Question and answer method and system about system state based on large model

Abstract

The invention provides a system state-related question answering method and system based on a large model, and relates to the technical field of intelligent question answering, and the large model is utilized to execute the following steps: obtaining a system state question expressed by a natural language; performing intention recognition and entity extraction on the system state problem, and generating a structured instruction containing a task intention and an entity parameter; based on the structured instruction, querying a knowledge graph to obtain a component topological relation, index metadata or a fault association rule related to entity parameters; according to the query result of the knowledge graph and the structured instruction, planning and executing a corresponding data processing task; and performing reasoning analysis on the task execution result to generate a natural language answer or a visual chart containing an analysis conclusion. According to the method, a large model is combined with system operation and maintenance, system state query, performance diagram generation and fault information collection are realized through natural language questions and answers, and the operation and maintenance efficiency is greatly improved.

Description

Technical Field

[0001] This invention relates to the field of intelligent question answering technology, specifically to a question answering method and system based on a large model regarding system state. Background Technology

[0002] With the rapid development of information technology, enterprise IT systems are becoming increasingly complex, typically comprising multiple components such as hosts, databases, middleware, and applications. System maintenance personnel need to monitor the operational status, performance indicators, and fault information of each component in real time to ensure stable system operation. Currently, system status queries mainly rely on monitoring tools (such as Zabbix and Prometheus) and command-line operations, performance graph generation requires manual configuration using specialized tools (such as Grafana), and fault information collection requires maintenance personnel to execute a series of commands and organize the data.

[0003] Although natural language interaction is gradually becoming an important way of human-computer interaction, its application in system status monitoring is immature, mainly due to the following defects and shortcomings: I. Low efficiency in interaction and acquisition Existing tools rely on specialized syntax or complex interfaces, resulting in high operational barriers and cumbersome steps; moreover, information is scattered across different platforms, making status queries, chart generation, and fault data integration time-consuming, labor-intensive, and slow to respond.

[0004] For example, existing monitoring tools require operations and maintenance personnel to master specific operating syntax or interfaces, making it difficult for non-professionals to use them quickly; performance graph generation requires manual configuration of data sources, time ranges, and indicator types, which is cumbersome; system status data is scattered across different tools (such as host monitoring, database monitoring, and application performance monitoring), requiring switching between multiple platforms for querying, resulting in high information integration costs; when a fault occurs, operations and maintenance personnel need to manually execute multiple commands to collect logs, performance indicators, and configuration information, which is time-consuming and may cause them to miss the best repair opportunity.

[0005] II. Insufficient intelligence and adaptive capabilities The system lacks natural language interaction capabilities and cannot understand ambiguous intentions or contexts; at the same time, it lacks a personalized adaptation mechanism, making it difficult to automatically optimize the way information is presented (such as charts and indicator combinations) according to different needs, resulting in poor flexibility.

[0006] For example, existing tools often rely on fixed commands or form inputs, cannot understand fuzzy queries (such as "Why has the database slowed down recently"), and lack flexibility; the format and metric combination of performance graphs need to be manually adjusted, and cannot automatically generate adapted views based on user roles (such as development, operations, and management).

[0007] In summary, existing technologies mainly rely on decentralized professional tools and manual operations, resulting in low efficiency in operation and maintenance interactions and a lack of intelligent natural language understanding and adaptive capabilities. Summary of the Invention

[0008] To address the aforementioned issues, this invention proposes a question-and-answer method and system based on a large model for system status. This method combines the large model with system operation and maintenance, and uses natural language question-and-answer to achieve system status query, performance graph generation, and fault information collection, thereby significantly improving operation and maintenance efficiency.

[0009] According to some embodiments, the present invention adopts the following technical solution: A question-answering method for system state based on a large model, which utilizes the large model to perform the following steps: The problem of obtaining system state representations in natural language; The system status problem is subjected to intent recognition and entity extraction to generate a structured instruction containing task intent and entity parameters. The task intent includes system status query, performance graph generation or fault information collection. Based on the structured instructions, the knowledge graph is queried to obtain component topology relationships, indicator metadata, or fault association rules related to entity parameters; Based on the query results of the knowledge graph and the structured instructions, corresponding data processing tasks are planned and executed. The data processing tasks include: calling the data interface to obtain real-time monitoring data, calling the chart engine to generate performance visualization charts, and calling the preset script to collect fault information. Perform reasoning analysis on the task execution results and generate natural language responses or visualizations that include the analysis conclusions.

[0010] According to some embodiments, the present invention adopts the following technical solution: A question-answering system for system state based on a large model, comprising: The issue acquisition module is configured to: acquire system status issues expressed in natural language; The instruction generation module is configured to: perform intent recognition and entity extraction on the system status problem, and generate a structured instruction containing task intent and entity parameters, wherein the task intent includes system status query, performance graph generation or fault information collection; The knowledge query module is configured to: query the knowledge graph based on the structured instructions to obtain component topology relationships, indicator metadata, or fault association rules related to entity parameters; The task execution module is configured to: plan and execute corresponding data processing tasks based on the query results of the knowledge graph and the structured instructions. The data processing tasks include: calling the data interface to obtain real-time monitoring data, calling the chart engine to generate performance visualization charts, and calling the preset script to collect fault information. The results analysis module is configured to perform reasoning analysis on the task execution results and generate natural language answers or visualization charts containing the analysis conclusions.

[0011] According to some embodiments, the present invention adopts the following technical solution: A computer program product includes a computer program that, when executed by a processor, implements the aforementioned question-and-answer method for system state based on a large model.

[0012] According to some embodiments, the present invention adopts the following technical solution: A non-transitory computer-readable storage medium is provided for storing computer instructions, which, when executed by a processor, implement the aforementioned question-and-answer method for system state based on a large model.

[0013] According to some embodiments, the present invention adopts the following technical solution: An electronic device includes a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to perform a question-and-answer method for system state based on a large model.

[0014] Compared with the prior art, the beneficial effects of the present invention are as follows: This invention automatically transforms unstructured operational requirements into precise, executable instructions through natural language interaction and intelligent parsing. Leveraging the associative reasoning of knowledge graphs, it integrates multi-source heterogeneous data for in-depth analysis, ultimately outputting natural language reports or visual charts that incorporate intelligent judgments from large models. This significantly reduces the operational threshold, improves information integration efficiency, accelerates fault location, and generates in-depth insights that directly support decision-making. It achieves a one-stop question-and-answer system for complex system states, specifically manifested in: 1. Lowering the barrier to entry: By replacing complex commands with natural language interaction, non-professionals can quickly check the system status (such as "check the response time of the payment application") without having to learn professional tools.

[0015] 2. Information aggregation capability: Integrates multi-source monitoring data, avoids cross-platform queries, and supports correlation analysis (such as "analyzing whether high CPU usage on the host is caused by database table locking").

[0016] 3. Accelerated fault response: When a fault occurs, the information collection process is automatically triggered, and logs and performance indicators are collected and preliminarily analyzed within 10 seconds, shortening the fault location time.

[0017] 4. Personalized output: Automatically adjust the granularity of results based on user roles (e.g., show trend charts to management and detailed metrics to developers).

[0018] 5. Continuous evolution capability: Continuously optimize the large model through feedback data to improve the accuracy of intent recognition and the relevance of answers, and adapt to new components and new metrics after system iteration. Attached Figure Description

[0019] The accompanying drawings, which form part of this invention, are used to provide a further understanding of the invention. The illustrative embodiments of the invention and their descriptions are used to explain the invention and do not constitute an improper limitation of the invention.

[0020] Figure 1 This is a method architecture diagram for Example 1. Detailed Implementation The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0021] It should be noted that the following detailed descriptions are exemplary and intended to provide further illustration of the invention. Unless otherwise specified, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0022] It should be noted that the terminology used herein is for the purpose of describing particular embodiments only and is not intended to limit the scope of exemplary embodiments according to the invention. As used herein, the singular form is intended to include the plural form as well, unless the context clearly indicates otherwise. Furthermore, it should be understood that when the terms "comprising" and / or "including" are used in this specification, they indicate the presence of features, steps, operations, devices, components, and / or combinations thereof.

[0023] Example 1 One embodiment of the present invention provides a question-and-answer method for system state based on a large model, which utilizes the large model to perform the following steps: Step S1: Obtain the system state problem expressed in natural language; Step S2: Perform intent recognition and entity extraction on the system status problem to generate a structured instruction containing task intent and entity parameters. The task intent includes system status query, performance graph generation, or fault information collection. Step S3: Based on the structured instructions, query the knowledge graph to obtain component topology relationships, indicator metadata, or fault association rules related to entity parameters; Step S4: Based on the query results of the knowledge graph and the structured instructions, plan and execute the corresponding data processing tasks, which include: calling the data interface to obtain real-time monitoring data, calling the chart engine to generate performance visualization charts, and calling the preset script to collect fault information; Step S5: Perform reasoning analysis on the task execution results and generate natural language answers or visualization charts containing the analysis conclusions.

[0024] As one embodiment, the present invention provides a question-and-answer method for system status based on a large model, which combines the large model with system operation and maintenance. It realizes system status query, performance graph generation and fault information collection through natural language question and answer, which greatly improves operation and maintenance efficiency. The specific implementation process is described below.

[0025] This embodiment provides a question-answering framework for system state based on a large model, including 6 core modules, and the overall architecture is shown in the figure: 1. User Interaction Module It accepts natural language input from users (such as text or voice) and returns structured results (text, charts, documents, etc.); it supports access from multiple terminals (Web, mobile, instant messaging tools).

[0026] 2. Intent Recognition and Parsing Module 2.1 Core Functions of the Module The intent recognition and parsing module is the semantic understanding hub, responsible for converting the natural language (text or speech-to-text) input by the user into structured instructions that can be executed by the machine. Its core objective is to accurately identify user intent (such as querying status, generating performance graphs, and collecting fault information) and extract key entity parameters (such as component type, time range, and indicator type), providing clear task boundaries and data dimensions for the subsequent large model inference module.

[0027] 2.2 Technical Architecture and Implementation Details This module is built upon fine-tuned large language models (such as LLaMA-2, GPT-3.5-turbo, etc.) and contains three sub-modules: 2.2.1 Intent Classification Submodule Categorize the user-input questions to determine which of the three core intents they belong to: Category 1: System status query (e.g., "Is database db-01 currently functioning correctly?"); The second category: performance graph generation (e.g., "Generate memory usage graph for host server-02 over the past 7 days"); The third category: Fault information collection (such as "collecting fault data of the app-login application 1 hour ago").

[0028] Specifically, a "pre-training + fine-tuning" approach is adopted. Based on an open-source large model, it uses 100,000+ labeled operation and maintenance intent samples (including typical questions of three types of intents) for fine-tuning. The intent probability is output through Softmax classification, and the highest probability is taken as the final intent.

[0029] Based on probability recognition, it supports fuzzy intent processing. If the intent probability is lower than the threshold (e.g., 0.7), it automatically generates follow-up questions (e.g., "Do you need to query the status or generate a performance graph?").

[0030] 2.2.2 Entity Extraction Submodule Extract key entities from user questions, including: (1) Component-related: type (host / database / middleware / application), name (e.g., "server-01", "mysql-prod"); (2) Time-related: start time (e.g., "yesterday at 8 o'clock"), end time (e.g., "today at 12 o'clock"), time range (e.g., "past 24 hours"); (3) Metrics related: performance metrics (such as "CPU utilization" and "disk I / O"), fault dimensions (such as "logs" and "thread stacks").

[0031] Specifically, based on Named Entity Recognition (NER) technology, the BIO annotation method (B - start, I - middle, O - non-entity) is used to annotate the samples, and the model is trained to recognize specific entity types (such as [component type: database, component name: db-01]).

[0032] After extracting entities, they are verified using the knowledge graph and compared with the component list and indicator metadata in the knowledge graph. If there are unmatched entities (such as the misspelling "sever-01"), error correction is automatically triggered (such as "Does this refer to server-01?").

[0033] 2.2.3 Ambiguity Resolution Submodule To handle ambiguous expressions or missing information, ensure the uniqueness and completeness of instructions. For example, if a user enters "Check which application has a problem", the "application name" and "the time of the problem" must be specified.

[0034] Specifically, based on contextual semantic reasoning, the referential relationships in the question (such as "it" and "that") are analyzed, and information is supplemented by combining historical dialogue records.

[0035] Dynamic follow-up questions are generated. If key entities are missing (e.g., no time range is specified), the large model automatically generates structured follow-up questions (e.g., "Please provide the time range you need to query (e.g., the past hour / today)") until the information is complete.

[0036] 3. Knowledge Graph Module 3.1 Core Functions The knowledge graph module is used to build and store a structured knowledge network related to system operation and maintenance, enabling unified management and efficient querying of information such as system components, performance indicators, fault cases, and topology relationships. Its core functions include: (1) Define the entity types and attributes in the operation and maintenance domain (e.g., the "host" entity includes attributes such as IP, CPU model, and cluster to which it belongs). (2) Establish relationships between entities (e.g., “Host A” runs “Application B”, “Application B” depends on “Database C”); (3) Experience-based knowledge such as storage metric baselines and fault rules (e.g., "database connection count > 1000" may cause "application response delay"); (4) Supports efficient semantic querying and relational reasoning (such as tracing possible related "database performance" or "network bandwidth" issues through "application response latency").

[0037] 3.2 Components of a Knowledge Graph The knowledge graph of this module consists of four parts: Entity, Relation, Attribute, and Rule, as detailed below: (1) Entity The system contains independently identifiable operation and maintenance objects (components, metrics, faults, etc.). For example, component entities include: host (server-01), database (db-01), application (app-pay), and middleware (tomcat-01); metric entities include: CPU utilization, memory usage, database connection count, and JVM heap memory; and fault entities include: database deadlock, application OOM, and network timeout.

[0038] (2) Relation The relationship type between entities describes "who has what kind of relationship with whom", including the following relationships: Inclusion relationships, for example, host server-01 "runs" the application app-pay; Dependencies, for example, the application app-pay depends on the database db-01; Indicator attribution, for example, CPU utilization "belongs" to host server-01; Fault correlations, for example, database deadlocks "cause" application response delays.

[0039] (3) Attribute The characteristics or parameters of an entity are used to describe the specific information of the entity. For example, host attributes: IP=192.168.1.101, number of CPU cores=32, normal load threshold<70%; indicator attributes: CPU utilization "unit"=percentage, "normal range"=0-80%; fault attributes: database deadlock "common cause"=SQL without index, "resolvement steps"=optimize SQL + add index.

[0040] (4) Rules Logical judgments based on historical experience or expert knowledge (used for reasoning), for example, if "database connection count > 1000" and "application response time > 500ms", then "connection pool exhaustion" may occur; if "host CPU utilization > 90% for 5 minutes", then "CPU overload alarm" will be triggered.

[0041] 3.3 Construction and Update Mechanism (1) Initialization and construction Import system component information (host, database, application name, IP, deployment path, etc.) from CMDB (Configuration Management Database) to generate basic entities.

[0042] Import metric metadata (metric name, unit, normal threshold) from a monitoring system (such as Prometheus) to establish the attribution relationship between metrics and components.

[0043] Enter historical failure cases (failure symptoms, related indicators, and solutions) to form failure entities and related rules.

[0044] Use topology discovery tools (such as Zabbix auto-discovery) to supplement the dependencies between components (such as the call relationship between the application and the database).

[0045] (2) Dynamic updates Real-time synchronization of CMDB changes (such as adding hosts, migrating applications), and automatic updating of entity attributes and relationships; Based on user feedback and new failure cases, the rule base is updated regularly (such as adding a related rule for "Redis cache penetration causing a sudden increase in database pressure"). The entity relationship weights are iteratively adjusted based on the labeled data collected by the feedback optimization module (such as "misassociation indicators" corrected by users). These weights are mainly applied to key processes such as intent parsing, inference decision-making, and fault root cause localization to optimize the accuracy of intent recognition and parsing, improve the association analysis efficiency of the large model inference module, and optimize the scope and priority of fault information collection.

[0046] 3.4 Technical Implementation (1) Storage selection: Use graph databases (such as Neo4j and JanusGraph) to store knowledge graphs, which support efficient node query and relation traversal (compared to traditional relational databases, graph databases have a performance improvement of more than 10 times in multi-hop relation queries). (2) Query interface: Provide SPARQL or Cypher query interface to support semantic queries (such as "query all applications that depend on db-01" or "find possible indicators that cause app-pay response delay"). (3) Inference Engine: Integrate rule-based inference engine (such as Drools) to perform correlation inference based on preset rules (such as inferring "the connection pool may be insufficient" when "the application response is delayed" and "the number of database connections exceeds the limit").

[0047] 3.5 Application Scenarios In the system, the knowledge graph module runs through the entire process of "user interaction → intent parsing → reasoning execution", and its specific applications are as follows: (1) Assisted Intent Recognition and Parsing Module: Improves the Accuracy of Semantic Understanding Entity disambiguation: When a user inputs a vague statement (such as "check the status of that database"), the knowledge graph helps determine the entity as "db-01" through contextual association (such as the user has previously queried db-01, and db-01 is currently the only online database); Missing information completion: If the user does not specify indicators (such as "generate performance graph of server-01"), the knowledge graph will automatically complete the indicator list based on the default indicator attributes of the "host" entity (such as CPU, memory, disk I / O) to avoid invalid follow-up questions; Intent validation: When a user inputs an unreasonable request (such as "query the JVM heap memory of the database"), the knowledge graph determines that there is no relationship between "database" and "JVM metrics". The auxiliary module identifies the error and prompts the user (such as "JVM metrics belong to application / middleware, do you want to query the number of database connections?").

[0048] (2) Support for large model inference module: enhancing decision-making and analytical capabilities Association analysis of status queries: When a user queries "Why is app-pay slow to respond?", the large model inference module queries the dependency relationship of "app-pay" (depending on db-01 and redis-01) through the knowledge graph, and at the same time obtains the correlation indicators (the number of connections of db-01 and the hit rate of redis-01), and combines real-time data to determine whether it is caused by the abnormality of the dependent components. Metrics filtering for performance graph generation: When generating "cross-component performance graphs" (such as "displaying the correlation metrics between app-pay and db-01"), the knowledge graph provides the dependencies between the two and key correlation metrics (such as the response time of app-pay and the number of slow queries in db-01) to ensure that the graph displays meaningful correlation data; Determining the scope of fault information collection: When collecting "fault information of app-pay", the knowledge graph automatically expands the collection scope based on the relationship between "app-pay and db-01" (not only collecting app-pay's logs, but also supplementing db-01's slow query logs and connection count metrics) to avoid missing root cause data; Fault root cause reasoning: By combining fault rules in the knowledge graph (such as "OOM faults are often associated with JVM heap memory configuration and GC logs"), the large model can quickly locate key clues when analyzing fault data (such as filtering the keyword "OutOfMemoryError" from the collected JVM logs).

[0049] (3) Optimize user interaction experience: provide personalized and accurate feedback Personalized metrics display: Based on the user role (such as "developer"), the knowledge graph provides entity attributes that the role is interested in (such as the thread stack and SQL execution plan of the application that developers are more concerned with), making the returned results more relevant to the needs. Accuracy of anomaly labeling: When generating performance graphs, knowledge graphs provide normal thresholds for metrics (such as "CPU utilization is within the normal range of 0-80%)", and large models use this information to accurately label abnormal periods that exceed the thresholds (such as "CPU utilization reaches 90% from 14:00 to 15:00, which is outside the normal range"). Recommended historical cases: When a user queries "how to resolve db-01 deadlock", the knowledge graph matches the "resolution steps" attribute of the "database deadlock" entity and returns historically verified solutions (such as "execute show processlist to find the SQL that locks the table, kill the corresponding process and then optimize the index").

[0050] 4. Data Access and Conversion Module This module acts as a "data transporter and standardization engineer" for the underlying raw data. It directly acquires all the underlying data and performs general transformations, focusing on "data accessibility" (making the scattered underlying data usable). This involves integrating multi-source monitoring data, including: 4.1 Real-time data: Connect to monitoring systems such as Prometheus and Zabbix via API to obtain metrics such as CPU, memory, and disk I / O; 4.2 Log Data: Integrate with the ELK stack to parse application logs and database slow query logs; 4.3 Configuration Data: Synchronize component topology relationships in the CMDB (Configuration Management Database). Convert unstructured data (such as logs) into a structured format and store it uniformly in a time-series database (such as InfluxDB).

[0051] 5. Large Model Inference Module 5.1 Core Functions of the Module The large-scale model inference module is the central hub for task execution. Based on the structured instructions output by the intent recognition and parsing module, it calls the underlying data interfaces and toolchain to complete three core tasks: system status query, performance graph generation, and fault information collection. It then transforms the results into user-understandable natural language or visualizations. Its core objective is to translate abstract user needs into concrete operational execution while ensuring the accuracy and readability of the results.

[0052] 5.2 Technical Architecture and Implementation Details This module is built upon fine-tuned large language models (such as LLaMA-2, GPT-3.5-turbo, etc.) and contains three sub-modules: 5.2.1 Task Planning Submodule Based on the structured instructions, break down the task steps and determine the tools / interfaces that need to be called.

[0053] Specifically, based on the "command-tool" mapping rule, three types of intents and tools are pre-defined (e.g., "status query" → time series database query interface; "performance graph generation" → ECharts engine; "fault information collection" → Shell script executor).

[0054] Complex tasks are decomposed into subtasks for requirements involving multiple metrics or cross-components (such as "analyzing the performance correlation between the host and the database"). These subtasks are automatically broken down into subtasks (first query host metrics → then query database metrics → finally perform correlation analysis).

[0055] 5.2.2 Data Processing and Inference Submodule The data processing and reasoning submodule acts as a "precise user + business analyst" of standardized data. It does not access the underlying raw data, but only retrieves standardized data as needed and processes it in conjunction with business logic. It focuses on the "business value of data" (making usable data solve specific user problems), performs specific data queries, analysis or collection operations, and generates results based on the semantic understanding capabilities of the large model.

[0056] Specifically, the system status query process includes: (1) Convert the “component, time, and metric” in the entity into a time series database query statement (e.g., PromQL: cpu_usage{instance="server-01"}[24h]); (2) Call the data access module to obtain the raw indicator data, and analyze whether the data is within the normal threshold through the large model (combined with the indicator baseline in the knowledge graph). (3) Generate natural language responses (e.g., “The peak CPU usage of host server-01 in the past 24 hours was 75% (threshold 80%), and the overall performance is normal”).

[0057] Performance graph generation process includes: (1) Extract standardized data (time stamp + indicator value) from the time series database according to the time range and indicator type. (2) Call the ECharts engine to generate visualization charts (line charts / bar charts), and mark outliers through a large model (e.g., "At 14:00 on October 26, memory usage suddenly increased to 90%, triggering an alarm"). (3) Output chart files (PNG / SVG) and accompanying text descriptions.

[0058] Fault information collection and processing includes: (1) Trigger the preset collection script according to the fault time and component type (e.g., call collect_mysql_fault.sh for database faults, call collect_app_logs.sh for application faults); (2) Scripts automatically execute commands (such as tail -n 1000 / var / log / app.log, jstack) <pid>), collect data such as logs, thread stacks, and network packets; (3) Based on the collected data, the large model matches historical failure cases in the knowledge graph to generate preliminary root cause analysis (such as "OutOfMemoryError appears in the log, which is suspected to be a memory leak").

[0059] 5.2.3 Result Optimization Submodule The generated results can be formatted and customized to improve the user experience.

[0060] Specifically, the results are formatted automatically based on the output type (text / chart / file), such as using Markdown for text and adding titles and axis descriptions to charts; personalized adaptation is achieved by adjusting the granularity of the results based on the user role (obtained through the user interaction module), such as displaying trend summaries to management and raw metrics and script execution logs to operations personnel; and exception handling is provided by generating user-friendly prompts for large models if data queries fail (e.g., the component does not exist), such as "middleware tomcat-01 not found, please check if the name is correct".

[0061] 6. Feedback Optimization Module Record user feedback on the results (e.g., "accurate" or "missing metrics"), and periodically fine-tune the large model using labeled data to optimize intent recognition accuracy and response quality.

[0062] Example 2 A specific implementation example is provided, including: Step 1: System Deployment and Initialization 1. Deploy the knowledge graph module and input system component information (such as host list, database instance, middleware type) and indicator metadata (such as indicator name, unit, normal threshold); 2. Configure the data access module to connect with the existing monitoring system (e.g., obtain metrics through the Prometheus API, and collect logs through Filebeat). 3. Based on open-source large models (such as LLaMA-2-7B), fine-tune them using labeled operation and maintenance Q&A data (100,000 entries) to generate a dedicated model.

[0063] Step 2: User Query Processing Flow For example, let's take "generating a trend chart of CPU usage and connection count for database db-01 over the past 3 days": 1. The user enters a question through the web interface, and the user interaction module transmits the text to the intent recognition module; 2. The intent recognition module parses the intent as "performance graph generation", and the entities include: component type = database, component name = db-01, time range = past 3 days, and metrics = CPU utilization and connection count; 3. Data access module: Based on entity information, calls the Prometheus API to query indicator data (time range: now-3 days to now). The large model inference module inputs data into the chart engine, generates a dual-axis line chart (X-axis represents time, Y-axis represents CPU utilization and number of connections respectively), and marks the time periods that exceed the threshold. 4. The user interaction module displays charts and returns text descriptions (such as "db-01 exceeded the threshold of 800 connections between 14:00 and 15:00 on June 10, and the CPU utilization rate rose to 70%").

[0064] Step 3: Fault Information Collection Process When a user enters "Collect fault information for the app-pay application from 10 minutes ago": 1. The intent recognition module determines the intent as "fault information collection", and the entities include: component type = application, component name = app-pay, time = 10 minutes ago; 2. The large model inference module calls the preset script: 2.1 Execute `journalctl -u app-pay --since "10 minutes ago" --until "5 minutes ago"` to collect application logs; 2.2 Call the JMX interface to obtain the current JVM heap memory and thread state; 2.3 Capture network packets at that time using tcpdump (lasting 1 minute); 3. The script compresses the collected files into app-pay_fault.zip and generates an analysis report (based on log keyword matching of historical fault cases). 4. The user interaction module returns a download link and a report summary.

[0065] Example 3 One embodiment of the present invention provides a question-answering system about system state based on a large model, comprising: The issue acquisition module is configured to: acquire system status issues expressed in natural language; The instruction generation module is configured to: perform intent recognition and entity extraction on the system status problem, and generate a structured instruction containing task intent and entity parameters, wherein the task intent includes system status query, performance graph generation or fault information collection; The knowledge query module is configured to: query the knowledge graph based on the structured instructions to obtain component topology relationships, indicator metadata, or fault association rules related to entity parameters; The task execution module is configured to: plan and execute corresponding data processing tasks based on the query results of the knowledge graph and the structured instructions. The data processing tasks include: calling the data interface to obtain real-time monitoring data, calling the chart engine to generate performance visualization charts, and calling the preset script to collect fault information. The results analysis module is configured to perform reasoning analysis on the task execution results and generate natural language answers or visualization charts containing the analysis conclusions.

[0066] Example 4 One embodiment of the present invention provides a computer program product, including a computer program that, when executed by a processor, implements the aforementioned question-and-answer method for system state based on a large model.

[0067] Example 5 In one embodiment of the present invention, a non-transitory computer-readable storage medium is provided for storing computer instructions, which, when executed by a processor, implement the aforementioned question-and-answer method for system state based on a large model.

[0068] Example 6 One embodiment of the present invention provides an electronic device, including: a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to implement the question-and-answer method for system state based on a large model.

[0069] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart illustrations and / or block diagrams. Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0070] These computer program instructions may also be loaded onto a computer or other programmable data processing equipment to cause a series of operational steps to be performed on the computer or other programmable equipment to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable equipment for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0071] While the specific embodiments of the present invention have been described above in conjunction with the accompanying drawings, this is not intended to limit the scope of protection of the present invention. Those skilled in the art should understand that various modifications or variations that can be made by those skilled in the art without creative effort based on the technical solutions of the present invention are still within the scope of protection of the present invention.< / pid>

Claims

1. A question-and-answer method for system states based on a large model, characterized in that, Perform the following steps using a large model: The problem of obtaining system state representations in natural language; The system status problem is subjected to intent recognition and entity extraction to generate a structured instruction containing task intent and entity parameters. The task intent includes system status query, performance graph generation or fault information collection. Based on the structured instructions, the knowledge graph is queried to obtain component topology relationships, indicator metadata, or fault association rules related to entity parameters; Based on the query results of the knowledge graph and the structured instructions, corresponding data processing tasks are planned and executed. The data processing tasks include: calling the data interface to obtain real-time monitoring data, calling the chart engine to generate performance visualization charts, and calling the preset script to collect fault information. Perform reasoning analysis on the task execution results and generate natural language responses or visualizations that include the analysis conclusions.

2. The question-and-answer method for system state based on a large model as described in claim 1, characterized in that, The intent recognition and entity extraction for the system state problem specifically includes: The natural language representation is classified into intents using a finely tuned domain-specific large language model. Key entities are extracted from the natural language representation based on named entity recognition technology. The key entities include at least one or more of the following: component type, component identifier, time range, and indicator type.

3. The question-and-answer method for system state based on a large model as described in claim 2, characterized in that, It also includes disambiguation based on the dialogue history context or entity relationships in the knowledge graph when the key entity is ambiguous or missing information, or generating interactive follow-up questions to request supplementary information from the user.

4. The question-and-answer method for system state based on a large model as described in claim 1, characterized in that, The query knowledge graph includes: Verify and correct the extracted entities; For the missing necessary entity parameters in the structured instructions, default values ​​based on context or domain common sense are provided; Based on the task intent and entity parameters, determine the cross-component data association query path, key performance indicator combination, or scope for automated collection of fault information.

5. The question-and-answer method for system state based on a large model as described in claim 1, characterized in that, The reasoning and analysis of the task execution results includes: The real-time monitoring data is compared with the normal threshold or baseline of the corresponding indicator obtained from the knowledge graph to automatically determine whether the system status is abnormal and generate a status summary. In the generated performance visualization chart, data anomalies and abnormal time periods are automatically marked, and explanatory descriptions are generated by associating them with relevant fault rules in the knowledge graph.

6. The question-and-answer method for system state based on a large model as described in claim 1, characterized in that, The generation of natural language responses containing analytical conclusions specifically includes: Based on the task intent and user role information, the level of detail and technical depth of the natural language response are dynamically adjusted. The user role information is either preset by the system or obtained from the user interaction context.

7. A question-and-answer system for system states based on a large model, characterized in that, The method for question-and-answering about system state based on a large model, as described in any one of claims 1-6, includes: The problem acquisition module is configured to: acquire system status problems expressed in natural language; The instruction generation module is configured to: perform intent recognition and entity extraction on the system status problem, and generate a structured instruction containing task intent and entity parameters, wherein the task intent includes system status query, performance graph generation or fault information collection; The knowledge query module is configured to: query the knowledge graph based on the structured instructions to obtain component topology relationships, indicator metadata, or fault association rules related to entity parameters; The task execution module is configured to: plan and execute corresponding data processing tasks based on the query results of the knowledge graph and the structured instructions. The data processing tasks include: calling the data interface to obtain real-time monitoring data, calling the chart engine to generate performance visualization charts, and calling the preset script to collect fault information. The results analysis module is configured to perform reasoning analysis on the task execution results and generate natural language answers or visualization charts containing the analysis conclusions.

8. A computer program product, comprising a computer program, characterized in that, When the computer program is executed by the processor, it implements a question-and-answer method for system state based on a large model as described in any one of claims 1-6.

9. A non-transitory computer-readable storage medium, characterized in that, The non-transitory computer-readable storage medium is used to store computer instructions, which, when executed by a processor, implement a question-and-answer method for system state based on a large model as described in any one of claims 1-6.

10. An electronic device, characterized in that, include: The device includes a processor, a memory, and a computer program; wherein the processor is connected to the memory, the computer program is stored in the memory, and when the electronic device is running, the processor executes the computer program stored in the memory to enable the electronic device to perform a question-and-answer method for system state based on a large model as described in any one of claims 1-6.

Images