Fault diagnosis method and device, electronic equipment, storage medium and product

Abstract

The invention relates to the technical field of computers, and particularly provides a fault diagnosis method and device, electronic equipment, a storage medium and a product. The method comprises the following steps: acquiring real-time abnormal alarm data in an application system, and processing the abnormal alarm data by using an online deployed fault diagnosis model to obtain a diagnosis result output by the fault diagnosis model; wherein the fault diagnosis model is used for performing fault diagnosis based on the relevancy between the abnormal alarm data and historical alarm events; wherein the relevancy is related to the event content and the event time. In conclusion, according to the technical scheme provided by the invention, the fault diagnosis efficiency and accuracy can be effectively improved by utilizing a large model technology based on correlation comparison.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a fault diagnosis method and apparatus, electronic equipment, storage medium and product. Background Technology

[0002] Currently, related technologies generally employ rule-based orchestration or unsupervised intelligent diagnostic algorithms for fault diagnosis. Rule-based orchestration standardizes atomic capabilities to form a tree-like structure and mechanism for automatic diagnosis of individual faults from top to bottom and from surface to depth, accumulating expert experience and improving the accuracy and efficiency of fault handling. However, this fault diagnosis method requires pre-analyzing the scenario and problem, resulting in a huge workload and the inability to diagnose new fault types not yet identified. Unsupervised intelligent diagnostic algorithms, on the other hand, automatically identify and diagnose faults without pre-labeled data. However, due to the lack of labeled data, the accuracy of diagnostic results is poor, especially in prediction, where significant errors and defects may occur. Furthermore, they are sensitive to small perturbations in the input data, potentially leading to unstable results.

[0003] With the development of cloud computing and big data technologies, the complexity of application systems is increasing daily. When application systems fail, quickly and accurately locating the cause of the failure becomes particularly important. However, existing fault diagnosis methods suffer from low diagnostic efficiency and poor accuracy. Summary of the Invention

[0004] This disclosure is made in view of the above-mentioned problems. This disclosure provides a fault diagnosis method and apparatus, electronic device, storage medium, and product to improve the efficiency and accuracy of fault diagnosis.

[0005] According to one aspect of this disclosure, a fault diagnosis method is provided, comprising: Obtain real-time anomaly alarm data from the application system; The abnormal alarm data is processed using an online fault diagnosis model to obtain the diagnostic results output by the fault diagnosis model. The fault diagnosis model is used to diagnose faults based on the correlation between the abnormal alarm data and historical alarm events; wherein the correlation is related to the event content and the event time.

[0006] According to another aspect of this disclosure, a fault diagnosis apparatus is provided, comprising: The acquisition unit is used to acquire real-time anomaly alarm data from the application system; The processing unit is used to process the abnormal alarm data using an online fault diagnosis model to obtain the diagnostic results output by the fault diagnosis model. The fault diagnosis model is used to diagnose faults based on the correlation between the abnormal alarm data and historical alarm events; wherein the correlation is related to the event content and the event time.

[0007] According to another aspect of this disclosure, an electronic device is provided, including a memory, a processor, and a computer program stored in the memory, the processor executing the computer program to implement the method as described in any of the above embodiments.

[0008] According to another aspect of this disclosure, a computer-readable storage medium is provided that stores a computer program / instructions thereon, which, when executed by a processor, implement the methods described in any of the above embodiments.

[0009] According to another aspect of this disclosure, a computer program product is provided, including a computer program / instructions that, when executed by a processor, implement the methods described in any of the above embodiments.

[0010] As will be described in detail below, a fault diagnosis method, apparatus, electronic device, storage medium, and product according to embodiments of this disclosure achieve rapid diagnosis and processing of abnormal alarm data through an online-deployed fault diagnosis model. Furthermore, it can evaluate the correlation between current abnormal alarm data and historical alarm events from two dimensions: event content and event time, and perform fault diagnosis based on this correlation. This means that the fault diagnosis model can use historical alarm events with high correlation as a reference, drawing on the processing experience of historical alarm events, to output the diagnostic results corresponding to the current abnormal alarm data more quickly and accurately. In other words, the technical solution provided by this disclosure can effectively improve the efficiency and accuracy of fault diagnosis by utilizing large-scale model technology based on correlation comparison.

[0011] It should be understood that both the foregoing general description and the following detailed description are exemplary and intended to provide further illustration of the claimed technology. Attached Figure Description

[0012] The above and other objects, features, and advantages of this disclosure will become more apparent from the more detailed description of the embodiments thereof in conjunction with the accompanying drawings. The drawings are provided to further illustrate the embodiments of this disclosure and form part of the specification. They are used together with the embodiments of this disclosure to explain the disclosure and do not constitute a limitation thereof. In the drawings, the same reference numerals generally represent the same components or steps.

[0013] Figure 1 This is a flowchart illustrating a fault diagnosis method provided in an embodiment of the present disclosure.

[0014] Figure 2This is a schematic diagram illustrating the training process of a fault diagnosis model provided in an embodiment of this disclosure.

[0015] Figure 3 This is a schematic diagram of a cloud computer fault diagnosis process provided in an embodiment of this disclosure.

[0016] Figure 4 This is a structural block diagram of a fault diagnosis device provided in an embodiment of the present disclosure.

[0017] Figure 5 This is a hardware block diagram of an electronic device provided in an embodiment of the present disclosure.

[0018] Figure 6 This is a schematic diagram of a computer-readable storage medium provided in an embodiment of this disclosure. Detailed Implementation

[0019] To make the objectives, technical solutions, and advantages of this disclosure more apparent, exemplary embodiments according to this disclosure will now be described in detail with reference to the accompanying drawings. Obviously, the described embodiments are merely some embodiments of this disclosure, and not all embodiments of this disclosure. It should be understood that this disclosure is not limited to the exemplary embodiments described herein.

[0020] To address the issues of low efficiency and poor accuracy in fault diagnosis in related technologies, this disclosure provides a novel design concept: utilizing a large model for fault diagnosis. On one hand, the self-learning analysis and data processing capabilities of the large model improve the efficiency and accuracy of fault diagnosis. On the other hand, the fault diagnosis model achieves fault diagnosis based on the correlation between input data and historical fault events. This correlation is related to both the event content and the event time. Therefore, it can identify similar historical fault events with high correlation to the input data from both content and event dimensions, thereby achieving fault diagnosis and further improving the accuracy of fault diagnosis. The following is a detailed explanation.

[0021] This disclosure provides a fault diagnosis method. Please refer to... Figure 1 , Figure 1 This is a flowchart illustrating a fault diagnosis method provided in an embodiment of this disclosure. Figure 1 As shown, the method includes: S102, obtain real-time abnormal alarm data from the application system.

[0022] The anomaly alarm data can be any real-time anomaly alarm event data in the application system. In specific implementation, when an anomaly occurs in the application system, it will report an anomaly alarm event. The fault diagnosis device (i.e., the entity executing this disclosure) can receive the anomaly alarm event and obtain the relevant data corresponding to it. This anomaly alarm data may include, but is not limited to, the data of the anomaly alarm event itself. For example, it may further include other application system information, such as version number, configuration information, attribute information, etc., without limitation or exhaustion.

[0023] Furthermore, the abnormal alarm data involved in one embodiment of this disclosure may include, but is not limited to, at least one of the following: monitoring data and basic data.

[0024] The monitoring data originates from the monitoring device and includes at least one of the following: application logs, metrics, and call chains. The monitoring device can be considered an observation platform (or observable platform), which can be an independent device separate from the application system and fault diagnosis device, or it can be a monitoring module within the application system and / or fault diagnosis device; there are no limitations on this. Specifically, the fault diagnosis device can acquire monitoring data by communicating with the monitoring device and / or the application system. In practical scenarios, the monitoring device and / or the application system can directly send monitoring data to the fault diagnosis device when an abnormal alarm event occurs, or the fault diagnosis device can proactively send and receive requests from the monitoring device and / or the application system to acquire the monitoring data.

[0025] The basic data originates from the application system and includes at least one of the following: configuration data, fault work orders, and change work orders. The configuration data may include, but is not limited to, data from the Configuration Management Database (CMDB). Specifically, the application system can directly send the basic data to the fault diagnosis device when an abnormal alarm event occurs, or the fault diagnosis device can proactively send a request to the application system and receive the basic data from the application system.

[0026] It should be understood that if both monitoring data and basic data come from the application system, the application system can send them to the fault diagnosis device together or separately.

[0027] Furthermore, in one exemplary embodiment, when specifically implementing this solution, before executing S104, the method may further include one or more of the following: feature extraction and data preprocessing of the abnormal alarm data. The data preprocessing may include, but is not limited to, one or more of the following: deleting redundant data, filtering abnormal data, data completion, etc., without exhaustive or limited examples.

[0028] S104. The online fault diagnosis model is used to process the abnormal alarm data to obtain the diagnostic results output by the fault diagnosis model. The fault diagnosis model is used to diagnose faults based on the correlation between abnormal alarm data and historical alarm events; the correlation is related to the event content and the event time.

[0029] Specifically, the input data of the fault diagnosis model involved in this disclosure is: abnormal alarm data, and the output data is the diagnostic result, which includes at least the root cause of the fault. The diagnostic result is used to indicate the root cause of the abnormal alarm. In other words, the fault diagnosis model is used to locate the root cause of abnormal alarms. In addition, the output data of the fault diagnosis model may include more information. For example, the output data (i.e., the diagnostic result) may also include, but is not limited to, one or more of the following: event information of similar historical events, fault handling methods, confidence levels of diagnostic results, etc., without exhaustive list.

[0030] In one exemplary embodiment, the method further includes: The diagnostic results are displayed visually on the screen. The diagnostic results include at least the root cause of the fault; the diagnostic results also include at least one of the following: event information of similar historical events, fault handling methods, and confidence levels.

[0031] In real-world scenarios, the diagnostic results output by the fault diagnosis model can be the final result, which can be directly output to the user; or, the diagnostic results output by the fault diagnosis model can also be used as a reference or intermediate result for the final result, which can be further processed or combined with other data to obtain the final result and output. This disclosure does not impose any special restrictions on this.

[0032] As described above, in this disclosure, the fault diagnosis model performs fault diagnosis based on the correlation between input data (i.e., abnormal alarm data) and historical alarm events. In other words, before outputting the diagnosis result, the fault diagnosis model can at least refer to historical alarm events similar to the current abnormal alarm and at least refer to their root causes to ultimately achieve fault diagnosis for the current abnormal alarm event. For example, when a system fault occurs and an abnormal alarm event is reported, the acquired abnormal alarm data can be input into the fault diagnosis model. The fault diagnosis model will then determine whether a similar fault has occurred in the past, what the previous solutions were, and whether a similar solution can be used for the current fault. Therefore, based on this design concept, the root cause of a historical alarm event that is extremely similar (highly correlated) can be directly identified as the root cause of the current abnormal alarm event, or, based on the correlation, the root cause of similar historical alarm events can be used as a reference factor to determine the fault diagnosis of the current abnormal alarm event.

[0033] Based on the above model design concept, the fault diagnosis model in this disclosure evaluates the correlation between abnormal alarm events and historical alarm events from at least two dimensions: event content and event time. Similar event content means that the two events are more likely to have the same root cause. The closer the event times, the more likely the root cause of the two events is to be the same. Furthermore, in the specific field of fault diagnosis, it is common for a fault to recur within a short period of time after it occurs. This problem of fault recurrence can also be avoided or resolved by considering the event time.

[0034] Specifically, the relevance involved in the embodiments of this disclosure can be positively correlated with the spatial similarity between the event content, where spatial similarity is used to characterize the degree of textual and / or semantic similarity between data content. In other words, the smaller the spatial distance between event content, the higher the spatial similarity of the events, and the higher the relevance between the two. In specific implementation, textual similarity recognition and / or semantic similarity recognition can be performed on the text (or features) corresponding to abnormal alarm data and historical alarm data. Then, based on the recognition results, weighting or other arbitrary comprehensive processing methods (such as obtaining average, maximum, or other statistical methods, or custom formulas, algorithms, etc.) can be applied to obtain the spatial similarity between the two.

[0035] The relevance involved in the embodiments of this disclosure can be positively correlated with the time weight between the event times, and the time weight is negatively correlated with the degree of time difference. In other words, the greater the difference between the event times, the smaller the time weight, and the smaller the event relevance. In specific implementation, the degree of time difference can be characterized by the time difference.

[0036] It should be noted that this disclosure does not limit the method by which the fault diagnosis model determines spatial similarity. For example, it can be done through one or more methods such as cosine similarity, edit distance, or pre-trained machine learning models, which will not be elaborated here. This disclosure also does not impose any particular restrictions on how to determine time weights based on the degree of time difference. For example, it can be done through one or more methods such as taking negative numbers, exponential functions or other custom algorithms or formulas, or pre-trained machine learning models, which will not be elaborated here.

[0037] Furthermore, this disclosure does not impose any particular restrictions on how the relevance is determined internally within the fault diagnosis model based on spatial similarity and temporal weighting. For example, in one possible embodiment, the fault diagnosis model may use a weighted average, product, or other possible methods of spatial and temporal similarity to determine the final relevance.

[0038] In one exemplary embodiment, any two events a With the event b The correlation between them can satisfy the following relationship:

[0039] in, This indicates the correlation between event a and event b. This represents the spatial distance between event a and event b. Indicates the time when event a occurred. Indicates the time when event b occurred. Custom weighting coefficients.

[0040] In this embodiment, This represents the spatial similarity between event a and event b. This represents the time weight between event a and event b. In other words, in this embodiment, the correlation between event a and event b is the product of spatial similarity and time weight, where spatial similarity is negatively correlated with spatial distance, and time weight is negatively correlated with the degree of temporal difference.

[0041] It should be understood that the embodiments described above are merely exemplary, and in real-world scenarios, other algorithms or processing logic can be customized. For example, spatial similarity can also be expressed as: For example, spatial similarity can also be expressed as: ,in, , For example, time weights can also be expressed as: , or, expressed as: For example, relevance can also be a weighted sum of spatial similarity and time weight, or other custom algorithms or processing logic, which will not be elaborated here.

[0042] Based on the above principles, the pre-trained fault diagnosis model in this disclosure can identify similar alarm events with similar times and content in the past, based on the correlation between the current abnormal alarm data and historical alarm events, and provide a diagnostic result for the current abnormal alarm event, considering both event content and event time. This means that the fault diagnosis model can use highly relevant historical alarm events as a reference, drawing on the handling experience of historical alarm events to output the diagnostic result corresponding to the current abnormal alarm data more quickly and accurately. In other words, the technical solution provided in this disclosure can effectively improve the efficiency and accuracy of fault diagnosis by utilizing large-scale model technology based on correlation comparison.

[0043] In one exemplary embodiment, the fault diagnosis model involved in this disclosure can be specifically used for: Obtain the correlation between the abnormal alarm data and each historical alarm event; Based on the correlation, similar historical events of the abnormal alarm data are determined; Using the root causes of similar historical events as a reference, the diagnostic results of the abnormal alarm data are determined.

[0044] It should be noted that the fault diagnosis model used in this disclosure is a machine learning model with machine learning capabilities, and is not a model composed of processing modules based on similarity comparison in the conventional sense. In this embodiment, the above processing is implemented within the fault diagnosis model, and does not require threshold design using conventional algorithms. Instead, it utilizes the self-learning capability of a large model, which learns the relationship between abnormal alarm data and diagnostic results during the training phase, and adjusts the model parameters accordingly to achieve automated processing. This reduces human intervention and human error, and also improves the accuracy and efficiency of fault diagnosis.

[0045] In this embodiment of the disclosure, the method may further include: a pre-trained fault diagnosis model.

[0046] In one exemplary embodiment, the method further includes the following processing: Obtain historical alarm data; the historical alarm data includes: historical alarm events and root causes of failures; The historical alarm data is used as training samples to train the fault diagnosis model. Deploy the fault diagnosis model online.

[0047] In this embodiment, historical alarm data is used as training samples to train the fault diagnosis model. The input data for the training samples consists of relevant data from historical alarm events, and the output samples represent the root causes of the faults. By using real historical fault data as training samples, the fault diagnosis model can learn more realistic input-output relationships, which is more conducive to improving the accuracy of the model's diagnostic results. In this embodiment, as long as the amount of historical alarm data is large enough, it can guide and improve the diagnostic accuracy of the fault diagnosis model.

[0048] Based on the above training, the fault diagnosis model can be deployed online, so that the online fault diagnosis model can directly process the real-time abnormal alarm data online.

[0049] In addition, this disclosure provides a training program for online feedback training.

[0050] In one exemplary embodiment, the method may further include: Obtain user review data for the diagnostic results; Based on the diagnostic results, the audit data, and the abnormal alarm data, the fault diagnosis model is optimized online.

[0051] In this embodiment, considering that the fault diagnosis model may still make misjudgments, this disclosure further provides a user review function for the diagnostic results. In practical scenarios, users can conduct random checks or full reviews of the diagnostic results based on their own needs, and multiple users can be configured with the same or different review permissions, which can be customized.

[0052] Thus, in this embodiment, the diagnostic results output by the fault diagnosis model can be sent to the reviewing user, for example, by directly displaying them visually or reminding the user to handle them in the form of a task; and the user's review data on the diagnostic results can be obtained. For the user, if the diagnostic result is correct, they can directly confirm the diagnostic result without any further processing; if the diagnostic result contains errors, the user can directly modify the diagnostic result, for example, by directly marking the root cause of the abnormal alarm event; and / or, the user can also instruct the fault diagnosis model to re-diagnose. Based on this review data, it can be determined whether the diagnostic results of the fault diagnosis model are correct. This disclosure combines the input data, output data, and review data of the fault diagnosis model as a set of training samples to perform supervised learning optimization on the online model, further improving the diagnostic accuracy of the fault diagnosis model.

[0053] It should be understood that the two model training methods mentioned above can be used individually or in combination.

[0054] For example, please refer to Figure 2 , Figure 2 This is a schematic diagram illustrating the training process of a fault diagnosis model provided in an embodiment of this disclosure. Figure 2 As shown, the fault diagnosis model can be trained offline based on offline work orders and then deployed online. Offline work orders include historical fault data, as described above. After deployment, the fault diagnosis model can process real-time abnormal alarm data and output diagnostic results. Users (e.g., operations and maintenance personnel) can review the diagnostic results. This review data can then be used to train the online fault diagnosis model in real-time, correcting model parameters to improve accuracy and optimize performance.

[0055] In such Figure 2In the illustrated embodiment, after receiving an anomaly alarm notification, the user can actively or automatically use the relevant data of the anomaly alarm as input to the fault diagnosis model. The model then automatically analyzes and diagnoses the root cause of the alarm and outputs a diagnostic result. This result can assist maintenance personnel in fault location, improving fault resolution efficiency and the efficiency of closed-loop problem handling. Furthermore, based on the visualized diagnostic results, users can also annotate them, such as annotating the actual root cause of the fault. This automatically triggers online feedback training of the fault diagnosis model to optimize model parameters in real time and improve model performance. This feedback training process adopts a supervised learning mechanism, that is, the analysis and processing of the anomaly alarm and the saving of the processing results are treated as a complete data annotation process. This process naturally integrates the annotation (processing of anomaly alarms) into the overall business process without adding any extra workload for the user, while achieving the effect of data annotation. In addition, after receiving anomaly feedback from other users, users can input user information, the time of the anomaly occurrence, and the anomaly type to diagnose the root cause of the problem.

[0056] In such Figure 2 In the illustrated embodiment, a combination of offline training and online feedback training is adopted. On the one hand, this can continuously optimize the model's diagnostic accuracy using real data from real-world scenarios. On the other hand, this training method incorporates the online review process as part of the data annotation process, using actual business scenarios to complete data annotation, which greatly reduces the difficulty of annotating training samples.

[0057] In summary, this disclosure achieves fault diagnosis by introducing a large-scale model (i.e., a fault diagnosis model). Utilizing the self-learning analytical capabilities of this model, based on monitoring and basic data, it automatically analyzes and learns from massive amounts of data to identify the root causes of abnormal alarm events. This reduces the need for manpower in operations and maintenance (O&M), improves problem analysis efficiency, and significantly reduces the mean time to repair (MTTR, a crucial indicator of system reliability and maintainability). Furthermore, it can process and analyze massive amounts of data far exceeding human capabilities, finding the root causes of problems based on the complex relationships hidden behind the data, thus improving diagnostic accuracy. Therefore, this disclosure can serve as part of a more robust and intelligent O&M platform, freeing up manpower; for example, O&M teams can dedicate more time to strategic tasks rather than routine troubleshooting.

[0058] Furthermore, the application systems involved in the embodiments of this disclosure can be any application software system, which can be a local application system or a remote application system. In one exemplary embodiment, the application systems involved in this disclosure may include, but are not limited to, cloud application systems. For example, the fault diagnosis method provided in this disclosure can be used for fault diagnosis of cloud computers and cloud applications. As another example, the fault diagnosis method provided in this disclosure can be used for fault diagnosis of local applications and third-party programs, etc., and so on.

[0059] Furthermore, this disclosure does not specifically limit the scope of fault diagnosis. For example, the diagnostic results involved in this disclosure include at least one of the following: software anomalies, network anomalies, and system anomalies. In other words, this solution can be used to diagnose faults in one or more aspects such as software, network, and system. The fault-causing end can include, but is not limited to, one or more of the following: client, network transmission components, cloud, server, etc., which may vary depending on the application system architecture, and is not exhaustive or limited.

[0060] Taking the cloud computer fault diagnosis mentioned above as an example, the technical solution provided in this disclosure can be used to diagnose faults on the cloud application client side, such as client crashes and configuration errors; it can also be used for fault diagnosis at the network level, such as network latency and packet loss; it can also be used for fault diagnosis at the system level, such as host machine failures and storage problems on the cloud infrastructure side, and driver problems on the cloud system side; it can also be used for fault diagnosis of cloud application software, such as application crashes and licensing problems, etc., without exhaustive list or elaboration.

[0061] For example, taking cloud computer fault diagnosis as an example, the fault diagnosis solution of this disclosure will be explained. Please refer to... Figure 3 , Figure 3 This is a schematic diagram illustrating a cloud computer fault diagnosis process provided in an embodiment of this disclosure. Figure 3 As shown, during the operation of a cloud PC application, the monitoring device or the cloud PC application itself can collect monitoring data such as logs, metrics, and call chains, thus improving the cloud PC's CMDB configuration data, fault tickets, and change ticket data. Feature data can be extracted from this data as training samples (or these data can be used directly as training samples) to train a large model, enabling the model to learn the relationship between abnormal fault data and the root cause of the fault, thereby improving model performance. In this way, when a cloud PC application malfunctions, the pre-trained fault diagnosis model can process the abnormal alarm data (i.e., determine the diagnostic result based on the correlation between the abnormal alarm data and historical alarm events) to diagnose the root cause of the problem (this can be the diagnostic result or the final result determined based on the diagnostic result, such as a manually modified root cause), and then feed this information back to the cloud PC application.

[0062] The fault diagnosis method according to embodiments of the present disclosure has been described above with reference to the accompanying drawings.

[0063] This disclosure also provides a fault diagnosis device. Figure 4 This is a structural block diagram of a fault diagnosis device provided in an embodiment of the present disclosure, such as... Figure 4 As shown, the fault diagnosis device 400 includes: The acquisition unit 410 is used to acquire real-time abnormal alarm data from the application system; The processing unit 420 is used to process the abnormal alarm data using an online fault diagnosis model to obtain the diagnostic results output by the fault diagnosis model. The fault diagnosis model is used to diagnose faults based on the correlation between the abnormal alarm data and historical alarm events; wherein the correlation is related to the event content and the event time.

[0064] In one exemplary embodiment, the relevance is positively correlated with the spatial similarity between the event content, whereby the spatial similarity is used to characterize the degree of textual and / or semantic similarity between data content; The relevance is positively correlated with the time weight between the event times, and the time weight is negatively correlated with the degree of time difference.

[0065] In one exemplary embodiment, the fault diagnosis model is specifically used for: Obtain the correlation between the abnormal alarm data and each historical alarm event; Based on the correlation, similar historical events of the abnormal alarm data are determined; Using the root causes of similar historical events as a reference, the diagnostic results of the abnormal alarm data are determined.

[0066] In one exemplary embodiment, the processing unit 420 is further configured to: Obtain historical alarm data; the historical alarm data includes: historical alarm events and root causes of failures; The historical alarm data is used as training samples to train the fault diagnosis model; Deploy the fault diagnosis model online.

[0067] In one exemplary embodiment, the processing unit 420 is further configured to: Obtain user review data for the diagnostic results; Based on the diagnostic results, the audit data, and the abnormal alarm data, the fault diagnosis model is optimized online.

[0068] In one exemplary embodiment, the processing unit 420 is further configured to: The diagnostic results are displayed visually on the screen. The diagnostic results include at least the root cause of the fault; the diagnostic results also include at least one of the following: event information of similar historical events, fault handling methods, and confidence levels.

[0069] In one exemplary embodiment, the abnormal alarm data includes at least one of the following: monitoring data and basic data; The monitoring data comes from the monitoring device and includes at least one of the following: application logs, metrics, and call chains; The basic data comes from the application system and includes at least one of the following: configuration data, fault work orders, and change work orders.

[0070] In one exemplary embodiment, the application system includes: a cloud application system; The diagnostic results include at least one of the following: software anomaly, network anomaly, or system anomaly.

[0071] For details not described above, please refer to the method embodiments described above.

[0072] Figure 5 This is a hardware block diagram of an electronic device provided according to an embodiment of the present disclosure. The electronic device 500 according to an embodiment of the present disclosure includes at least a memory, a processor, and a computer program stored in the memory. The processor executes the computer program to implement the fault diagnosis method as described in any of the above embodiments.

[0073] Figure 5 The illustrated electronic device 500 specifically includes a central processing unit (CPU) 501, a graphics processing unit (GPU) 502, and a memory 503. These units are interconnected via a bus 504. The CPU 501 and / or GPU 502 can function as the aforementioned processor, and the memory 503 can function as the aforementioned memory storing computer-readable instructions. Furthermore, the electronic device 500 may also include a communication unit 505, a storage unit 506, an output unit 507, an input unit 508, and an external device 509, all of which are also connected to the bus 504.

[0074] Figure 6 This is a schematic diagram of a computer-readable storage medium provided according to an embodiment of the present disclosure. The computer-readable storage medium according to an embodiment of the present disclosure stores a computer program / instructions (including but not limited to computer-readable instructions). Specifically, as shown... Figure 6As shown, a computer-readable storage medium 600 stores computer-readable instructions 601. When executed by a processor, this computer program / instruction implements the fault diagnosis method as described in any of the preceding embodiments of this disclosure. The computer-readable storage medium includes, but is not limited to, volatile memory and / or non-volatile memory. Volatile memory may include, for example, random access memory (RAM) and / or cache memory. Non-volatile memory may include, for example, read-only memory (ROM), hard disk, flash memory, optical disk, magnetic disk, etc.

[0075] This disclosure further provides a computer program product, including a computer program / instructions that, when executed by a processor, implement the fault diagnosis method as described in any of the foregoing embodiments of this disclosure.

[0076] The basic principles of this disclosure have been described above with reference to specific embodiments. However, it should be noted that the advantages, benefits, and effects mentioned in this disclosure are merely examples and not limitations, and should not be considered as essential features of each embodiment of this disclosure. Furthermore, the specific details disclosed above are for illustrative and facilitative purposes only, and are not limitations. These details do not limit the scope of this disclosure to the necessity of employing the aforementioned specific details for implementation.

[0077] The block diagrams of devices, apparatuses, devices, and systems disclosed herein are merely illustrative examples and are not intended to require or imply that they must be connected, arranged, or configured in the manner shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, devices, and systems can be connected, arranged, and configured in any manner. Words such as “comprising,” “including,” “having,” etc., are open-ended terms meaning “including but not limited to,” and are used interchangeably with them. The terms “or” and “and” as used herein refer to the terms “and / or,” and are used interchangeably with them unless the context clearly indicates otherwise. The term “such as” as used herein refers to the phrase “such as but not limited to,” and is used interchangeably with it.

[0078] Additionally, as used herein, the "or" used in a list of items beginning with "at least one" indicates a separate list, such that a list of, for example, "at least one of A, B, or C" means A or B or C, or AB or AC or BC, or ABC (i.e., A and B and C). Furthermore, the word "exemplary" does not imply that the described example is preferred or better than other examples.

[0079] It should also be noted that in the systems and methods of this disclosure, the components or steps can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions to this disclosure.

[0080] Various changes, substitutions, and modifications can be made to the technology described herein without departing from the teachings defined by the appended claims. Furthermore, the scope of the claims of this disclosure is not limited to the specific aspects of the processes, machines, manufactures, events, means, methods, and actions described above. Currently existing or later-developed processes, machines, manufactures, events, means, methods, or actions that perform substantially the same function or achieve substantially the same result as the corresponding aspects described herein can be utilized. Therefore, the appended claims include such processes, machines, manufactures, events, means, methods, or actions within their scope.

[0081] The above description of the disclosed aspects is provided to enable any person skilled in the art to make or use this disclosure. Various modifications to these aspects will be readily apparent to those skilled in the art, and the general principles defined herein may be applied to other aspects without departing from the scope of this disclosure. Therefore, this disclosure is not intended to be limited to the aspects shown herein, but rather to be carried out within the widest scope consistent with the principles and novel features disclosed herein.

[0082] The above description has been given for purposes of illustration and description. Furthermore, this description is not intended to limit the embodiments of this disclosure to the forms disclosed herein. Although numerous exemplary aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, alterations, additions, and sub-combinations therein.

Claims

1. A fault diagnosis method, characterized in that, include: Obtain real-time anomaly alarm data from the application system; The abnormal alarm data is processed using an online fault diagnosis model to obtain the diagnostic results output by the fault diagnosis model. The fault diagnosis model is used to diagnose faults based on the correlation between the abnormal alarm data and historical alarm events; wherein the correlation is related to the event content and the event time.

2. The method according to claim 1, characterized in that, The relevance is positively correlated with the spatial similarity between the event content, and the spatial similarity is used to characterize the degree of textual and / or semantic similarity between data content; The relevance is positively correlated with the time weight between the event times, and the time weight is negatively correlated with the degree of time difference.

3. The method according to claim 1, characterized in that, The fault diagnosis model is specifically used for: Obtain the correlation between the abnormal alarm data and each historical alarm event; Based on the correlation, similar historical events of the abnormal alarm data are determined; Using the root causes of similar historical events as a reference, the diagnostic results of the abnormal alarm data are determined.

4. The method according to claim 1, characterized in that, The method further includes: Obtain historical alarm data; the historical alarm data includes: historical alarm events and root causes of failures; The historical alarm data is used as training samples to train the fault diagnosis model; Deploy the fault diagnosis model online.

5. The method according to claim 1, characterized in that, The method further includes: Obtain user review data for the diagnostic results; Based on the diagnostic results, the audit data, and the abnormal alarm data, the fault diagnosis model is optimized online.

6. The method according to claim 1, characterized in that, The method further includes: The diagnostic results are displayed visually on the screen. The diagnostic results include at least the root cause of the fault; the diagnostic results also include at least one of the following: event information of similar historical events, fault handling methods, and confidence levels.

7. The method according to any one of claims 1-6, characterized in that, The abnormal alarm data includes at least one of the following: monitoring data and basic data; The monitoring data comes from the monitoring device and includes at least one of the following: application logs, metrics, and call chains; The basic data comes from the application system and includes at least one of the following: configuration data, fault work orders, and change work orders.

8. The method according to any one of claims 1-6, characterized in that, The application system includes: a cloud application system; The diagnostic results include at least one of the following: software anomaly, network anomaly, or system anomaly.

9. A fault diagnosis device, characterized in that, include: The acquisition unit is used to acquire real-time anomaly alarm data from the application system; The processing unit is used to process the abnormal alarm data using an online fault diagnosis model to obtain the diagnostic results output by the fault diagnosis model. The fault diagnosis model is used to diagnose faults based on the correlation between the abnormal alarm data and historical alarm events; wherein the correlation is related to the event content and the event time.

10. An electronic device comprising a memory, a processor, and a computer program stored in the memory, characterized in that, The processor executes the computer program to implement the method as described in any one of claims 1-8.

11. A computer-readable storage medium having a computer program / instructions stored thereon, characterized in that, When the computer program / instruction is executed by the processor, it implements the method as described in any one of claims 1-8.

12. A computer program product comprising a computer program / instructions, characterized in that, When the computer program / instruction is executed by the processor, it implements the method as described in any one of claims 1-8.

Images