A large model-based root cause positioning method, device and medium

Abstract

This invention provides a root cause localization method, device, and medium based on a large model, relating to the field of data processing technology. The method determines initial abnormal nodes and their corresponding initial abnormal scores based on a fault call chain graph and abnormal indicator data. Based on the call chain path from the starting point of the call chain graph to the initial abnormal node, the node identifier of the initial abnormal node, abnormal indicator data, target abnormal logs, historical fault cases, and the large model, it determines target abnormal nodes and obtains their corresponding predicted abnormal scores and node selection description text. Combining the initial abnormal scores, predicted abnormal scores, and adjusted weights obtained based on the node selection description text, it obtains the target abnormal score of the target abnormal node and sorts the target abnormal nodes accordingly to obtain the root cause localization result. This method not only integrates fault call chain topology and quantitative indicator data but also effectively utilizes fault semantic information in unstructured text such as logs, improving the accuracy of root cause localization.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a root cause localization method, device and medium based on a large model. Background Technology

[0002] In modern distributed systems and microservice architectures, service call relationships are becoming increasingly complex, and failures often involve multiple components and layers. Existing root cause localization methods mainly rely on analyzing the fault call chain topology and quantitative indicator data. They calculate the anomaly score of each node in the fault call chain topology using a preset scoring algorithm, sort all nodes in descending order of anomaly score, and select the top few nodes in the sorting results as the root cause localization results.

[0003] However, the above method also has the following technical problems:

[0004] The above methods mainly rely on fault call chain topology and quantitative indicator data for root cause localization. They are difficult to effectively parse the key fault semantics contained in unstructured texts such as logs and alarms, resulting in insufficient basis for judging the root cause of the fault. Consequently, the ranking results of each node in the root cause localization result deviate from the priority of the real root cause node, reducing the accuracy and reliability of root cause localization. Summary of the Invention

[0005] To address the aforementioned technical problems, the technical solution adopted by this invention is as follows:

[0006] According to a first aspect of the present invention, a root cause localization method based on a large model is provided, the method comprising the following steps:

[0007] S1. Based on the fault call chain graph and the abnormal indicator data corresponding to the fault, determine several initial abnormal nodes and obtain the initial abnormal score corresponding to each initial abnormal node; the initial abnormal node is a node in the call chain graph.

[0008] S2. Based on each initial abnormal node, obtain the key dataset; the key dataset includes: the node identifier of each initial abnormal node, several call chain paths from the starting point of the call chain graph to the initial abnormal node, as well as the abnormal indicator data, target abnormal logs, and historical failure cases corresponding to each initial abnormal node.

[0009] S3. Input the target prompt words into the large model. The large model will select at least one target abnormal node from all the initial abnormal nodes and output the abnormal identification results. The abnormal identification results include: the node identifier of each target abnormal node, the predicted abnormal score corresponding to the node identifier of each target abnormal node, and the node selection description text. The target prompt words are constructed based on the key dataset and the preset prompt word template.

[0010] S4. For each target anomaly node, based on the initial anomaly score, predicted anomaly score, and adjustment weight corresponding to the predicted anomaly score, obtain the target anomaly score corresponding to the target anomaly node; the adjustment weight corresponding to the predicted anomaly score is obtained based on the node selection description text.

[0011] S5. Sort all target anomaly nodes in descending order of their target anomaly scores to obtain root cause localization results.

[0012] According to a second aspect of the present invention, a non-transitory computer-readable storage medium is provided, wherein a computer program is stored in the storage medium, and the computer program is loaded and executed by a processor to implement the aforementioned method.

[0013] According to a third aspect of the present invention, an electronic device is provided, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the aforementioned method.

[0014] The present invention has at least the following beneficial effects:

[0015] This invention provides a root cause localization method, device, and medium based on a large model. In the method, based on the fault call chain graph and the corresponding abnormal indicator data, several initial abnormal nodes are determined, and an initial abnormal score is obtained for each initial abnormal node. Target prompt words are constructed based on a key dataset and a preset prompt word template. These target prompt words are input into the large model, which then selects at least one target abnormal node from all initial abnormal nodes and outputs the abnormal identification result. The key dataset includes: the node identifier of each initial abnormal node, several call chain paths from the start of the call chain graph to the initial abnormal node, and the node name of each initial abnormal node. The corresponding abnormal indicator data, target abnormal logs, and historical fault cases are included. The abnormal identification results include: the node identifier of each target abnormal node, the predicted abnormal score corresponding to the node identifier of each target abnormal node, and the node selection description text. For each target abnormal node, based on the initial abnormal score, the predicted abnormal score, and the adjustment weight corresponding to the predicted abnormal score, the target abnormal score corresponding to the target abnormal node is obtained, and all target abnormal nodes are sorted in descending order of target abnormal score to obtain the root cause localization results. Among them, the adjustment weight corresponding to the predicted abnormal score is obtained based on the node selection description text. As can be seen, this invention not only integrates fault call chain topology and quantitative indicator data, but also effectively utilizes the fault semantic information contained in unstructured text such as logs. By introducing historical fault cases and interpretable logical reasoning through a large model, it performs semantically enhanced anomaly re-evaluation on initial abnormal nodes, thereby filtering out target abnormal nodes. Furthermore, by combining the initial abnormal score, the predicted abnormal score, and the adjustment weight corresponding to the predicted abnormal score obtained based on the node selection description text, the target abnormal score of each target abnormal node is calculated. The target abnormal nodes are then accurately sorted according to the target abnormal score to obtain the root cause localization result, which significantly improves the accuracy, reliability, and scenario generalization ability of root cause localization. Attached Figure Description

[0016] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0017] Figure 1 This is a flowchart of a root cause localization method based on a large model, provided as an embodiment of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0019] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar tasks and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that comprises a series of steps or units is not necessarily limited to those explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0020] Embodiments of the present invention provide a root cause localization method based on a large model, the method comprising the following steps, such as... Figure 1 As shown:

[0021] S1. Based on the fault call chain graph and the abnormal indicator data corresponding to the fault, determine several initial abnormal nodes and obtain the initial abnormal score corresponding to each initial abnormal node; the initial abnormal node is a node in the call chain graph.

[0022] In one specific embodiment, step S1 includes the following sub-steps:

[0023] S11. Extract the fault call chain graph T from the graph database. T includes several nodes and dependency edges between nodes. Nodes are used to represent service instances, microservices, hosts, etc. The fault call chain graph is the complete call chain graph corresponding to the fault.

[0024] Specifically, the graph database is a database system that supports attribute graph models, such as Neo4j database, which will not be elaborated further here.

[0025] S12. Inject the abnormal indicator data corresponding to the fault into the attribute fields of each node in T so that T can be updated; the abnormal indicator data corresponding to the fault includes the abnormal indicator data corresponding to each node in T.

[0026] Specifically, for each node in T, the abnormal indicator data corresponding to the node includes: node identifier, indicator name of at least one preset monitoring indicator, and current indicator value corresponding to each indicator name; wherein, the preset monitoring indicator is a key performance indicator that can determine whether the corresponding node is abnormal through its indicator value, and includes at least error rate and latency.

[0027] Specifically, the node identifier is a unique identifier for the node.

[0028] Specifically, the current indicator value is the current indicator value.

[0029] Specifically, for each node in T, the abnormality index data corresponding to the node also includes an abnormality degree label, which is used to characterize the severity of the abnormality of the corresponding node, including: no abnormality, abnormality, and severe abnormality.

[0030] Furthermore, the anomaly level label is determined based on the current index values ​​of each preset monitoring indicator corresponding to the node. Those skilled in the art will understand that any existing method for determining the anomaly level label based on the current index values ​​of each preset monitoring indicator corresponding to a node falls within the scope of this invention. For example: if the current index value of each preset monitoring indicator corresponding to a node is less than the first preset monitoring threshold of its corresponding preset monitoring indicator, then the anomaly level label is determined to be "no anomaly"; if among the current index values ​​of all preset monitoring indicators corresponding to a node, there is one that exceeds the first preset monitoring threshold of its corresponding preset monitoring indicator, and there is no current index value that exceeds the second preset monitoring threshold of its corresponding preset monitoring indicator, then the anomaly level label is determined to be "abnormal"; otherwise, the anomaly level label is determined to be "severely abnormal"; the second preset monitoring threshold is greater than the first preset monitoring threshold; further details will not be elaborated here.

[0031] S13. Perform a pruning operation on T, removing all connected subgraphs whose anomaly level labels are all normal, as well as call paths whose path length is less than a preset path length threshold, so that T can be updated; the preset degree threshold is a threshold set by those skilled in the art according to actual needs, such as 3 or 4, which will not be elaborated here.

[0032] Specifically, the call path is a directed path that starts from the beginning of the call chain graph and ends at a certain node in T.

[0033] Specifically, the path length of the call path is the number of nodes included in the call path.

[0034] S14. For each node in T, obtain the initial anomaly score corresponding to the node.

[0035] Specifically, the y-th node J in T y The corresponding initial anomaly score Uy Meets the following conditions:

[0036] Where 1 ≤ y ≤ q, and q is the number of nodes in T; V yx For J y The preset weight Z corresponding to the x-th preset monitoring indicator. yx For J y The anomaly intensity is obtained by normalizing the current value of the corresponding x-th preset monitoring indicator, where 1 ≤ x ≤ p(y), and p(y) is J. y The corresponding number of preset monitoring indicators; γ is the influence breadth adjustment factor; DESC y For J y Number of reachable downstream nodes, DESC max GJ is the maximum number of downstream nodes corresponding to all nodes in T; y For J y The corresponding upstream cleanliness factor; where, when J y When all nodes directly and indirectly dependent on the upstream have anomaly level labels of no anomaly, GJ is determined. y =1, otherwise, determine GJ y =β, β<1.

[0037] Specifically, The specific values ​​of the preset weights of the preset monitoring indicators are set in advance by those skilled in the art based on the importance of the preset monitoring indicators, and will not be elaborated here.

[0038] Specifically, 0 ≤ γ ≤ 1, and the specific value of γ is preset by those skilled in the art according to actual needs, and will not be elaborated here.

[0039] Specifically, the number of downstream nodes corresponding to a node is the number of downstream nodes that can be reached from that node.

[0040] Specifically, β is a preset constant less than 1, for example, 0.5, which will not be elaborated further here.

[0041] S15. Sort all nodes in T in descending order of initial abnormal scores, and take the first g nodes in the sorting results as initial abnormal nodes, where g is a preset node number threshold. The preset node number threshold is a value set by those skilled in the art according to actual needs, such as 3 or 4, which will not be elaborated here.

[0042] Through the above steps, firstly, the complete call chain graph corresponding to the fault is extracted from the graph database, and the abnormal indicator data of each node is injected into its attribute fields to achieve a structured expression of the system's operating status in a unified graph structure. Then, the updated call chain graph is pruned, removing connected subgraphs with only normal nodes and excessively short call paths, allowing the graph structure to further focus on key areas that may participate in fault propagation and effectively reducing interference from irrelevant information. Based on this, for each node in the pruned call chain graph, a multi-dimensional anomaly assessment is performed, considering the anomaly intensity, impact breadth, and upstream cleanliness of its preset monitoring indicators, to obtain an initial anomaly score. This ensures that the initial anomaly score not only reflects the node's own anomaly level but also incorporates its contextual role in the call topology, significantly improving the accuracy of the initial anomaly score. Finally, all nodes are sorted in descending order of the initial anomaly score, and the top few are selected as initial anomaly nodes for use as input data to build a large model. This ensures that the input data has high relevance and low noise characteristics, effectively controlling the inference cost of the large model and providing a high-quality foundation for subsequent semantic enhancement and accurate ranking, thereby improving the overall accuracy of root cause localization.

[0043] S2. Based on each initial abnormal node, obtain the key dataset; the key dataset includes: the node identifier of each initial abnormal node, several call chain paths from the starting point of the call chain graph to the initial abnormal node, as well as the abnormal indicator data, target abnormal logs, and historical failure cases corresponding to each initial abnormal node.

[0044] Specifically, after step S1 and before step S2, the following steps S01-S02 are also included:

[0045] S01. For each initial exception node, based on the call chain graph, obtain the longest path from the starting point of the call chain graph to the initial exception node, and use the longest path as the candidate call path corresponding to the initial exception node.

[0046] Specifically, the longest path can be understood as the path that includes the most nodes.

[0047] Specifically, the starting point of the call chain graph is the first time a user request or system event associated with the fault enters the service interface or execution unit of the distributed system.

[0048] S02. Perform deduplication processing on all candidate call paths according to the preset deduplication rules, and use the deduplicated candidate call paths as the call chain paths from the starting point of the call chain graph to the initial exception node; wherein, the preset deduplication rules are: if L j For L e If the continuous subpaths are L, then L j Delete; L j For the j-th candidate call path, L eLet be the e-th candidate call path, 1≤j≤m, 1≤e≤m and e≠j, where m is the total number of candidate call paths; for example: if candidate call path 1 is: node A→node B→node C→node D; and candidate call path 2 is: node A→node B→node C→node D→node E; then it can be determined that candidate call path 1 is a continuous sub-path of candidate call path 2, and candidate call path 1 is deleted.

[0049] Through the above steps, for each initial abnormal node, the longest path from the starting point of the call chain graph to the initial abnormal node is obtained, and this longest path is used as the candidate call path corresponding to the initial abnormal node. This effectively preserves the most complete fault propagation context. Compared with selecting only any one or the shortest path, the longest path contains more nodes and dependencies between nodes, and can more comprehensively reflect the position of the initial abnormal node in the entire path and its possible dependency relationships. Furthermore, all candidate call paths are deduplicated according to a preset deduplication rule, and the deduplicated candidate call paths are used as the call chain paths from the starting point of the call chain graph to the initial abnormal node. This reduces the number of duplicate or highly overlapping candidate call paths, providing richer structured input for the subsequent large model to understand the fault propagation path. At the same time, without losing key context, it reduces the complexity of subsequent prompt word construction and the input noise of the large model, thereby improving the overall accuracy and interpretability of root cause localization.

[0050] Specifically, for each initial abnormal node, the abnormal log of the initial abnormal node within the target time period is determined as the target abnormal log corresponding to the initial abnormal node; the end time of the target time period is the time when the fault occurred, and the duration of the target time period is a preset duration; the preset duration is a duration pre-set by those skilled in the art according to actual needs, such as 1 hour, 2 hours, 3 hours, which will not be elaborated here.

[0051] Specifically, exception logs are log records generated by system components during operation that reflect their abnormal states; including but not limited to error stacks, timeout information, connection failure prompts, or resource exhaustion alarms.

[0052] Through the above steps, the abnormal logs of the initial abnormal node within the target time period are identified as the target abnormal logs corresponding to the initial abnormal node. By limiting the target abnormal logs to logs within a preset time period before the fault occurred, the focus is effectively placed on log content related to the current fault, avoiding interference from irrelevant historical logs, and providing more accurate and reliable semantic input for the large model.

[0053] Specifically, the historical failure cases corresponding to the initial abnormal node are obtained by querying the failure case database; the failure case database includes several failure cases, and each failure case includes failure description information and the node identifier of the root cause node corresponding to the failure description information.

[0054] Specifically, the failure case database includes failure cases corresponding to failures that have actually occurred and whose root cause analysis has been completed.

[0055] Specifically, the fault case also includes a fault case identifier corresponding to the fault description information; the fault case identifier is the unique identifier of the fault case.

[0056] Furthermore, if the node identifier of the initial abnormal node is consistent with the node identifier of the root cause node in the fault case, then the fault case is regarded as the historical fault case corresponding to the initial abnormal node.

[0057] By matching the initial abnormal nodes with the historical faults in the fault case database whose root causes have been confirmed, the relevant historical fault cases can be accurately obtained, and past diagnostic experience can be effectively reused. This not only enhances the contextual understanding of the current fault, but also provides high-value prior knowledge for large model reasoning, thereby improving the accuracy and reliability of root cause judgment.

[0058] Specifically, the abnormal indicator data corresponding to the initial abnormal node includes the node identifier, the indicator name of at least one preset monitoring indicator, and the current indicator value corresponding to each indicator name.

[0059] Specifically, the anomaly indicator data corresponding to the initial abnormal node also includes an anomaly degree label.

[0060] S3. Input the target prompt words into the large model. The large model will select at least one target abnormal node from all the initial abnormal nodes and output the abnormal identification results. The abnormal identification results include: the node identifier of each target abnormal node, the predicted abnormal score corresponding to the node identifier of each target abnormal node, and the node selection description text. The target prompt words are constructed based on the key dataset and the preset prompt word template.

[0061] Specifically, the large model is a large language model.

[0062] Specifically, data from the key dataset is injected into placeholders in a preset prompt word template to generate target prompt words; the preset prompt word template is a prompt word template pre-set by those skilled in the art according to actual needs, and will not be described in detail here.

[0063] Specifically, the node selection description text serves as the reasoning basis for the large model in natural language form, generated based on the target prompt words, and is used to explain why the initial abnormal node was selected as the target abnormal node.

[0064] Specifically, the predicted anomaly score should be no less than 0 and no greater than 1.

[0065] S4. For each target anomaly node, based on the initial anomaly score, predicted anomaly score, and adjustment weight corresponding to the predicted anomaly score, obtain the target anomaly score corresponding to the target anomaly node; the adjustment weight corresponding to the predicted anomaly score is obtained based on the node selection description text.

[0066] Specifically, the i-th target anomaly node C i The corresponding target anomaly score H i Meets the following conditions:

[0067] H i =W1×F i +W2×A i ×α; W1 is the importance weight corresponding to the initial anomaly score; F i For C i The score is obtained by normalizing the corresponding initial anomaly score; W2 is the importance weight corresponding to the predicted anomaly score; A i C i The corresponding predicted anomaly score; α is the adjustment weight corresponding to the predicted anomaly score; 1≤i≤n, where n is the number of target anomaly nodes.

[0068] Specifically, W1 represents the importance of the initial anomaly score; the larger W1 is, the higher the importance of the initial anomaly score. W2 represents the importance of the predicted anomaly score; the larger W2 is, the higher the importance of the predicted anomaly score. The specific values ​​of W1 and W2 are set by those skilled in the art according to actual needs, for example: W1=0.7, W2=0.3; W1=0.6, W2=0.4; W1=W2=0.5, which will not be elaborated here.

[0069] Specifically, F i Meets the following conditions:

[0070] F i =(Q i -Q min ) / (Q max -Q min ), where Q i C i The corresponding initial anomaly score, Q min Q is the minimum of the initial anomaly scores for all nodes in T. max It is the maximum value among the initial anomaly scores corresponding to all nodes in T.

[0071] Through the above steps, the initial anomaly score and the predicted anomaly score are weighted and fused, and the adjustment weight corresponding to the predicted anomaly score dynamically generated based on the node selection description text is introduced to calculate the target anomaly score. This not only preserves the objective and stable evaluation results based on the call chain and indicator data, but also fully integrates the semantic understanding of unstructured data such as logs, call chains, and historical failure cases by the large model, as well as the contextual reasoning ability of the large model. Furthermore, the target anomaly nodes are sorted based on the target anomaly score to obtain the root cause localization results, which significantly improves the accuracy, robustness, and adaptability to different failure scenarios of root cause localization.

[0072] Specifically, the anomaly identification results should include at least one node selection description text.

[0073] Specifically, when the anomaly identification result includes only one node selection description text, α is obtained based on the data source type D corresponding to the node selection description text and the preset data source type set E; where, if E does not include D, then α is determined to be 0; if E includes D, then α is obtained based on D and the key dataset; E includes log class, indicator class and case class.

[0074] Furthermore, when D is a log class, α is obtained based on the semantic similarity between B and the target abnormal log; when D is an indicator class, if B successfully matches the abnormal indicator data, then α=1; otherwise, α=0; when D is a case class, if B successfully matches the historical fault case, then α=1; otherwise, α=0.

[0075] Specifically, while outputting the anomaly identification results, the large model also outputs the data source type corresponding to the node selection description text. The data source types corresponding to the node selection description text include: log type, indicator type, historical case type, and other auxiliary information type.

[0076] Specifically, when the anomaly identification result includes multiple node selection description texts, for each node selection description text, the adjustment weight corresponding to that node selection description text is obtained based on the data source type and E corresponding to the node selection description text; the average of the adjustment weights corresponding to all node selection description texts is taken as α; wherein, the same method of obtaining α based on D and E is used to obtain the adjustment weight corresponding to that node selection description text based on the data source type and E corresponding to the node selection description text.

[0077] Through the above steps, when the data source type corresponding to the node selection description text is log type, the adjustment weight corresponding to the predicted anomaly score is obtained based on the semantic similarity between the node selection description text and the target abnormal log; when the data source type corresponding to the node selection description text is indicator type or case type, the adjustment weight corresponding to the predicted anomaly score is determined based on its matching result with abnormal indicator data or historical failure cases; when the data source type corresponding to the node selection description text is not any of log type, indicator type, or case type, the adjustment weight corresponding to the predicted anomaly score is determined to be 0; furthermore, when there are multiple node selection description texts, the adjustment weights corresponding to all node selection description texts are... The average weight of the weights is used as the adjustment weight corresponding to the predicted anomaly score. By introducing a data source type-aware dynamic adjustment mechanism, the adjustment weight can truly reflect the strength and verifiability of the factual basis for the large model's reasoning. This not only enhances the transparency and credibility of the scoring process but also effectively suppresses the interference of unfounded or low-relevance explanations on the results. Furthermore, the initial anomaly score and the predicted anomaly score are weighted and fused, and the adjustment weight corresponding to the predicted anomaly score dynamically generated based on the node selection description text is introduced to calculate a more accurate target anomaly score. The target anomaly nodes are sorted based on the target anomaly score to obtain the root cause localization results, which significantly improves the accuracy and reliability of root cause localization.

[0078] Specifically, in the step of obtaining α based on the semantic similarity between B and the target anomaly log, sub-steps S01-S03 are included:

[0079] S01. For each target anomalous log in the key dataset, the vector similarity between the semantic feature vector corresponding to B and the semantic feature vector of the target anomalous log is taken as the semantic similarity between B and the target anomalous log; wherein, the vector dimension of the semantic feature vector corresponding to B and the semantic feature vector of the target anomalous log are the same.

[0080] Specifically, feature extraction is performed on the target anomalous log to obtain the semantic feature vector of the target anomalous log; wherein, as those skilled in the art know, any method in the prior art for feature extraction of the target anomalous log to obtain the corresponding semantic feature vector is within the protection scope of this invention, such as: embedding methods based on pre-trained language models (such as BERT, Sentence-BERT) to map the target anomalous log into a fixed-dimensional semantic feature vector, which will not be elaborated here.

[0081] Furthermore, the semantic feature vector corresponding to B is obtained by using the same method as obtaining the semantic feature vector corresponding to the target anomaly log.

[0082] Specifically, the vector similarity is no greater than 1. The greater the vector similarity, the more similar the semantic feature vector of the corresponding target anomaly log is to the semantic feature vector corresponding to B.

[0083] Optionally, the cosine similarity between the semantic feature vector corresponding to B and the semantic feature vector of the target anomaly log can be used as the vector similarity between the semantic feature vector corresponding to B and the semantic feature vector of the target anomaly log. In some other embodiments, other methods can be used to obtain the vector similarity between the semantic feature vector corresponding to B and the semantic feature vector of the target anomaly log. For example, the vector distance between the semantic feature vector corresponding to B and the semantic feature vector of the target anomaly log can be converted into a value between 0 and 1, and this value can be used as the vector similarity between the semantic feature vector corresponding to B and the semantic feature vector of the target anomaly log. This will not be elaborated further here.

[0084] S02. Sort all semantic similarities in descending order to obtain a semantic similarity sequence, and take the first f semantic similarities in the semantic similarity sequence as the target similarity; f is a preset quantity threshold; the preset quantity threshold is a quantity threshold set in advance by those skilled in the art according to actual needs, such as 3, 5, which will not be elaborated here.

[0085] S03. When P > 0, let α = P; when P ≤ 0, let α = 0; P is the average of all target similarities.

[0086] Through the above steps, the vector similarity between the semantic feature vector corresponding to the node selection description text and the semantic feature vector of the target anomaly log is used as the semantic similarity between the node selection description text and the target anomaly log. After sorting all semantic similarities in descending order, the top few semantic similarities in the sorting results are selected as the target similarities. When the average of all target similarities is greater than 0, the average of all target similarities is used as the adjustment weight corresponding to the predicted anomaly score; otherwise, the adjustment weight corresponding to the predicted anomaly score is determined to be 0. This ensures that the adjustment weight is only assigned a valid value when there is a substantial semantic relationship between the node selection description text and the actual target anomaly log. This effectively suppresses the interference of unfounded or fictitious explanations on the target anomaly score, significantly improving the rationality of the obtained target anomaly score and the accuracy and reliability of the root cause localization results.

[0087] Specifically, the method further includes the following steps S001-S004:

[0088] S001. When D is an indicator class, perform structured parsing on B to obtain several key indicator data contained in B. The key indicator data includes: node identifier, indicator name, standard indicator value corresponding to the indicator name, and comparison relationship; the comparison relationship includes higher than, lower than, and equal to. For example, if B is "the error rate of auth-service is higher than 1%, significantly exceeding the normal threshold, which is the root cause of this failure", then the node identifier in the key indicator data obtained based on B is "auth-service", the indicator name is "error rate", the standard indicator value corresponding to the indicator name is "1%", and the comparison relationship is "higher than".

[0089] S002. For each key indicator data corresponding to B, when the node identifier in the abnormal indicator data in the key dataset is consistent with the node identifier in the key indicator data, and the abnormal indicator data includes the indicator name in the key indicator data, the current indicator value corresponding to the indicator name in the abnormal indicator data is taken as the indicator observation value corresponding to the key indicator data; for example, when the node identifier in the abnormal indicator data in the key dataset is "auth-service", the indicator name is "error rate", and the current indicator value corresponding to the indicator name is "8%", the indicator observation value corresponding to the key indicator data is "8%".

[0090] S003. Compare the standard indicator values ​​in the key indicator data with the corresponding indicator observation values, and determine the matching result of the key indicator data based on the comparison results and the comparison relationship in the key indicator data; the matching result includes successful matching and failed matching.

[0091] Specifically, the comparison results include: the observed value of the indicator is greater than the standard indicator value, the observed value of the indicator is less than the standard indicator value, and the observed value of the indicator is equal to the standard indicator value.

[0092] Specifically, in step S003, if the comparison relationship in the key indicator data is "higher than", then if the comparison result shows that the observed value of the indicator is greater than the standard indicator value, the matching result corresponding to the key indicator data is determined to be a successful match; otherwise, the matching result corresponding to the key indicator data is determined to be a failed match. If the comparison relationship in the key indicator data is "lower than", then if the comparison result shows that the observed value of the indicator is less than the standard indicator value, the matching result corresponding to the key indicator data is determined to be a successful match; otherwise, the matching result corresponding to the key indicator data is determined to be a failed match. If the comparison relationship in the key indicator data is "equal to", then if the comparison result shows that the observed value of the indicator is equal to the standard indicator value, the matching result corresponding to the key indicator data is determined to be a successful match; otherwise, the matching result corresponding to the key indicator data is determined to be a failed match. For example, if the observed value of the key indicator data is "8%", the standard indicator value is "1%", and the comparison relationship in the key indicator data is "higher than", then it can be known that the observed value of the indicator is greater than the standard indicator value, and the matching is determined to be successful.

[0093] S004. If all the key indicator data corresponding to B are successfully matched, then B is determined to be successfully matched with the abnormal indicator data; otherwise, B is determined to be unmatched with the abnormal indicator data.

[0094] Through the above steps, when the data source type corresponding to the node selection description text is log type, the node selection description text is structured and parsed to extract key indicator data. This data is then matched with abnormal indicator data in the key dataset to determine the corresponding indicator observation value. The standard indicator value in the key indicator data is compared numerically with the corresponding indicator observation value. Based on the comparison results and the comparison relationships within the key indicator data, the matching result for that key indicator data is determined. If all matching results for the key indicator data corresponding to the node selection description text are successful, then the node selection description text and the abnormal indicator data are considered successfully matched; otherwise, the matching is considered unsuccessful. This process automates and objectively verifies the inference results of the large model, effectively ensuring that the judgment has a real indicator basis and avoiding subjective inferences without factual support. This significantly improves the credibility of weight adjustment, the accuracy of target anomaly scores, and the accuracy and reliability of the final root cause localization results.

[0095] Specifically, the method further includes the following steps S0001-S0002:

[0096] S0001. When D is a case class, perform structured parsing on B to obtain several fault case identifiers corresponding to B.

[0097] S0002. If each fault case identifier corresponding to B belongs to the fault case identifier set corresponding to the key dataset, then it is determined that B is successfully matched with the historical fault case; otherwise, it is determined that B is not matched with the historical fault case. The fault case identifier set corresponding to the key dataset includes the fault case identifier in each historical fault case in the key dataset.

[0098] Specifically, 0 ≤ α ≤ 1; where, the larger α is, the higher the reliability of the predicted outlier score.

[0099] Through the above steps, when the data source type corresponding to the node selection description text is a case type, the corresponding fault case identifier is obtained by structured parsing of the node selection description text. When each fault case identifier corresponding to the node selection description text belongs to the fault case identifier set corresponding to the associated dataset, it is determined that the node selection description text and the historical fault case are successfully matched; otherwise, it is determined that the node selection description text and the historical fault case are not matched. This prevents the large model from fabricating or misciting historical cases, and ensures that the large model's case-based reasoning has a real and traceable basis, thereby significantly improving the credibility of weight adjustment, the accuracy of target anomaly scores, and the accuracy and reliability of the final root cause localization results.

[0100] S5. Sort all target anomaly nodes in descending order of their target anomaly scores to obtain root cause localization results.

[0101] Through the above steps, based on the fault call chain graph and the corresponding abnormal indicator data, several initial abnormal nodes are identified, and the initial abnormal score corresponding to each initial abnormal node is obtained. Target prompt words are constructed based on the key dataset and preset prompt word templates. These target prompt words are input into the large model, which then selects at least one target abnormal node from all initial abnormal nodes and outputs the abnormal identification result. The key dataset includes: the node identifier of each initial abnormal node, several call chain paths from the starting point of the call chain graph to the initial abnormal node, and the abnormal indicator data corresponding to each initial abnormal node, target abnormal logs, and historical fault cases. The abnormal identification result includes: the node identifier of each target abnormal node, the predicted abnormal score corresponding to the node identifier of each target abnormal node, and node selection description text. For each target abnormal node, based on the initial abnormal score, predicted abnormal score, and the predicted abnormal score corresponding to the target abnormal node... The algorithm adjusts weights to obtain the target anomaly score corresponding to the target anomaly node, and sorts all target anomaly nodes in descending order of target anomaly score to obtain root cause localization results. The adjusted weights corresponding to the predicted anomaly scores are obtained based on the node selection description text. This approach not only integrates fault call chain topology and quantitative indicator data, but also effectively utilizes the fault semantic information contained in unstructured text such as logs. Furthermore, it introduces historical fault cases and interpretable logical reasoning through a large model to perform semantically enhanced anomaly re-evaluation of the initial anomaly nodes, thereby filtering out target anomaly nodes. Further, by combining the initial anomaly score, the predicted anomaly score, and the adjusted weights corresponding to the predicted anomaly score obtained based on the node selection description text, the target anomaly score of each target anomaly node is calculated. The target anomaly nodes are then accurately sorted according to their target anomaly scores to obtain root cause localization results, significantly improving the accuracy, reliability, and scenario generalization ability of root cause localization.

[0102] Embodiments of the present invention also provide a non-transitory computer-readable storage medium that can be disposed in an electronic device to store a computer program related to implementing a method in the method embodiments, the computer program being loaded and executed by the processor to implement the method provided in the above embodiments.

[0103] Embodiments of the present invention also provide an electronic device, including: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method provided in the above embodiments.

[0104] Embodiments of the present invention also provide a computer program product including program code, which, when the program product is run on an electronic device, causes the electronic device to perform the steps of the methods described above in various exemplary embodiments of the present invention.

[0105] While specific embodiments of the invention have been described in detail by way of examples, those skilled in the art should understand that the examples are for illustrative purposes only and are not intended to limit the scope of the invention. Those skilled in the art should also understand that various modifications can be made to the embodiments without departing from the scope and spirit of the invention.

Claims

1. A root cause localization method based on a large model, characterized in that, The method includes the following steps: S1. Based on the fault call chain diagram and the abnormal indicator data corresponding to the fault, determine several initial abnormal nodes and obtain the initial abnormal score corresponding to each initial abnormal node. The initial exception node is a node in the call chain graph; S2. Based on each initial abnormal node, obtain the key dataset; The key dataset includes: the node identifier of each initial abnormal node, several call chain paths from the starting point of the call chain graph to the initial abnormal node, and the abnormal indicator data, target abnormal logs, and historical failure cases corresponding to each initial abnormal node. S3. Input the target prompt words into the large model. The large model will select at least one target anomaly node from all initial anomaly nodes and output the anomaly identification results and the data source type corresponding to the node selection description text. The anomaly identification results include: the node identifier of each target anomaly node, the predicted anomaly score corresponding to the node identifier of each target anomaly node, and the node selection description text. The target prompt words are constructed based on the key dataset and the preset prompt word template. The data source types corresponding to the node selection description text include: log type, indicator type, case type, and other auxiliary information type. S4. For each target anomaly node, based on the initial anomaly score, predicted anomaly score, and the adjustment weight α corresponding to the predicted anomaly score, obtain the target anomaly score corresponding to the target anomaly node; α is obtained based on the node selection description text B; where, if the preset data source type set E does not include the data source type D corresponding to B, then determine α=0; otherwise, obtain α based on D and the key dataset; E includes log class, indicator class, and case class; α is obtained based on D and the key dataset, including: When D is a log type, α is obtained based on the semantic similarity between B and the target exception log. When D is an indicator class, if B successfully matches the abnormal indicator data, then set α=1; otherwise, set α=0. When D is a case class, if B successfully matches a historical failure case, then let α=1; otherwise, let α=0. S5. Sort all target anomaly nodes in descending order of their target anomaly scores to obtain root cause localization results.

2. The root cause localization method based on a large model according to claim 1, characterized in that, The steps following step S1 and before step S2 include: S01. For each initial exception node, based on the call chain graph, obtain the longest path from the starting point of the call chain graph to the initial exception node, and use the longest path as the candidate call path corresponding to the initial exception node. S02. Perform deduplication processing on all candidate call paths according to the preset deduplication rules, and use the deduplicated candidate call paths as the call chain paths from the starting point of the call chain graph to the initial exception node; wherein, the preset deduplication rules are: if L j For L e If the continuous subpaths are L, then L j Delete; L j For the j-th candidate call path, L e Let be the e-th candidate call path, 1≤j≤m, 1≤e≤m and e≠j, and m be the total number of candidate call paths.

3. The root cause localization method based on a large model according to claim 1, characterized in that, For each initial abnormal node, the abnormal log of the initial abnormal node within the target time period is determined as the target abnormal log corresponding to the initial abnormal node; the end time of the target time period is the time when the fault occurred, and the duration of the target time period is the preset duration.

4. The root cause localization method based on a large model according to claim 1, characterized in that, The historical fault cases corresponding to the initial abnormal node are obtained by querying the fault case database; the fault case database includes several fault cases, and each fault case includes fault description information and the node identifier of the root cause node corresponding to the fault description information.

5. The root cause localization method based on a large model according to claim 4, characterized in that, If the node identifier of the initial abnormal node is consistent with the node identifier of the root cause node in the fault case, then the fault case is regarded as the historical fault case corresponding to the initial abnormal node.

6. The root cause localization method based on a large model according to claim 1, characterized in that, The i-th target abnormal node C i The corresponding target anomaly score H i The following conditions must be met: H i =W1×F i +W2×A i ×α; W1 is the importance weight corresponding to the initial anomaly score; F i For C i The score is obtained by normalizing the corresponding initial anomaly score; W2 is the importance weight corresponding to the predicted anomaly score; A i C i The corresponding predicted anomaly score; 1≤i≤n, where n is the number of target anomaly nodes.

7. The root cause localization method based on a large model according to claim 6, characterized in that, 0≤α≤1; where, the larger α is, the higher the reliability of the predicted outlier score.

8. The root cause localization method based on a large model according to claim 1, characterized in that, The call chain graph begins when a user request or system event associated with the fault first enters the service interface or execution unit of the distributed system.

9. A non-transitory computer-readable storage medium, characterized in that, The storage medium stores a computer program, which is loaded and executed by a processor to implement the root cause localization method based on a large model as described in any one of claims 1-8.

10. An electronic device, comprising: A processor, a memory, and a computer program stored in the memory and executable on the processor, characterized in that, when the processor executes the computer program, it implements the root cause localization method based on a large model as described in any one of claims 1-8.

Images