an sigmoid transfer function to discretize and improve the continuous RCO algorithm, and introduces a dual verification mechanism of safety circuit breaking and load circuit breaking to ensure that the deployment of monitoring probes does not interfere with the normal operation of the business system. Considering the large number of components and complex dependencies in modern computer systems, this invention abandons the traditional end-to-end large model scheme and designs a cascaded neural network architecture for hierarchical localization and component localization. The system quickly identifies the logical level at which the fault occurs through the first network, and then activates the second-level sub-model specific to that level for fine-grained inference. This strategy significantly reduces the input dimension of the neural network and eliminates cross-level noise features. This invention introduces a confidence-based backtracking correction mechanism. When the initial level of localization is questionable, the system can automatically backtrack and explore the second-best level, effectively solving the problem of failure due to misjudgment of a single model and significantly improving the localization fault tolerance rate in complex fault scenarios. By constructing a fault priority scheduling queue, the system can dynamically generate differentiated diagnostic instructions based on the probability of the fault and implement a hierarchical scheduling strategy to accurately concentrate diagnostic resources on a few suspected fault points, thereby improving diagnostic efficiency. Attached Figure Description

[0023] Figure 1 The flowchart illustrates the steps of a method for rapid computer fault location according to an embodiment of the present invention. Detailed Implementation

[0024] To make the above-mentioned objects, features and advantages of the present invention more apparent and understandable, the specific embodiments of the present invention will be described in detail below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0025] Example, refer to Figure 1 This paper provides a method for rapid computer fault location, which includes the following steps: Step S1: Obtain global monitoring data of the target computer, perform hierarchical topology modeling on the target computer to obtain a hierarchical topology model, and construct a set of candidate monitoring points and node data based on the hierarchical topology model; Step S2: Use the RCO algorithm to perform optimization and location calculations on the monitoring point set and node data to obtain a subset of monitoring points; Step S3: Construct a hierarchical fault location model based on the hierarchical topology model and a subset of monitoring points, and perform backtracking hierarchical location on the global monitoring data to obtain the fault probability of each computer component. Step S4: Construct a diagnostic scheduler based on the failure probability of each computer component, distribute it to each monitoring point, and generate a fault priority scheduling queue in a closed loop.

[0026] Step S1 includes the following sub-steps: Step S11: Deploy a lightweight data acquisition agent on the target computer, call the configuration management database interface of the target computer, and obtain the global monitoring data of the target computer. The global monitoring data includes operating system data, application log data, network connection data, and application performance data. Step S12: Based on the call relationships and corresponding timestamp synchronization information in the global monitoring data, a layered topology model is constructed using graph theory. The layered topology model is a directed acyclic graph and is divided into physical layer, virtualization layer, service layer and interface layer from bottom to top. Each node of the directed acyclic graph is a component of the target computer, and the edges of the directed acyclic graph point to the data flow between each component. The components of the target computer include physical components, virtualization and operating system components, middleware and platform layer components, and application logic components; Step S13: Traverse all nodes in the hierarchical topology model, perform multimodal interface probing on each node, and extract a set of candidate monitoring points. Multimodal interface probing includes: When a node can respond to the preset monitoring protocol command, it is determined that the current node has the ability to send data back and is regarded as a node with data transmission. The circuit breaker mechanism is further used to mark the nodes with data transmission and obtain node labels. The node labels include observable and unobservable. The node labels are traversed, and the nodes with observable labels are extracted as candidate monitoring points to generate a set of candidate monitoring points. The identity data, access protocol data, resource overhead data, and circuit breaker status data of candidate monitoring points in the hierarchical topology model are determined and used as node data; Identity data includes identifiers, component categories, hierarchical levels, upstream nodes, and downstream nodes; Access protocol data includes access endpoints, collection protocol types, and permission indexes; Resource overhead data includes computing overhead, network overhead, storage overhead, and path coverage center data; The circuit breaker status data includes a comprehensive pressure index and node labels.

[0027] As one embodiment of the present invention, a lightweight data acquisition agent is deployed in each physical node and virtualization container of the target computer. The lightweight data acquisition agent is configured to operate in daemon mode and acquires data in kernel mode without locking by extending Berkeley packet filtering technology. At the same time, the system calls the existing configuration management database interface of the target computer to synchronize static asset information and obtain global monitoring data, specifically including: Operating system data: CPU utilization, memory page swapping frequency, disk I / O throughput, and number of file handles; Application log data: standard output log, error stack log, system syslog, and security audit log; Network connection data: TCP / UDP connection status, network packet loss rate, and RTT round-trip time; Application performance data: HTTP response status codes, API response times, and distributed tracing data associated with Trace IDs; Then, step S12 is executed, which uses graph theory algorithms to construct a hierarchical topology model based on global monitoring data. First, by utilizing the source IP and destination IP mapping relationship in the call chain data, as well as timestamp synchronization information, the dependency direction between components is identified, and a set of directed edges is constructed. Secondly, the node set Based on logical attributes, it is divided into four levels from bottom to top, forming a directed acyclic graph structure: Physical layer: physical server chassis, switch ports, power modules; Virtualization and operating system layer: virtual machines, Kubernetes Pods, Docker containers, host operating system kernel; Middleware and platform layer: Database instance (MySQL), message queue topic (Kafka), cache node (Redis); Application logic layer: microservice modules, RPC interfaces, RESTful API endpoints; The edges of a directed acyclic graph (DAG) precisely point to the direction of data flow. For example, the API node in the "application logic layer" points to the database node in the "middleware layer," representing the data flow of SQL query requests.

[0028] The number of nodes contained in the candidate monitoring point set is recorded as the total number of monitorable components in the system; It should be noted that the term "target computer" in this specification should not be limited to a single physical computer terminal. It should be understood to include, but is not limited to: personal computers, servers, workstations, embedded devices, and distributed clusters, cloud computing environments, or edge computing nodes consisting of multiple computer devices. Components refer to any physical parts or logical software blocks in the above systems that can generate status data, performance indicators, or log information.

[0029] The circuit breaker mechanism is used to mark nodes with feedback, specifically including: Security circuit breaking based on dynamic trust scoring and load circuit breaking based on multi-dimensional resource pressure are used to determine all nodes with backhaul and obtain the first state and the second state. The first state is a secure isolation state, and the second state is a high resource load state. Security circuit breaker processing based on dynamic trust scoring includes: A dynamic trust score is initialized for all backhaul nodes. The behavior dimensions of backhaul nodes within a preset historical time window are monitored in real time. The behavior dimensions include diagnostic task response failure rate, security threat log records and configuration violations. When the behavior dimensions of a backhaul node in the current historical time window exceed the preset behavior threshold, the dynamic trust score of the current node is deducted. Nodes with backhaul nodes whose dynamic trust scores are lower than the security threshold are determined to be in the first state, which is the security isolation state. Load circuit breaker handling based on multidimensional resource pressure includes: The utilization rates of key resources with backhaul nodes are collected. Key resources include CPU, memory, and disk I / O. The dynamic baseline range of each key resource is calculated based on a time series model. Based on the deviation of the current key resource utilization rate from the dynamic baseline range, the degree of deviation of a single resource is calculated.

[0030] in, Let be the deviation of the r-th resource. Let r be the current utilization rate of the r-th resource. Let r be the upper limit of the dynamic baseline range for the r-th resource. The maximum value of resource r, when Less than hour, =0, where r is the ID of the critical resource. , The comprehensive stress index of a node is calculated using a resource contention penalty factor. The expression for the comprehensive stress index is as follows:

[0031] in, The overall stress index, Let be the weight coefficient corresponding to the r-th resource. To compete for resources, use penalty factors. It is a Boolean indicator variable; When the overall pressure index is greater than the dynamic pressure threshold or the utilization rate of any key resource exceeds the absolute safety threshold, and the duration is greater than twice the historical time window, the current node with feedback will be determined to be in the second state. When a node with a return message is not in the first state or the second state at the same time, the node with the return message will be marked as observable. When a return node is in either the first or second state, the node with the return node will be labeled as unobservable.

[0032] In this embodiment, the operating system kernel interface is invoked to collect the processing unit blocking parameters, storage swapping blocking parameters, and input / output wait parameters of the target node in real time. The processing unit blocking parameters are the system average load value and the process context switching frequency. The storage swapping blocking parameters are the memory page miss rate and the swap partition read / write frequency. The input / output wait parameters include the percentage of time the CPU is in the I / O wait state.

[0033] The system average load is divided by the total number of logical CPU cores to obtain the processing unit saturation; the swap partition read / write frequency and memory page miss rate are weighted and summed, and then divided by the preset memory throughput limit to obtain the storage swap saturation; the percentage of time the CPU spends in I / O wait state is directly extracted as the I / O saturation. Constructing a contention penalty factor based on a nonlinear mapping: Based on preset contention severity weights, the processing unit saturation, storage exchange saturation, and I / O saturation are normalized and weighted summed to obtain the original contention value. The original contention value is then mapped using an exponential amplification function to obtain the final resource contention penalty factor. The exponential amplification function is as follows:

[0034] in, To handle cell saturation, To achieve storage exchange saturation, For I / O saturation, The sensitivity coefficient, The result is the original contention value (resource overhead data), which is preferably set to [value] in this embodiment. =0.5, =0.3, =0.2, =0.5 means the CPU has the greatest impact, and the exponential amplification function is configured as follows: The preferred setting is a preset safety baseline of 0.8 and a sensitivity coefficient. The preset safety baseline is 0.5, which represents the upper limit of resource saturation of the computer when there is no obvious contention. When the original contention value is less than 0.8, the calculated resource contention penalty factor is approximately equal to 0, which does not affect the overall stress index. When the original contention value rises above the preset safety baseline, the resource contention penalty factor will increase rapidly, realizing the rapid triggering of the circuit breaker. The Boolean indicator variable is generated such that when the contention penalty factor is greater than 0.1, it is determined that there is a substantial resource contention. =1, when the contention penalty factor is less than or equal to 0.1, it is judged as an occasional fluctuation, let =0; In this embodiment, the initial value of the dynamic trust score is set to 1.0. When the failure rate of the diagnostic task response exceeds the preset failure threshold, it is reduced by 0.1; when a security threat log is detected, it is reduced by 0.2; when a configuration violation is detected, it is reduced by 0.15; the security threshold is preferably set to 0.5; when a node has no violation behavior within 3-5 consecutive time windows, the trust score is restored to 0.05, up to a maximum of 1.0. Through the above calculations, this embodiment can convert kernel contention state into a mathematical penalty term and add it to the comprehensive stress index, thereby accurately identifying deadlock or thrashing states that cannot be detected by simply looking at CPU utilization, and marking the node as the second state accordingly.

[0035] Step S2 includes the following sub-steps: Step S21: Extract the candidate monitoring point set and node data, map the candidate monitoring point set to the position vector of the RCO algorithm, define the population size as N, and the position vector of each candidate monitoring point is the position of the potential monitoring point in the hierarchical topology model. Set the position vector of the i-th individual in the t-th iteration as... Where D is the total number of candidate monitoring points, the location vector is mapped using a discretization function to... The status, where 1 indicates that a monitoring point is deployed at this location, and 0 indicates that no monitoring point is deployed; Step S22: Construct a bi-objective fitness function. The bi-objective fitness function includes calculating fault coverage and resource overhead. The fault coverage is calculated based on the path coverage centrality of candidate monitoring points, and the resource overhead is calculated based on the resource overhead data of candidate monitoring points to obtain individual scalar values. Step S23: The position vector of each candidate monitoring point is iteratively updated using the RCO optimization algorithm to obtain the individual position vector; Step S24: Through the discretization mapping mechanism, the individual position vector is mapped to a binary state using the sigmoid transfer function to generate a subset of monitoring points; Step S25: Preset the number of iterations. When the number of iterations of the RCO optimization algorithm reaches the preset number of iterations, output a subset of monitoring points and output the binary vector corresponding to the individual with the highest fitness. Use the nodes with a value of 1 in the vector as the subset of monitoring points.

[0036] In this embodiment, step S21 first defines the solution space, sets the population size to N=50, and the encoding length D of each individual is equal to the total number of candidate monitoring points. Then, step S22 is executed to construct the bi-objective fitness function. in, Let be the binary position vector of the i-th individual. Path cover centrality in node data is an optimization weight attribute extracted in step S1, used to quantify the importance of the j-th node in the hierarchical topology graph, such as how many business links traverse the current node. This represents the sum of the coverage capabilities of all currently selected nodes. This is the sum of path cover centrality for all candidate nodes in the network, used to normalize the payoff value to the [0,1] interval. The resource overhead weight is a resource consumption indicator defined in step S1. For example, the weight of an eBPF collection point is 0.1 (low overhead), and the weight of a full log collection point is 0.8 (high overhead). This represents the current increase in total system load. This represents the total resource overhead of all candidate nodes across the entire network. , This is a weighting coefficient used to adjust the priority of fault coverage and resource overhead. In this embodiment, it is preferred to set it to... =0.7, =0.3, which makes the bi-objective fitness function more inclined to ensure the accuracy of fault location, while also taking into account the lightweight and low-overhead nature of the system, ultimately yielding the individual scalar value. ; Traditional monitoring strategies suffer from the dual problems of system lag caused by full data collection or missed fault reports due to sampling. This invention introduces a resource overhead penalty term, forcing the algorithm to automatically avoid high-cost nodes with high overhead but low benefits during the search process. This achieves adaptive lightweighting of the monitoring system, resolving the contradiction between full monitoring and system performance. By introducing path coverage centrality as a benefit weight, it can intelligently identify the intersection points of key business links in the hierarchical topology model. Even when only a small number of monitoring points are selected, it can ensure the observation coverage of core business flows and significantly improve the recall rate of fault location.

[0037] Step S23 also includes: The location vector of each candidate monitoring point is iteratively updated using the RCO optimization algorithm, including global exploration and local exploration. The calculation expression for global exploration is:

[0038] in, Let the position vector of the candidate monitoring points be the position vector after the (t+1)th iteration. Let be the position vector of the optimal candidate monitoring point in the t-th iteration. It is a random number. Environmental wind disturbance factor, Let be a random variable that follows a normal distribution; The calculation expression for local exploration is:

[0039] in, The convergence factor decreases with the number of iterations. It is a random number. To simulate the perturbation term of periodic local exploration actions, The location of the individual is randomly selected.

[0040] In this embodiment, step S23 simulates the natural behavior of the red-crowned crane to perform a global exploration iteration: In the early stages of iteration, wind interference factors were utilized. Perform a wide-area search. Follows a standard normal distribution Necessary random perturbations are introduced to prevent premature entrapment in a complex multimodal search space.

[0041] In the later stages of iteration, for individuals with high fitness, the algorithm simulates the periodic actions during courtship to conduct local exploration. An oscillating operator between [-1, 1] is generated, so that the individual does not approach the optimal solution in a straight line, but performs a fine search near the optimal solution along a spiral trajectory. The nonlinear approximation strategy greatly improves the solution accuracy of the algorithm in discrete combinatorial optimization problems.

[0042] The specific process of the discretization mapping mechanism is as follows: Using S-type transfer function Calculate the probability of each value in the location vector of consecutive candidate monitoring points:

[0043] in, Let i be the probability of taking a value, j be the number of the population size, j be the number of the candidate monitoring point, and e be the mathematical natural constant. Call the pseudo-random number generator to generate a random floating-point number that follows a distribution in the interval [0,1]. ,like Determine that the current random event has occurred, and set the corresponding binary bits. Set to 1, if Determine that the current random event has not occurred; set the corresponding binary bits. Set to 0.

[0044] In this embodiment, since the traditional RCO algorithm can only solve the extremum problem of continuous functions and cannot be directly applied to discrete combinatorial optimization scenarios, this invention improves the RCO algorithm by introducing the Sigmoid transfer function. This mathematically connects the continuous trend of candidate monitoring points with the selection probability, enabling the improved RCO algorithm to effectively globally optimize and filter for key fault location of computer monitoring points. Compared to deterministic threshold truncation (e.g., setting it to 1 if the value is greater than 0.5), the random competition strategy of this invention allows low-probability events to occur. Even if the probability of a monitoring point's value is only 0.2, the improved RCO algorithm still has a probability of selecting it. This mechanism effectively maintains population diversity in the early stages of iteration, helping the algorithm escape local optima and discover potential monitoring schemes. The nonlinear characteristics of the Sigmoid function make the convergence of the algorithm smoother in the later stages of iteration. As the threshold gradually increases, the probability of it being selected rises steadily, avoiding the violent oscillations in the solution space caused by the hard threshold, thus ensuring the stability and reliability of the final output subset of monitoring points.

[0045] Step S3 specifically includes the following sub-steps: Step S31: Standardize the subset of monitoring points to obtain the global feature monitoring matrix, construct the first neural network model, input the global feature monitoring matrix into the first neural network model, output the set of hierarchical probability distributions, traverse the set of hierarchical probability distributions, and select the corresponding level with the highest probability value as the first positioning level. The first neural network model is a fully connected neural network. The number of output layer nodes is equal to the number of layers in the hierarchical topology model. The number of coarse nodes corresponds to the physical layer, virtualization layer, service layer and interface layer in the hierarchical topology model. The probability value of a fault occurring in each layer is calculated using the Softmax function. Step S32: Construct a second neural network model. The second neural network model includes a physical layer sub-model, a virtualization and operating system layer sub-model, a middleware and platform layer sub-model, and an application logic layer sub-model. Based on the first positioning level, extract the feature subset corresponding to the global feature monitoring matrix in the attributes of the first positioning level as the first sub-vector. The first sub-vector is a sub-vector of the corresponding level feature. Input the first sub-vector into the second neural network model and use the Softmax function to calculate the failure probability of the first positioning level component. Step S33: Preset confidence threshold. When the failure probabilities output by the second neural network model are all lower than the confidence threshold, trigger the backtracking correction mechanism, return to step S31 to remove the current level, select the level with the second highest probability, and re-execute step S32 to obtain the failure probabilities of each computer component.

[0046] In a preferred embodiment of the present invention, firstly, a subset of monitoring points output in step S2 is obtained. The collected subset of monitoring points includes CPU utilization, response time, and network throughput. The subset of monitoring points is preprocessed using the Z-Score normalization formula to obtain a global feature monitoring matrix. A first-level neural network model is constructed, which is a fully connected network. The input layer receives the global feature monitoring matrix, and the output layer has four nodes, corresponding to the physical layer, virtualization and operating system layer, middleware and platform layer, and application logic layer in the hierarchical topology model, respectively. The global feature monitoring matrix is ​​input into the first-level neural network model, and the Softmax function is used to calculate the output layer probability distribution set. Step S32: Four parallel second-level neural network sub-models are pre-constructed. Based on the middleware and platform layers locked in step S31, the sub-models corresponding to the middleware and platform layers are automatically activated, and the other three sub-models are masked. From the global feature monitoring matrix, features related to the middleware layer (such as the number of database connections, message queue backlog, etc.) are extracted using the index mask to form the first sub-vector. The first sub-vector is input into the activated sub-model, and the failure probability of each component in this layer is calculated again using the Softmax function. For example, the calculation results are: MySQL instance A (0.45), Redis cache B (0.30), Kafka node C (0.25). Step S33: Preliminary confidence judgment system preset confidence threshold. The maximum probability value (0.45) output in step S32 is checked. Since 0.45 < 0.8, the confidence of the current positioning result is determined to be insufficient, triggering the backtracking correction mechanism (i.e., entering the process of step S33). If the maximum probability value is 0.85, the corresponding component is directly output. This invention employs the aforementioned technical solution to address the problem of the large number of components in high-dimensional computer systems. By constructing a cascaded architecture of first-level hierarchical localization and second-level component localization, the fault search space of the entire network is decomposed into smaller hierarchical internal spaces. Compared to directly classifying all components of the entire network at once, this invention significantly reduces the input dimension and computational load of the neural network, achieving rapid fault localization. By constructing dedicated sub-models for specific layers (such as the physical layer and application layer) in the second-level network, it is possible to utilize the fine-grained features unique to that layer (such as the first sub-vector) for training and inference, avoiding interference from physical layer noise and other factors on localization accuracy when the application layer experiences faults.

[0047] Step S33 also includes: Obtain the fault probability output in step S32, and extract the maximum value of the fault probability; If the maximum value is greater than the confidence threshold, the current fault location is determined to be valid, and the identifier corresponding to the fault probability is output as the fault location result. If the maximum value is less than the confidence threshold, it is determined that there is a misjudgment at the first positioning level, and a backtracking correction mechanism is executed: Call the probability distribution set in step S31, reset the probability value corresponding to the currently traversed level to 0, update the probability distribution set, and reselect the level with the largest probability value as the new first positioning level; Jump to step S32, extract the feature subset corresponding to the global feature monitoring matrix in the first positioning level attribute according to the new first positioning level, and input the first sub-vector into the second neural network model. Use the Softmax function to calculate the failure probability of the first positioning level component. Repeat the above process until the maximum value of the failure probability is greater than the confidence threshold or all levels have been traversed, then stop the loop; otherwise, output the component with the highest probability among all traversal results as the suspected failure point and mark it as a low confidence state.

[0048] Assuming that in the first localization, the maximum failure probability output in step S32 is 0.45 (corresponding to the middleware layer), and the system's preset confidence threshold is 0.8, then... If a misjudgment is determined in the first positioning layer (middleware layer), a backtracking operation is performed: the probability distribution set output in step S31 is called. Set the probability of the currently traversed middleware layer to 0, and the updated set becomes In the updated set, the system iterates again to find the maximum value, which is now 0.2, corresponding to the virtualization and operating system layer. This layer is marked as the new first location layer. The system jumps back to step S32, activates the virtualization and operating system layer sub-model, extracts features related to virtual machines and containers (such as memory page swapping rate and CPU contention value) from the global matrix to form a new first sub-vector, inputs the new vector into the sub-model, and calculates the failure probability of a certain Docker container node in this layer as 0.92. The system judges again, and now 0.92 > 0.8, which meets the termination condition. The system stops the loop, determines that the fault location is valid, and outputs the identifier (ID) of the Docker container node as the final fault location result. If the maximum probability is still lower than 0.8 after traversing all 4 layers, the system will output the component with the highest probability in all calculations and mark it with a low confidence label, prompting the operation and maintenance personnel to intervene manually. In complex computer failure scenarios, failure characteristics may be confused across different levels (e.g., network packet loss may manifest as application timeout). This invention, through a backtracking mechanism, can automatically backtrack and explore suboptimal levels when the location result of the first-level neural network is uncertain. This effectively solves the problem of location failure caused by misjudgment in the first-level neural network, significantly improving the fault tolerance rate of location. By setting a confidence threshold and a loop traversal mechanism, this invention can automatically complete the judgment correction and re-judgment actions without human intervention, avoiding the output of erroneous location results and ensuring that the optimal suspected fault point can still be given even in complex failure modes.

[0049] Step S4 includes the following sub-steps: Step S41: Obtain the failure probability of each computer component and sort them in descending order. Set the failure hazard threshold and divide the sorted failure probabilities into failure response levels to obtain a three-level response queue. The three-level response queue includes a high-priority emergency queue, a general inspection queue, and a silent monitoring queue. Step S42, set up the diagnostic scheduler: traverse the high-priority emergency queue, match the pre-set deep probing scripts according to the component's identity data, and generate deep probing instructions. Deep probing instructions include enabling full log streams, triggering memory stack dumps, and executing SQL execution plan analysis. Traverse the ordinary inspection queue to generate maintenance detection instructions. Maintenance detection instructions include port connectivity testing and basic resource indicator polling. Through a distributed message middleware, encapsulate the deep probing instructions and maintenance detection instructions into message packets, and route them to the corresponding lightweight collection agents for execution according to the component ID.

[0050] In this embodiment, the set of component failure probabilities output in step S3 is obtained and sorted in descending order. The first threshold is preferably set to 0.8, which means that the component has a very high probability of having experienced a serious failure that affects the business. The second threshold is preferably set to 0.3, which represents that there are abnormal signs in the component, but the failure has not yet been fully confirmed; The system's built-in diagnostic scheduler executes different operational logic based on the queue level: For high-priority emergency queues: The scheduler reads the component's identity data (e.g., component type is MySQL); the system automatically matches the pre-set deep probing script and generates deep probing instructions; Example of the instruction content is as follows: Database commands include: Action: "Explain_SQL", Target: "Slow_Query_Log" (execute SQL plan analysis); For Java applications, the instructions include: Action: "JStack", Target: "Full_Thread_Dump", (trigger memory stack dump), enabling evidence of the fault to be captured in the shortest possible time; For regular inspection queues: The scheduler generates lightweight maintenance inspection instructions: Example of the instruction content is as follows: Action: "Ping_Port", Target: "8080" (Port connectivity test) or Action: "Get_Metrics", Target: "CPU_Usage" (Basic metrics polling); This allows us to remain vigilant and prevent any abnormal deterioration, but avoid taking drastic measures to prevent impacting business operations. For silent monitoring queues: the scheduler does not generate any active probe commands, but only receives passive regular heartbeat packets; All generated instructions are encapsulated into standard binary message packets. Using a distributed message middleware (such as Kafka's partitioning mechanism), the instructions are precisely distributed to the edge nodes where the target components are located, with the component's unique ID as the routing key. The lightweight acquisition agent residing on the node parses the message packets and immediately executes the corresponding local system calls.

[0051] The logic for classifying fault response levels based on the sorted fault probabilities is as follows: Set a fault hazard threshold, which includes a first threshold and a second threshold, when the fault probability... When the first threshold is reached, the component identifier corresponding to the failure probability is added to the high-priority emergency queue. When the second threshold Failure probability When the first threshold is reached, the component identifier corresponding to the failure probability is added to the ordinary inspection queue. When the probability of failure When the second threshold is reached, the component identifier corresponding to the failure probability is added to the silent monitoring queue.

[0052] In this embodiment, a three-level partitioning strategy with dual thresholds is used to precisely concentrate deep diagnostic resources (high-priority emergency queue) on high-risk components, while only low-cost detection is performed on ordinary components. This ensures that core faults are not missed while reducing overall diagnostic overhead. By using a distributed message middleware for instruction distribution, the diagnostic decision center and the execution edge are decoupled. Even if a certain edge network experiences jitter, the instruction can be cached in the middleware and retried, ensuring the reliable delivery and execution of diagnostic tasks.

[0053] Those skilled in the art will understand that embodiments of the present invention can be provided as methods, systems, or computer program products. Therefore, the present invention can take the form of a completely hardware embodiment, a completely software embodiment, or an embodiment combining software and hardware aspects. Furthermore, the present invention can take the form of a computer program product implemented on one or more computer-usable storage media containing computer-usable program code. The storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as Static Random Access Memory (SRAM), Electrically Erasable Programmable Read-Only Memory (EEPROM), Erasable Programmable Read Only Memory (EPROM), Programmable Read-Only Memory (PROM), Read-Only Memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0054] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and are not intended to limit it. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can be made to the technical solutions of the present invention without departing from the spirit and scope of the technical solutions of the present invention, and all such modifications or substitutions should be covered within the protection scope of the present invention.

Claims

1. A method for rapid computer fault location, characterized in that, Includes the following steps: Step S1: Obtain global monitoring data of the target computer, perform hierarchical topology modeling on the target computer to obtain a hierarchical topology model, and construct a set of candidate monitoring points and node data based on the hierarchical topology model; Step S2: Use the RCO algorithm to perform optimization and location calculations on the monitoring point set and node data to obtain a subset of monitoring points; Step S3: Construct a hierarchical fault location model based on the hierarchical topology model and a subset of monitoring points, and perform backtracking hierarchical location on the global monitoring data to obtain the fault probability of each computer component. Step S4: Construct a diagnostic scheduler based on the failure probability of each computer component, distribute it to each monitoring point, and generate a fault priority scheduling queue in a closed loop. Step S2 includes the following sub-steps: Step S21: Extract the candidate monitoring point set and node data, map the candidate monitoring point set to the position vector of the RCO algorithm, define the population size as N, and the position vector of each candidate monitoring point is the position of the potential monitoring point in the hierarchical topology model. Set the position vector of the i-th individual in the t-th iteration as... Where D is the total number of candidate monitoring points, the location vector is mapped using a discretization function to... The status, where 1 indicates that a monitoring point is deployed at this location, and 0 indicates that no monitoring point is deployed; Step S22: Construct a bi-objective fitness function, which includes calculating fault coverage and resource overhead. The fault coverage is calculated based on the path coverage centrality of candidate monitoring points, and the resource overhead is calculated based on the resource overhead data of candidate monitoring points to obtain individual scalar values. Step S23: The position vector of each candidate monitoring point is iteratively updated using the RCO optimization algorithm to obtain the individual position vector; Step S24: Through the discretization mapping mechanism, the individual position vector is mapped to a binary state using the sigmoid transfer function to generate a subset of monitoring points; Step S25: Preset the number of iterations. When the number of iterations of the RCO optimization algorithm reaches the preset number of iterations, output a subset of monitoring points. Step S23 further includes: The location vector of each candidate monitoring point is iteratively updated using the RCO optimization algorithm, including global exploration and local exploration. The calculation expression for the global exploration is as follows: ； in, Let the position vector of the candidate monitoring points be the position vector after the (t+1)th iteration. Let be the position vector of the optimal candidate monitoring point in the t-th iteration. It is a random number. Environmental wind disturbance factor, Let be a random variable that follows a normal distribution; The calculation expression for the local exploration is: ； in, The convergence factor decreases with the number of iterations. It is a random number. To simulate the perturbation term of periodic local exploration actions, The location of the individual is randomly selected.

2. The method for rapid computer fault location as described in claim 1, characterized in that, Step S1 includes the following sub-steps: Step S11: Deploy a lightweight data acquisition agent on the target computer, call the configuration management database interface of the target computer, and obtain the global monitoring data of the target computer. The global monitoring data includes operating system data, application log data, network connection data, and application performance data. Step S12: Based on the call relationships and corresponding timestamp synchronization information in the global monitoring data, a layered topology model is constructed using graph theory. The layered topology model is a directed acyclic graph and is divided into a physical layer, a virtualization layer, a service layer, and an interface layer from top to bottom. Each node of the directed acyclic graph is a component of the target computer, and the edges of the directed acyclic graph point to the data flow between the components. The components of the target computer include physical components, virtualization and operating system components, middleware and platform layer components, and application logic components. Step S13: Traverse all nodes in the hierarchical topology model, perform multimodal interface detection on each node, and extract a set of candidate monitoring points. The multimodal interface detection includes: When a node can respond to a preset monitoring protocol command, it is determined that the current node has the ability to send data back and is regarded as a node with data transmission. The circuit breaker mechanism is further used to mark the node with data transmission to obtain node labels. The node labels include observable and unobservable. The node labels are traversed, and the nodes with the node labels being observable are extracted as candidate monitoring points to generate a set of candidate monitoring points. The identity data, access protocol data, resource overhead data, and circuit breaker status data of candidate monitoring points in the hierarchical topology model are determined and used as node data; The identity data includes identifiers, component categories, hierarchical levels, upstream nodes, and downstream nodes; Access protocol data includes access endpoints, collection protocol types, and permission indexes; Resource overhead data includes computing overhead, network overhead, storage overhead, and path coverage center data; The circuit breaker status data includes a comprehensive pressure index and node labels.

3. The method for rapid computer fault location as described in claim 2, characterized in that, The specific steps of using a circuit breaker mechanism to mark the nodes with feedback transmission include: Security circuit breaking based on dynamic trust scoring and load circuit breaking based on multi-dimensional resource pressure are used to determine all nodes with backhaul and obtain the first state and the second state. The first state is a secure isolation state, and the second state is a high resource load state; Security circuit breaker processing based on dynamic trust scoring includes: A dynamic trust score is initialized for all backhaul nodes. The behavior dimensions of the backhaul nodes within a preset historical time window are monitored in real time. The behavior dimensions include diagnostic task response failure rate, security threat log records, and configuration violations. When the behavior dimensions of the backhaul node in the current historical time window exceed the preset behavior threshold, the dynamic trust score of the current node is deducted. The backhaul nodes with dynamic trust scores lower than the security threshold are determined to be in the first state, which is the security isolation state. Load circuit breaker handling based on multidimensional resource pressure includes: The utilization rate of key resources of the backhaul nodes is collected. These key resources include CPU, memory, and disk I / O. The dynamic baseline range of each key resource is calculated based on a time series model. Based on the deviation of the current key resource utilization rate from the dynamic baseline range, the degree of deviation of a single-dimensional resource is calculated. ； in, Let be the deviation of the r-th resource. Let r be the current utilization rate of the r-th resource. Let r be the upper limit of the dynamic baseline range for the r-th resource. The maximum value of resource r, when Less than hour, =0, where r is the ID of the critical resource. ; The overall pressure index of a node is calculated using a resource contention penalty factor. The formula for calculating the overall pressure index is as follows: ； in, The overall stress index, Let be the weight coefficient corresponding to the r-th resource. To compete for resources, use penalty factors. It is a Boolean indicator variable; When the comprehensive pressure index is greater than the dynamic pressure threshold or the utilization rate of any key resource exceeds the absolute safety threshold, and the duration is greater than twice the historical time window, the current node with feedback will be determined to be in the second state. When the node with feedback is not in the first state or the second state at the same time, the node label of the node with feedback is marked as observable. When the node with feedback is in either the first state or the second state, the node label of the node with feedback is marked as unobservable.

4. The method for rapid computer fault location as described in claim 3, characterized in that, The specific process of the discretization mapping mechanism is as follows: Using S-type transfer function Calculate the probability of each value in the location vector of consecutive candidate monitoring points: ； in, Let i be the probability of taking a value, j be the number of the population size, j be the number of the candidate monitoring point, and e be the mathematical natural constant. Call the pseudo-random number generator to generate a random floating-point number that follows a distribution in the interval [0,1]. ,like Determine that the current random event has occurred, and set the corresponding binary bits. Set to 1, if Determine that the current random event has not occurred; set the corresponding binary bits. Set to 0.

5. The method for rapid computer fault location as described in claim 4, characterized in that, Step S3 specifically includes the following sub-steps: Step S31: Standardize the subset of monitoring points to obtain the global feature monitoring matrix, construct the first neural network model, input the global feature monitoring matrix into the first neural network model, output the set of hierarchical probability distributions, traverse the set of hierarchical probability distributions, and select the corresponding level with the highest probability value as the first positioning level. The first neural network model is a fully connected neural network. The number of output layer nodes is equal to the number of layers in the hierarchical topology model. The number of coarse nodes corresponds to the physical layer, virtualization layer, service layer and interface layer in the hierarchical topology model. The probability value of a fault occurring at each layer is calculated using the Softmax function. Step S32: Construct a second neural network model. The second neural network model includes a physical layer sub-model, a virtualization and operating system layer sub-model, a middleware and platform layer sub-model, and an application logic layer sub-model. Based on the first positioning level, extract the feature subset corresponding to the global feature monitoring matrix in the attributes of the first positioning level as the first sub-vector. The first sub-vector is the sub-vector of the corresponding level feature. Input the first sub-vector into the second neural network model and use the Softmax function to calculate the failure probability of the first positioning level component. Step S33: Preset confidence threshold. When the failure probabilities output by the second neural network model are all lower than the confidence threshold, trigger the backtracking correction mechanism, return to step S31 to remove the current level, select the level with the second highest probability, and re-execute step S32 to obtain the failure probabilities of each computer component.

6. The method for rapid computer fault location as described in claim 5, characterized in that, Step S33 further includes: Obtain the fault probability output in step S32, and extract the maximum value of the fault probability; If the maximum value is greater than the confidence threshold, the current fault location is determined to be valid, and the identifier corresponding to the fault probability is output as the fault location result. If the maximum value is less than the confidence threshold, it is determined that there is a misjudgment at the first positioning level, and a backtracking correction mechanism is executed: Call the probability distribution set in step S31, reset the probability value corresponding to the currently traversed level to 0, update the probability distribution set, and reselect the level with the largest probability value as the new first positioning level; Jump to step S32. Based on the new first positioning level, extract the feature subset corresponding to the global feature monitoring matrix in the first positioning level attribute as the first sub-vector. Input the first sub-vector into the second neural network model and use the Softmax function to calculate the failure probability of the first positioning level component. Repeat the above process. When the maximum value of the fault probability is greater than the confidence threshold, stop the loop and output the identifier corresponding to the fault probability as the fault location result. When all levels have been traversed and the confidence threshold is still not met, output the component with the highest probability among all traversal results as the suspected fault point and mark it as a low confidence state.

7. A method for rapid computer fault location as described in claim 6, characterized in that, Step S4 includes the following sub-steps: Step S41: Obtain the failure probability of each computer component and sort them in descending order. Set a failure hazard threshold and divide the sorted failure probabilities into failure response levels to obtain a three-level response queue. The three-level response queue includes a high-priority emergency queue, a general inspection queue, and a silent monitoring queue. Step S42, set up the diagnostic scheduler: traverse the high-priority emergency queue, match the pre-set deep probing scripts according to the component's identity data, and generate deep probing instructions. The deep probing instructions include enabling the full log stream, triggering memory stack dump, and executing SQL execution plan analysis. Traverse the ordinary inspection queue to generate maintenance detection instructions. The maintenance detection instructions include port connectivity testing and basic resource indicator polling. Through a distributed message middleware, encapsulate the deep probing instructions and maintenance detection instructions into message packets, and route them to the corresponding lightweight collection agent for execution according to the component ID.

8. A method for rapid computer fault location as described in claim 7, characterized in that, The logic for classifying fault response levels based on the sorted fault probabilities is as follows: Set a fault risk threshold, which includes a first threshold and a second threshold. When the fault probability is greater than the first threshold, add the component identifier corresponding to the fault probability to the high priority emergency queue. When the failure probability is less than or equal to the first threshold and greater than the second threshold, the component identifier corresponding to the failure probability is added to the ordinary inspection queue. When the failure probability is less than or equal to the second threshold, the component identifier corresponding to the failure probability is added to the silent monitoring queue.

Images