Fault analysis method, device and equipment based on large model and storage medium

Abstract

The invention discloses a fault analysis method, device and equipment based on a large model and a storage medium, and the method comprises the following steps: based on system state data of at least two subsystems in a target application system and a system calling relationship between the subsystems, analyzing the system state data of the at least two subsystems in the target application system; generating a target system topological structure corresponding to the target application system; marking a fault node with a fault in the target system topological structure, and generating a fault prompt word according to fault information of the fault node; and inputting the labeled topological structure of the target system and the fault prompt word into a fault analysis model, and carrying out fault analysis on the fault node. According to the technical scheme, the fault analysis accuracy and the fault analysis efficiency are improved.

Description

Technical Field

[0001] This application relates to the field of computer technology, specifically to a fault analysis method, apparatus, device, and storage medium based on a large model. Background Technology

[0002] With the widespread adoption of cloud-native and microservice architectures, enterprise applications often consist of hundreds or even thousands of loosely coupled services. The call chains and dependencies grow exponentially, and any single point of failure can quickly spread along the dependency chain, triggering an "alarm storm" and significantly lengthening the average repair time.

[0003] Existing root cause analysis methods still have significant shortcomings in rule maintenance, alarm noise reduction, dynamic topology adaptability, data drift response, and interpretable evaluation of results, making it difficult to meet the continuous demands of modern large-scale distributed systems for high accuracy, low mean time to repair, and low maintenance costs. Summary of the Invention

[0004] This application provides a fault analysis method, apparatus, device, and storage medium based on a large model to improve the accuracy and efficiency of fault analysis.

[0005] According to one aspect of this application, a fault analysis method based on a large model is provided, the method comprising:

[0006] Based on the system status data of at least two subsystems in the target application system, and the system call relationships between the subsystems, a target system topology is generated corresponding to the target application system; wherein, the target application system refers to an application system with system faults.

[0007] In the target system topology, faulty nodes that have experienced failures are marked, and fault prompt words are generated based on the fault information of the faulty nodes.

[0008] The labeled target system topology and the fault prompt words are input into the fault analysis model to perform fault analysis on the faulty node; wherein, the fault analysis model is a pre-trained artificial intelligence model.

[0009] According to another aspect of this application, a fault analysis apparatus based on a large model is provided, the apparatus comprising:

[0010] The system topology module is used to generate the target system topology structure corresponding to the target application system based on the system status data of at least two subsystems in the target application system and the system call relationship between the subsystems; wherein, the target application system refers to the application system with system failure;

[0011] The prompt word generation module is used to mark the faulty nodes that have failed in the target system topology and generate fault prompt words based on the fault information of the faulty nodes.

[0012] The fault analysis module is used to input the labeled target system topology and the fault prompt words into the fault analysis model to perform fault analysis on the fault node; wherein, the fault analysis model is a pre-trained artificial intelligence model.

[0013] According to another aspect of this application, an electronic device is provided, the electronic device comprising:

[0014] One or more processors;

[0015] Memory, used to store one or more programs;

[0016] When the one or more programs are executed by the one or more processors, the one or more processors implement any of the large model-based fault analysis methods provided in the embodiments of this application.

[0017] According to another aspect of this application, a computer-readable storage medium is provided having a computer program stored thereon, which, when executed by a processor, implements any of the large-model-based fault analysis methods provided in the embodiments of this application.

[0018] According to another aspect of this application, a computer program product is provided, including a computer program that, when executed by a processor, implements any of the large-model-based fault analysis methods provided in the embodiments of this application.

[0019] This application constructs a unified system state representation of the target application system based on the system state data of the subsystems, establishing a unified data entry point for subsequent fault analysis. It no longer relies on the judgment results of a single data dimension, but effectively improves the system's perception and localization capabilities for complex fault scenarios through cross-dimensional and multi-angle target system topology. This enables the large language model to generate more reasonable and sufficient fault localization explanations during the reasoning process, thereby improving the accuracy and efficiency of fault analysis. Attached Figure Description

[0020] Figure 1 This is a flowchart of a fault analysis method based on a large model according to Embodiment 1 of this application;

[0021] Figure 2 This is a flowchart of a fault analysis method based on a large model according to Embodiment 2 of this application;

[0022] Figure 3This is a schematic diagram of a fault analysis device based on a large model according to Embodiment 3 of this application;

[0023] Figure 4 This is a schematic diagram of the structure of an electronic device that implements the fault analysis method based on a large model according to Embodiment 4 of this application. Detailed Implementation

[0024] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present application, and not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those of ordinary skill in the art without creative effort should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this application are used to distinguish similar objects and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or apparatus that comprises a series of steps or units is not necessarily limited to those steps or units explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or apparatus.

[0026] Example 1

[0027] Figure 1 This is a flowchart of a fault analysis method based on a large model, according to Embodiment 1 of this application. This embodiment is applicable to the analysis of the causes of system failures in application systems. It can be executed by a fault analysis device based on a large model, which can be implemented in hardware and / or software and can be configured in a computer device, such as a server. Figure 1 As shown, the method includes:

[0028] S110. Based on the system status data of at least two subsystems in the target application system and the system call relationships between the subsystems, generate the target system topology structure corresponding to the target application system.

[0029] The target application system can refer to an application system with system failures or an application system for which the causes of failures can be analyzed. It should be noted that the target system topology can be updated synchronously in real time according to changes in the target application system. The observable entities (subsystems) of the target system topology can include hosts, processes, service instances, and interfaces, and different observable entities correspond to different system status data. For example, observable system data (system status data) for interfaces can include response time and error rate; observable system data for processes can include input / output rates and thread counts; and observable system data for hosts can include CPU utilization and memory utilization.

[0030] Specifically, during the operation of the target application system, system status data of each subsystem can be collected in real time, and the collected data can be standardized to unify the data semantics between different subsystems. Based on the system call relationship between the subsystems, the system status data obtained by each subsystem can be logically correlated and fused with temporal dependencies to obtain an abstract data structure that describes the dynamic evolution of the internal state and external behavior of the system, which serves as the target system topology structure corresponding to the target application system.

[0031] The target system topology can be used to infer potential abnormal system nodes and their propagation paths during system operation, providing panoramic contextual information support for root cause analysis.

[0032] S120. Mark the faulty nodes in the target system topology and generate fault prompt words based on the fault information of the faulty nodes.

[0033] It should be noted that the annotated target system topology can be used to characterize the location and severity of faults at faulty nodes, as well as the fault propagation path of the faulty node. It can be used to measure the degree of anomaly in a subsystem within a specific time window, and, combined with structural connections and behavioral impact relationships with other subsystems, generate an interpretive view of system anomalies. This view not only reflects key anomalies in the target system topology but also shows the propagation chain of other subsystems that may be affected by the anomalies.

[0034] Optionally, fault prompt words can be determined based on a preset fault prompt word template. For example, the fault location information and fault type information can be extracted from the fault alarm information issued by the target application system, and the fault information can be filled into the fault prompt word template to generate fault prompt words. For example, "A fault occurred at location xx. Please analyze the cause of the above fault."

[0035] S130. Input the labeled target system topology and fault prompt words into the fault analysis model to perform fault analysis on the faulty nodes.

[0036] The fault analysis model can be a pre-trained artificial intelligence model. It should be noted that this artificial intelligence model can include a large language model.

[0037] This application embodiment constructs a unified system state expression for the target application system based on the system state data of the subsystems, establishing a unified data entry point for subsequent fault analysis. It no longer relies on the judgment results of a single data dimension, but effectively improves the system's perception and localization capabilities for complex fault scenarios through a cross-dimensional and multi-angle target system topology structure. This enables the large language model to generate more reasonable and sufficient fault localization explanations during the reasoning process, thereby improving the accuracy and efficiency of fault analysis.

[0038] Example 2

[0039] Figure 2 This is a flowchart of a fault analysis method based on a large model according to Embodiment 2 of this application. Based on the technical solutions of the above embodiments, this embodiment further refines the step of "inputting the labeled target system topology and fault indication words into the fault analysis model to perform fault analysis on the faulty nodes." It should be noted that for parts not detailed in this embodiment, please refer to the relevant descriptions in other embodiments. Figure 2 As shown, the method includes:

[0040] S210. Based on the system status data of at least two subsystems in the target application system and the system call relationships between the subsystems, generate the target system topology structure corresponding to the target application system.

[0041] S220. Mark the faulty nodes in the target system topology and generate fault prompt words based on the fault information of the faulty nodes.

[0042] S230. Use a large language model to perform semantic analysis and intent recognition on fault prompt words to determine the fault location and intent recognition result corresponding to the fault prompt words.

[0043] Specifically, the large language model can break down fault prompt words into the smallest semantic units, perform tensor transformation on the smallest semantic units, use a multi-head self-attention layer to extract multi-dimensional features from the smallest semantic units, capture contextual dependencies, determine the high-dimensional feature vector of each smallest semantic unit, and perform non-linear transformation on the output of the multi-head self-attention layer to enhance feature representation ability. The large language model can perform semantic analysis on the feature extraction results, activate the corresponding knowledge base and output framework based on the semantic classification results, and then determine the intent recognition result.

[0044] S240. Based on the intent recognition results, traverse the target system topology starting from the location of the fault to determine at least one candidate faulty link.

[0045] Optionally, the link nodes in the candidate faulty links are traversed, including: during the traversal of the candidate faulty links, for the currently traversed link node, the corresponding node interface of the currently traversed link node is called to access the system status data corresponding to the currently traversed link node.

[0046] By obtaining system status data of link nodes in the target system topology through external interfaces, the large language model can provide panoramic contextual information support for the target application system.

[0047] S250. Traverse the link nodes in the candidate fault links to identify abnormal link nodes with abnormal system status data, and use a large language model to generate at least one candidate fault root cause based on the abnormal link node and the traversal starting point.

[0048] For example, a candidate root cause of failure could be: the root cause of the response time of interface A being higher than 500ms is an abnormal error in queue B, and the evidence is that the erroneous call chain of interface A clearly points to an abnormal error in queue B.

[0049] Optionally, in this embodiment of the invention, after generating candidate root causes, the method further includes: generating causal analysis instructions based on the candidate root causes, inputting the causal analysis instructions into a large language model for causal analysis, generating causal analysis results; determining the corresponding causal confidence level for the candidate root cause based on the causal analysis results, and determining the target root cause from the candidate root causes based on the causal confidence level.

[0050] The causal analysis is specified to instruct the large language model to perform causal analysis on candidate root causes. Causal analysis can include causal logic analysis of candidate root causes and causal fact analysis. Causal logic analysis can be used to determine the probability of word sequence relationship between cause words and cause words in candidate root causes. Causal fact analysis can be used to determine whether the causal logic between causal pairs in candidate root causes can be supported by evidence.

[0051] By employing a large language model to perform causal analysis on candidate root causes of failures, and conducting consistency verification and sufficiency checks, potential reasoning flaws and insufficient coverage of candidate root causes are identified. Critical feedback for the candidate root causes is generated and stored in the context of the large language model. A round-by-round feedback adjustment approach is used to proactively avoid common illusions and semantic contradictions, significantly improving the robustness and reliability of output in complex task reasoning. For example, the critical feedback could be: "The conclusion that the root cause of interface A's response time exceeding 500ms is due to an abnormal error in queue B contradicts the result of interface A pointing to database C in the slow call chain."

[0052] It should be noted that word sequence relationship probability can be used to characterize the co-occurrence probability between cause and effect words. Optionally, the large language model can be generated based on Granger causality tests. Granger causality can be generated based on business rules and common sense constraints. Business rules can be used to characterize the operating rules of the target application system. For example, business rules can refer to the structural connection relationships and behavioral influence relationships represented by the system topology indicated by the target system topology. Common sense constraints can be used to characterize users' basic cognition of the physical world and can be used for temporal and logical consistency constraints to reduce excessive dependence on sample data. For example, the cause must occur before the effect (e.g., "smoking causes lung cancer," not "lung cancer causes smoking"). If A is the cause of B, and B is the cause of C, then the indirect causal relationship between A and C must conform to transitivity (e.g., "studying hard → improving grades → receiving a reward"). The model cannot derive the contradictory conclusion that "A→C but B is irrelevant."

[0053] In this embodiment of the invention, when the causal confidence score corresponding to a candidate root cause is lower than a preset minimum confidence threshold, a root cause revision instruction is generated based on the confidence score of the critical feedback of the candidate root cause and input into the large language model. This initiates the next round of causal analysis, performs confidence checks on the remaining candidate root causes, until a candidate root cause passes the confidence check or reaches a preset termination condition (such as satisfying a preset maximum number of iterations). This allows the reasoning conclusions of the large language model to gradually converge in terms of logical coherence and confidence, thereby improving the accuracy and stability of root cause localization. For example, the root cause revision instruction could be: "The root cause conclusion that the response time of interface A is higher than 500ms is caused by an abnormal error in queue B," with a confidence score of 0.7, lower than the system's preset minimum confidence standard of 0.8, and the current iteration count of 1, lower than the system's preset maximum iteration count of 5.

[0054] This application embodiment generates at least one candidate fault link by invoking the target system topology based on fault information, and obtains the root cause feedback of the candidate fault by combining the external data of the link nodes in the candidate fault link, thereby improving the adaptability and interpretive transparency of the reasoning process to dynamic system state changes.

[0055] Example 3

[0056] Figure 3 This is a schematic diagram of a large-model-based fault analysis device according to Embodiment 3 of this application. It is applicable to analyzing the causes of system failures in application systems. This large-model-based fault analysis device can be implemented in hardware and / or software and can be configured in a computer device, such as a server. Figure 3 As shown, the device includes:

[0057] The system topology module 310 is used to generate a target system topology structure corresponding to the target application system based on the system status data of at least two subsystems in the target application system and the system call relationship between the subsystems; wherein, the target application system refers to an application system with system faults.

[0058] The prompt word generation module 320 is used to mark the faulty nodes that have failed in the target system topology and generate fault prompt words based on the fault information of the faulty nodes.

[0059] The fault analysis module 330 is used to input the labeled target system topology and the fault prompt words into the fault analysis model to perform fault analysis on the fault node; wherein, the fault analysis model is a pre-trained artificial intelligence model.

[0060] This application embodiment constructs a unified system state expression for the target application system based on the system state data of the subsystems, establishing a unified data entry point for subsequent fault analysis. It no longer relies on the judgment results of a single data dimension, but effectively improves the system's perception and localization capabilities for complex fault scenarios through a cross-dimensional and multi-angle target system topology structure. This enables the large language model to generate more reasonable and sufficient fault localization explanations during the reasoning process, thereby improving the accuracy and efficiency of fault analysis.

[0061] Optionally, the fault analysis module 330 includes:

[0062] The semantic analysis unit is used to perform semantic analysis and intent recognition on the fault prompt words using a large language model, and to determine the fault location and intent recognition result corresponding to the fault prompt words.

[0063] The candidate link unit is used to traverse the topology of the target system based on the intent recognition result, with the fault location as the traversal starting point, and determine at least one candidate fault link.

[0064] The candidate root cause unit is used to traverse the link nodes in the candidate fault links, determine the abnormal link nodes in the link nodes where there are abnormal system status data, and use a large language model to generate at least one candidate fault root cause based on the abnormal link node and the traversal starting point.

[0065] Optionally, the fault analysis module 330 also includes:

[0066] Target root cause units can be specifically used for:

[0067] After generating candidate root causes, a causal analysis instruction is generated based on the candidate root causes, and the causal analysis instruction is input into the large language model for causal analysis to generate causal analysis results. The causal analysis includes causal logic analysis of the candidate root causes and causal fact analysis. The causal logic analysis is used to determine the probability of word sequence relationships between cause words and causal words in the candidate root causes. The causal fact analysis is used to determine whether the causal logic between causal pairs in the candidate root causes can be supported by evidence.

[0068] Based on the causal analysis results, determine the corresponding causal confidence level for the candidate root cause of the failure, and determine the target root cause of the failure from the candidate root causes based on the causal confidence level.

[0069] Optionally, the candidate link unit can be specifically used for:

[0070] During the traversal of candidate fault links, for the currently traversed link node, the corresponding node interface of the currently traversed link node is called to access the system status data corresponding to the currently traversed link node.

[0071] Optionally, the labeled target system topology can be used to characterize the location and degree of fault occurrence of the faulty node, as well as the fault propagation path of the faulty node.

[0072] Optionally, the target system topology can be updated in real time, and the observation entities of the target system topology include hosts, processes, service instances and interfaces, and different observation entities correspond to different system status data.

[0073] The fault analysis device based on a large model provided in this application can execute the fault analysis method based on a large model provided in any embodiment of this application, and has the corresponding functional modules and beneficial effects for executing each fault analysis method based on a large model.

[0074] According to embodiments of this application, this application also provides an electronic device, a readable storage medium, and a computer program product.

[0075] Example 4

[0076] Figure 4 This is a schematic diagram of the structure of an electronic device 410 implementing the large-model-based fault analysis method of this application embodiment. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processors, cellular phones, smartphones, wearable devices (such as helmets, glasses, watches, etc.), and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely illustrative and are not intended to limit the implementation of the present application described and / or claimed herein.

[0077] like Figure 4 As shown, the electronic device 410 includes at least one processor 411 and a memory, such as a read-only memory 412 or a random access memory 413, communicatively connected to the at least one processor 411. The memory stores computer programs executable by the at least one processor. The processor 411 can perform various appropriate actions and processes based on the computer program stored in the read-only memory 412 or loaded from storage unit 418 into the random access memory 413. The random access memory 413 can also store various programs and data required for the operation of the electronic device 410. The processor 411, read-only memory 412, and random access memory 413 are interconnected via a bus 414. An input / output interface 415 is also connected to the bus 414.

[0078] Multiple components in electronic device 410 are connected to input / output interface 415, including: input unit 416, such as keyboard, mouse, etc.; output unit 417, such as various types of monitors, speakers, etc.; storage unit 418, such as disk, optical disk, etc.; and communication unit 419, such as network card, modem, wireless transceiver, etc. Communication unit 419 allows electronic device 410 to exchange information / data with other devices through computer networks such as the Internet and / or various telecommunications networks.

[0079] Processor 411 can be a variety of general-purpose and / or special-purpose processing components with processing and computing capabilities. Some examples of processor 411 include, but are not limited to, central processing units, graphics processing units, various special-purpose artificial intelligence computing chips, various processors running machine learning model algorithms, digital signal processors, and any suitable processor, controller, microcontroller, etc. Processor 411 performs the various methods and processes described above, such as fault analysis methods based on large models.

[0080] In some embodiments, the large model-based fault analysis method can be implemented as a computer program tangibly contained in a computer-readable storage medium, such as storage unit 418. In some embodiments, part or all of the computer program can be loaded and / or installed on electronic device 410 via read-only memory 412 and / or communication unit 419. When the computer program is loaded into random access memory 413 and executed by processor 411, one or more steps of the large model-based fault analysis method described above can be performed. Alternatively, in other embodiments, processor 411 can be configured for the large model-based fault analysis method by any other suitable means (e.g., by means of firmware).

[0081] Various embodiments of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field-programmable gate arrays, application-specific integrated circuits (ASICs), application-specific standard products (ASICs), systems-on-a-chip (SoCs), payload programmable logic devices, computer hardware, firmware, software, and / or combinations thereof. These various embodiments may include implementations in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which may be a dedicated or general-purpose programmable processor, capable of receiving data and instructions from a storage system, at least one input device, and at least one output device, and transmitting data and instructions to the storage system, the at least one input device, and the at least one output device.

[0082] Computer programs used to implement the methods of this application may be written in any combination of one or more programming languages. These computer programs may be provided to the processor of a general-purpose computer, a special-purpose computer, or other programmable model-based fault analysis apparatus, such that when executed by the processor, the computer programs cause the functions / operations specified in the flowcharts and / or block diagrams to be implemented. The computer programs may be executed entirely on a machine, partially on a machine, or as a standalone software package, partially on a machine and partially on a remote machine, or entirely on a remote machine or server.

[0083] In the context of this application, a computer-readable storage medium can be a tangible medium that may contain or store a computer program for use by or in conjunction with an instruction execution system, apparatus, or device. A computer-readable storage medium can be, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, apparatus, or devices, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium can be a machine-readable signal medium. More specific examples of machine-readable storage media include electrical connections based on one or more wires, portable computer disks, hard disks, random access memory, read-only memory, erasable programmable read-only memory, optical fibers, portable compact disk read-only memory, optical storage devices, magnetic storage devices, or any suitable combination of the foregoing.

[0084] To provide interaction with a user, the systems and techniques described herein can be implemented on an electronic device having: a display device (e.g., a cathode ray tube or liquid crystal display monitor) for displaying information to the user; and a keyboard and pointing device (e.g., a mouse or trackball) through which the user provides input to the electronic device. Other types of devices can also be used to provide interaction with the user; for example, feedback provided to the user can be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user can be received in any form (including sound input, voice input, or tactile input).

[0085] The systems and technologies described herein can be implemented in computing systems that include backend components (e.g., as data servers), or computing systems that include middleware components (e.g., application servers), or computing systems that include frontend components (e.g., user computers with graphical user interfaces or web browsers through which users can interact with implementations of the systems and technologies described herein), or any combination of such backend, middleware, or frontend components. The components of the system can be interconnected via digital data communication of any form or medium (e.g., communication networks). Examples of communication networks include local area networks (LANs), wide area networks (WANs), blockchain networks, and the Internet.

[0086] A computing system can include clients and servers. Clients and servers are generally geographically separated and typically interact via communication networks. The client-server relationship is created by computer programs running on the respective computers and having a client-server relationship with each other. The server can be a cloud server, also known as a cloud computing server or cloud host, which is a host product within the cloud computing service system to address the shortcomings of traditional physical hosts and virtual private servers, such as high management difficulty and weak business scalability.

[0087] It should be understood that the various forms of processes shown above can be used to rearrange, add, or delete steps. For example, the steps described in this application can be executed in parallel, sequentially, or in different orders, as long as the desired result of the technical solution of this application can be achieved, and this is not limited herein.

[0088] The specific embodiments described above do not constitute a limitation on the scope of protection of this application. Those skilled in the art should understand that various modifications, combinations, sub-combinations, and substitutions can be made according to design requirements and other factors. Any modifications, equivalent substitutions, and improvements made within the spirit and principles of this application should be included within the scope of protection of this application.

Claims

1. A fault analysis method based on a large model, characterized in that, include: Based on the system status data of at least two subsystems in the target application system, and the system call relationships between the subsystems, a target system topology is generated corresponding to the target application system; wherein, the target application system refers to an application system with system faults. In the target system topology, faulty nodes that have experienced failures are marked, and fault prompt words are generated based on the fault information of the faulty nodes. The labeled target system topology and the fault prompt words are input into the fault analysis model to perform fault analysis on the faulty node; wherein, the fault analysis model is a pre-trained artificial intelligence model.

2. The method according to claim 1, characterized in that, The step of inputting the labeled target system topology and fault warning words into the fault analysis model to perform fault analysis on the faulty nodes includes: A large language model is used to perform semantic analysis and intent recognition on the fault prompt words to determine the fault location and intent recognition result corresponding to the fault prompt words. Based on the intent recognition result, the topology of the target system is traversed starting from the location of the fault occurrence to determine at least one candidate fault link. The link nodes in the candidate fault links are traversed to identify abnormal link nodes with abnormal system status data. At least one candidate fault root cause is generated based on the abnormal link node and the starting point of the traversal using a large language model.

3. The method according to claim 2, characterized in that, After generating candidate root causes of failures, the process also includes: A causal analysis instruction is generated based on the candidate root causes of failures, and the causal analysis instruction is input into the large language model for causal analysis to generate causal analysis results. The causal analysis includes causal logic analysis of the candidate root causes and causal fact analysis. The causal logic analysis is used to determine the probability of word sequence relationships between cause words and causal words in the candidate root causes. The causal fact analysis is used to determine whether the causal logic between causal pairs in the candidate root causes can be supported by evidence. Based on the causal analysis results, determine the corresponding causal confidence level for the candidate root cause of the failure, and determine the target root cause of the failure from the candidate root causes based on the causal confidence level.

4. The method according to claim 2, characterized in that, Traversing the link nodes in the candidate faulty links includes: During the traversal of candidate fault links, for the currently traversed link node, the corresponding node interface of the currently traversed link node is called to access the system status data corresponding to the currently traversed link node.

5. The method according to claim 1, characterized in that, The labeled target system topology can be used to characterize the location and degree of fault occurrence of the fault node, as well as the fault propagation path of the fault node.

6. The method according to claim 1, characterized in that, The target system topology can be updated in real time. The observation entities of the target system topology include hosts, processes, service instances and interfaces, and different observation entities correspond to different system status data.

7. A fault analysis device based on a large model, characterized in that, include: The system topology module is used to generate the target system topology structure corresponding to the target application system based on the system status data of at least two subsystems in the target application system and the system call relationship between the subsystems; wherein, the target application system refers to the application system with system failure; The prompt word generation module is used to mark the faulty nodes that have failed in the target system topology and generate fault prompt words based on the fault information of the faulty nodes. The fault analysis module is used to input the labeled target system topology and the fault prompt words into the fault analysis model to perform fault analysis on the fault node; wherein, the fault analysis model is a pre-trained artificial intelligence model.

8. An electronic device, characterized in that, include: One or more processors; Memory, used to store one or more programs; When the one or more programs are executed by the one or more processors, the one or more processors implement the large model-based fault analysis method as described in any one of claims 1-6.

9. A computer-readable storage medium having a computer program stored thereon, characterized in that, When executed by the processor, the program implements the large model-based fault analysis method as described in any one of claims 1-6.

10. A computer program product comprising a computer program that, when executed by a processor, implements the fault analysis method based on a large model according to any one of claims 1-6.

Images