Method and system for automatic diagnosis of it system failures based on large language models

Abstract

The present application relates to the technical field of fault diagnosis, and more particularly to an IT system fault automatic diagnosis method and system based on a large language model, which comprises an IT diagnosis center, a heterogeneous data acquisition module, a diagnosis analysis module, a repair scheme matching module, a repair execution and verification module, and a diagnosis evaluation and attribution module; the present application realizes automatic collection and standardized processing of multi-source heterogeneous operation and maintenance data, solves the problem of traditional scattered data, provides comprehensive and accurate data support for diagnosis, and improves root cause positioning efficiency and accuracy by combining a large language model and a text similarity algorithm, thereby eliminating the dependence on artificial experience; through three-level repair verification and full-process closed-loop evaluation of "alarm-indicator-root cause", the effectiveness of repair is ensured, the failure root cause is accurately located, the blindness of optimization is avoided, the scheme library and case library are dynamically updated, the IT environment changes are adapted, the diagnosis and repair capability is continuously improved, and the operation and maintenance cost is reduced.

Description

Technical Field

[0001] This invention relates to the field of fault diagnosis technology, and in particular to an automatic fault diagnosis method and system for IT systems based on a large language model. Background Technology

[0002] As IT system architectures become increasingly complex and technologies such as distributed systems and microservices are widely used, the causes of failures in IT environments are becoming more diverse, and the propagation paths of failures are becoming more concealed. This poses a significant challenge to the fault diagnosis and repair work of operations and maintenance personnel. Currently, traditional IT fault diagnosis methods rely heavily on the experience accumulated by operations and maintenance personnel, resulting in many problems such as low diagnostic efficiency, delayed response, and inaccurate root cause location. At the data processing level: some monitoring systems can only collect a single type of data, resulting in data coverage blind spots, which can easily lead to incomplete fault diagnosis and omission of key fault clues; at the root cause diagnosis and remediation solution matching level, traditional methods mostly involve manual analysis of logs and indicators, which is not only time-consuming and labor-intensive, but also easily affected by differences in personal experience, leading to biased root cause location; at the diagnostic result evaluation and optimization level: existing technologies often only focus on successful diagnostic cases, neglecting the analysis and summary of failed diagnostic cases, resulting in the inability to accurately locate weak links in the diagnostic process, blind optimization direction, and difficulty in achieving continuous improvement of diagnostic capabilities; To address the aforementioned technical shortcomings, a solution is proposed. Summary of the Invention

[0003] The purpose of this invention is to provide an automatic fault diagnosis method and system for IT systems based on a large language model, in order to solve the aforementioned technical defects. This invention realizes automatic collection and standardized processing of multi-source heterogeneous operation and maintenance data, solving the problem of fragmented traditional data and providing comprehensive and accurate data support for diagnosis. At the same time, it combines a large language model and text similarity algorithm to improve the efficiency and accuracy of root cause location, eliminating the reliance on human experience. Through a three-level repair verification of "alarm-indicator-root cause" and a closed-loop evaluation of the whole process, it ensures the effectiveness of repair, accurately locates the root cause of failure, avoids blind optimization, and dynamically updates the solution library and case library to adapt to changes in the IT environment, continuously improves diagnostic and repair capabilities, and reduces operation and maintenance costs.

[0004] The objective of this invention can be achieved through the following technical solution: an automatic fault diagnosis system for IT systems based on a large language model, comprising an IT diagnosis center, a heterogeneous data acquisition module, a diagnosis analysis module, a repair solution matching module, a repair execution and verification module, and a diagnosis evaluation and attribution module; The heterogeneous data acquisition module is used to automatically collect multi-source heterogeneous operation and maintenance data through existing monitoring components deployed in the target IT and send them to the IT diagnostic center for storage. The diagnostic analysis module is used to preprocess and extract features from the collected multi-source heterogeneous operation and maintenance data to obtain an initial standardized dataset. Based on the diagnostic analysis of the initial standardized dataset, it outputs an executable repair suggestion scheme. The repair plan matching module is used to extract the root cause classification from the structured diagnostic results, perform plan matching and result output analysis on the root cause classification, and obtain prompt information on executable repair suggestions and no matching repair suggestions; The repair execution and verification module is used to perform operations according to the executable repair suggestion and record key information. It extracts the core fault characteristics before repair as the verification baseline, and sequentially verifies the alarm clearing, indicator regression and root cause elimination. Finally, it outputs the resolution signal or the list of unrepaired items. The diagnostic assessment and attribution module is used to evaluate diagnostic results through a three-level verification mechanism of confidence score, data flow integrity, and repair result verification. It stores the identified failure cases in the diagnostic failure case library, classifies and statistically analyzes the failure types and locates the root causes, and outputs an attribution analysis report.

[0005] Preferably, the diagnostic analysis module performs the following analysis: S1: Data preprocessing and feature extraction steps: Clean, normalize, and context-enhanced the collected multi-source heterogeneous operation and maintenance data, and extract features to obtain an initial standardized dataset; S2: Input the preprocessed initial standardized dataset into a pre-set large language model, and the large language model outputs structured diagnostic results; S3: The structured diagnostic results include root cause classification, chain of evidence, and confidence score; S4: Based on the root cause classification in the structured diagnostic results, further match and output an executable repair suggestion.

[0006] Preferably, the matching process for the executable repair suggestion scheme is as follows: Based on the root cause classification in the structured diagnostic results, a pre-built library of executable remediation suggestions is retrieved. The root cause classification in the structured diagnostic results is then precisely matched with the root cause classification associated with each suggestion in the executable remediation suggestion library. Specifically: A preset text similarity algorithm is used to semantically match the root cause classification in the structured diagnostic results with the root cause classification associated in the executable repair suggestion library, so as to obtain the executable repair suggestion corresponding to the root cause classification or mark the root cause classification as a state to be supplemented. Output the executable repair suggestions obtained from the matching. For root cause categories marked as pending supplementation, output a prompt message indicating that there are no matching repair suggestions.

[0007] Preferably, the analysis process of the repair execution and verification module is as follows: T1: Perform the operation according to the feasible repair suggestion, and record the key information during the operation process; T2: Extract the core fault characteristics of the target IT before repair as a verification baseline; T3: Based on the fault alarm type in the verification baseline, confirm whether the fault alarm has been cleared and no new alarm of the same type has been generated. If so, generate a feedback signal; otherwise, record the alarm duration and new alarm details, and then build a repair feedback list.

[0008] Preferably, when a feedback signal is generated, the instantaneous value and the average value of the parameter value after repair corresponding to the abnormal indicator in the verification baseline are extracted (the average value within the preset time period after repair). It is determined whether it has returned to the normal threshold range. If it has, a progressive signal is generated. If not, the abnormal indicators that have not returned to the normal threshold range are recorded, and an indicator feedback list is constructed.

[0009] Preferably, when generating the progressive signal, for the output root cause classification, it is verified whether the corresponding root cause feature has been eliminated: if the root cause classification is eliminated, a resolution signal is generated; if the root cause classification is not eliminated, an unrepaired list is output.

[0010] Preferably, the attribution analysis report acquisition process is as follows: Step 1: Extract the confidence score from the structured diagnostic results, analyze the confidence score to obtain the identification failure signal corresponding to the identification failure case or the identification success signal; Step 2: When a successful identification signal is generated, determine whether there is a process abnormality in the collection and processing of multi-source heterogeneous operation and maintenance data, and obtain the identification failure case or the diagnosis normal signal corresponding to the diagnosis abnormality signal. Step 3: When a normal diagnostic signal is generated, the repair results of the executable repair suggestion plan are further analyzed to obtain the corresponding failure case or successful diagnostic signal. Step 4: Store the failed cases in the diagnostic failure case database according to a unified standard format; Step 5: Based on the diagnostic failure case library, classify and statistically analyze the failure types (insufficient confidence type, data flow abnormal type, and ineffective repair type), locate the root cause for each failure type, and finally output an attribution analysis report.

[0011] The beneficial effects of this invention are as follows: (1) This invention achieves comprehensive coverage and precise extraction of IT environment fault-related data through automatic collection and standardized preprocessing of multi-source heterogeneous operation and maintenance data, laying a solid data foundation for subsequent diagnosis and analysis. It outputs structured diagnostic results with the help of large language models and achieves precise matching of repair solutions by combining text similarity algorithms, which greatly improves the efficiency and accuracy of fault root cause location and solves the pain points of relying on human experience and delayed response in traditional diagnosis. (2) This invention ensures the effectiveness of repair operations through a three-level repair verification process of “alarm-indicator-root cause”, avoids the risk of secondary failure caused by blind repair, and the dynamic update design of the executable repair suggestion library and the diagnostic failure case library can continuously adapt to changes in the IT environment and new types of faults, continuously improve the accuracy of subsequent fault diagnosis and repair success rate, reduce IT operation and maintenance costs, and ensure the stable operation of IT systems. Attached Figure Description

[0012] The invention will now be further described with reference to the accompanying drawings; Figure 1 This is a flowchart of the system of the present invention; Figure 2 This is a reference analysis diagram of the method of the present invention; Figure 3 This is a reference diagram for the analysis of the repair execution and verification module. Detailed Implementation

[0013] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0014] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of the invention. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments; Example 1: Please see Figures 1 to 3 As shown, this invention is an automatic fault diagnosis system for IT systems based on a large language model, including an IT diagnostic center, a heterogeneous data acquisition module, a diagnostic analysis module, a repair solution matching module, a repair execution and verification module, and a diagnostic evaluation and attribution module. The IT diagnostic center and the heterogeneous data acquisition module have a bidirectional communication connection, the IT diagnostic center and the diagnostic analysis module have a unidirectional communication connection, the diagnostic analysis module and the repair solution matching module have a bidirectional communication connection, the diagnostic analysis module and the diagnostic evaluation and attribution module have a unidirectional communication connection, and the repair solution matching module and the repair execution and verification module have a unidirectional communication connection. The heterogeneous data acquisition module is used to automatically collect multi-source heterogeneous operation and maintenance data through existing monitoring components deployed in the target IT and send them to the IT diagnostic center for storage. This involves automatically collecting multi-source heterogeneous operational data through agents deployed in the target IT infrastructure or by integrating with existing monitoring components (such as Prometheus, ELK, and Zabbix). This operational data includes application logs, system and middleware logs, resource metrics, and network traffic and topology data. Application logs include error stacks and transaction logs; system and middleware logs include OS logs and database slow query logs; resource metrics include time-series data such as CPU utilization, memory usage, disk I / O latency, and network throughput; and network traffic and topology data includes inter-service call chains, network latency, and packet loss rate. The diagnostic analysis module is used to preprocess and extract features from the collected multi-source heterogeneous operation and maintenance data to obtain an initial standardized dataset. Based on the diagnostic analysis of the initial standardized dataset, it outputs executable repair suggestions, specifically including: S1: Data preprocessing and feature extraction steps: Cleaning, normalizing and context-enhancing the collected multi-source heterogeneous operation and maintenance data, and feature extraction are performed to obtain an initial standardized dataset. This also includes keyword extraction and labeling of log text, calculation of anomaly scores of indicator data through a sliding window, construction of a service dependency graph based on call chain data, and alignment of all data by timestamp and appending metadata. The metadata includes host IP, service name, and environment label. S2: Input the preprocessed initial standardized dataset into a pre-set large language model, and the large language model outputs structured diagnostic results; S3: The structured diagnostic results include root cause classification (such as "Insufficient database memory leading to OOM"), chain of evidence (referencing specific log lines and indicators), confidence score (value from 0 to 100), etc. S4: Based on the root cause classification in the structured diagnostic results, further match and output an executable repair suggestion plan, which is immediately displayed on the back-end visual panel. The executable repair suggestion plan includes root cause classification and repair suggestions (structured operation instructions). The repair plan matching module is used to extract root cause classification from the structured diagnostic results, perform plan matching and result output analysis on the root cause classification, and obtain prompts for executable repair suggestions and no matching repair suggestions. The specific matching process for executable repair suggestions is as follows: Based on the root cause classification in the structured diagnostic results, a pre-built library of executable repair suggestions is retrieved. The library stores several sets of executable repair suggestions, each set of which is associated with a unique root cause classification and contains structured operation instructions corresponding to that root cause classification. The root cause classification in the structured diagnostic results is precisely matched with the root cause classification associated with each solution in the executable remediation suggestion library. Specifically: A preset text similarity algorithm is used to semantically match the root cause classification in the structured diagnostic results with the root cause classification associated in the executable repair suggestion library. When the similarity is greater than or equal to the preset similarity threshold, it is determined to be completely consistent, and the executable repair suggestion corresponding to the root cause classification is extracted. If the similarity is less than the preset similarity threshold, it is further confirmed by manual review whether they are different expressions of the same root cause classification. If they still cannot be matched after manual review, they are marked as pending supplementation. The output is an executable repair suggestion scheme obtained from the matching, and the executable repair suggestion scheme includes at least the root cause classification and the corresponding structured operation instructions; For root cause classifications marked as pending supplementation, a prompt message indicating no matching repair suggestion (such as "not matched") is output synchronously. The executable remediation suggestion library covers common fault types in the target IT environment, including but not limited to database memory shortage leading to OutOfMemoryError (OOM), connection pool exhaustion, service call timeout, excessive disk I / O latency, and abnormal network packet loss rate. Each set of executable remediation suggestion solutions contains structured operation instructions that are practical and clearly define the operation target, operation steps, operation parameter range, and operation verification standards. The executable remediation suggestion library supports dynamic updates, adding new root cause categories and corresponding remediation suggestions, and optimizing the structured operation instructions of existing remediation suggestions. The structured operation instructions should include at least the following dimensions of information: Operation subject: clearly define the target object of the repair operation, such as a database service corresponding to a specific host IP, middleware with a specified service name, or a network topology node; Operation action: clearly define the specific operation type to be performed, such as configuration adjustment, service restart, resource expansion, or parameter modification; Operation parameters: clearly define the specific parameters and values ​​corresponding to the operation action, such as MySQL memory configuration values ​​or restart timeout thresholds; Operation order: if there are multiple operations, clearly define the execution order of each operation; Operation verification points: clearly define the core indicators, log keywords, and alarm status that need to be verified after the repair operation is executed, to determine whether the repair is effective.

[0015] Example 2: The repair execution and verification module is used to execute operations according to the executable repair suggestions and record key information. It extracts the core fault characteristics before repair as the verification baseline, and sequentially verifies the alarm clearance, indicator regression, and root cause elimination. Finally, it outputs a resolution signal or an unrepaired list, specifically including: T1: Perform the operation according to the executable repair suggestion, and record the key information during the operation process. The key information includes the execution timestamp, the operator, the actual execution parameters (such as the restart timeout threshold and the expansion configuration value), and the execution result (success / failure / partial execution). T2: Extract the core fault characteristics of the target IT before repair as the verification baseline, including: fault alarm type (such as order service timeout), abnormal indicator values ​​(such as MySQL memory utilization of 98%), key log keywords (such as "OOM" "DBconnectiontimeout"), etc. T3: Based on the fault alarm type in the verification baseline, confirm whether the fault alarm has been cleared and no new alarm of the same type has been generated. If so, generate a feedback signal. If not, record the alarm duration, new alarm details and other information, and then build a repair feedback list and display it immediately on the backend visual panel. When a feedback signal is generated, the instantaneous value and the average value of the parameter value after repair corresponding to the abnormal indicator in the verification baseline are extracted. The average value within the preset time period after repair is determined to determine whether it has returned to the normal threshold range. If it has, an incremental signal is generated. If not, the abnormal indicators that have not returned to the normal threshold range are recorded, an indicator feedback list is constructed, and it is immediately displayed on the backend visual panel. T4: When a progressive signal is generated, the corresponding root cause features are verified for the output root cause classification. If the root cause classification is eliminated, a resolution signal is generated and the corresponding preset text is immediately displayed on the backend visual panel. If the root cause classification is not eliminated, an unrepaired list is output. The unrepaired list includes information such as root cause classification and execution timestamp, and is immediately displayed on the backend visual panel. For example: If the root cause is classified as insufficient database memory leading to OOM, check whether the MySQL configuration has been adjusted according to the repair suggestions, whether the memory allocation meets the service requirements, and whether there are any triggering conditions for another OOM. If the root cause is classified as connection pool exhaustion: check whether the Redis connection pool configuration (such as max_connections) has been expanded, and whether the connection utilization rate has dropped from 100% to a safe range (such as ≤70%). The diagnostic assessment and attribution module evaluates diagnostic results through a three-level verification mechanism: confidence scoring, data flow integrity, and repair result verification. It stores failed cases in a diagnostic failure case database, categorizes and statistically analyzes failure types, identifies root causes, and outputs an attribution analysis report, specifically including: Step 1: Extract the confidence score from the structured diagnostic results and analyze the confidence score. If the confidence score is less than the preset confidence score threshold, an identification failure signal is generated, and the fault diagnosis event of the target IT is marked as an identification failure case. If the confidence score is greater than or equal to the preset confidence score threshold, an identification success signal is generated. Step 2: When a successful identification signal is generated, it is determined whether there is a process abnormality in the collection and processing of multi-source heterogeneous operation and maintenance data (such as data loss, unrecoverable abnormal error in preprocessing). If so, a diagnostic abnormality signal is generated to obtain the identification failure case; otherwise, a diagnostic normal signal is generated. Step 3: When a normal diagnostic signal is generated, the results of the executable repair suggestions are further analyzed. If the result of the executable repair suggestions is that the fault is not eliminated or recurs within a preset time (e.g., 30 minutes), a diagnostic failure signal is generated, and the case of failure is identified. If the result of the executable repair suggestions is that the fault is eliminated or does not recur within a preset time (e.g., 30 minutes), a diagnostic success signal is generated. Step 4: Store the identified failed cases into the diagnostic failure case library according to a unified standard format. The content of the identified failed cases includes: original input data (multi-source heterogeneous operation and maintenance data), preprocessing results (initial standardized dataset), structured diagnostic results, etc. Step 5: Based on the diagnostic failure case library, classify and statistically analyze the failure types (insufficient confidence type, data flow abnormal type, and ineffective repair type). At the same time, locate the root cause for each failure type, and finally output the attribution analysis report, which is immediately displayed on the backend visual panel to clarify the optimization direction (such as model iteration, data collection scheme upgrade, repair suggestion library expansion, etc.). For each type of failure, locate the root cause: Insufficient confidence type: Analyze the effectiveness of feature extraction, the rationality of diagnostic model parameters, and the matching degree between fault features and historical samples. Data flow anomaly type: Investigate the stability of the data acquisition interface and the completeness of the data quality verification rules; Ineffective Repair: Verify the correlation between repair recommendations and the root cause of the failure, the effectiveness of repair operations, and the impact of environmental variables (such as IT equipment load and network status) on the repair results; In summary, this study analyzes the overall success of the target IT fault diagnosis from the perspective of the entire fault diagnosis process. This is achieved through a three-level verification mechanism—confidence scoring, data flow integrity, and repair result verification—to realize a closed-loop evaluation of the entire fault diagnosis process, significantly improving the reliability and credibility of the results. Furthermore, for failed fault diagnoses, the study specifically identifies the root causes, addressing the problem of blind optimization caused by "focusing only on successful cases and ignoring failure experiences" in traditional fault diagnosis. Additionally, the optimization direction helps improve the accuracy of subsequent fault diagnoses.

[0016] Example 3: An automatic fault diagnosis method for IT systems based on large language models includes the following steps: Step 1: Data Acquisition: Automatically collect multi-source heterogeneous operation and maintenance data by deploying agents in the target IT environment or connecting to existing monitoring systems; Step 2: Data Preprocessing and Feature Extraction Steps: Clean, normalize, and context-enhanced the collected multi-source heterogeneous operation and maintenance data, and extract features to obtain an initial standardized dataset; Step 3: Diagnostic Analysis Step: Input the preprocessed initial standardized dataset into the pre-set large language model, and the large language model outputs structured diagnostic results; Step 4: Repair Solution Matching Step: Based on the root cause classification in the structured diagnostic results, further match pre-set executable repair suggestions, which include root cause classification and structured operation instructions; Step 5: Repair Execution and Verification: Perform the operation according to the matched executable repair suggestions and verify the repair effect. Finally, output the resolution signal or the list of unrepaired items. Step Six: Diagnostic Result Evaluation Step: Through a three-level verification mechanism of confidence scoring, data flow integrity, and repair result verification, the target IT fault diagnosis results are evaluated in a closed-loop manner throughout the entire process to locate the root cause of the diagnosis failure and output an attribution analysis report. In summary, this invention overcomes the problem of incomplete diagnosis caused by single data sources and chaotic formats in traditional fault diagnosis by automatically collecting and standardizing multi-source heterogeneous operation and maintenance data. It achieves comprehensive coverage and accurate extraction of IT environment fault-related data, laying a solid data foundation for subsequent diagnostic analysis. By using a large language model to output structured diagnostic results and combining text similarity algorithms to achieve accurate matching of repair solutions, it significantly improves the efficiency and accuracy of fault root cause location, solving the pain points of traditional diagnosis that rely on human experience and have slow response. At the same time, through the three-level repair verification process of "alarm-indicator-root cause", it ensures the effectiveness of repair operations and avoids the risk of secondary faults caused by blind repair. It can not only accurately judge the reliability of diagnostic results, but also classify and attribute the causes of diagnostic failure cases, effectively solving the problem of blind optimization caused by "emphasizing success and neglecting failure" in traditional fault diagnosis. The dynamic update design of the executable repair suggestion library and the diagnostic failure case library can continuously adapt to changes in the IT environment and new fault types, continuously improve the accuracy and repair success rate of subsequent fault diagnosis, reduce IT operation and maintenance costs, and ensure the stable operation of IT systems.

[0017] The threshold is set for comparative analysis of results to determine whether they are good or bad. The value of the threshold is determined by a combination of large-scale model analysis of sample data and human experience. It can also be adjusted appropriately based on seasonal or common-sense influencing factors.

[0018] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. An automatic fault diagnosis system for IT systems based on a large language model, characterized in that, It includes an IT diagnostic center, a heterogeneous data acquisition module, a diagnostic analysis module, a remediation solution matching module, a remediation execution and verification module, and a diagnostic assessment and attribution module; The heterogeneous data acquisition module is used to automatically collect multi-source heterogeneous operation and maintenance data through existing monitoring components deployed in the target IT and send them to the IT diagnostic center for storage. The diagnostic analysis module is used to preprocess and extract features from the collected multi-source heterogeneous operation and maintenance data to obtain an initial standardized dataset. Based on the diagnostic analysis of the initial standardized dataset, it outputs an executable repair suggestion scheme. The repair plan matching module is used to extract the root cause classification from the structured diagnostic results, perform plan matching and result output analysis on the root cause classification, and obtain prompt information on executable repair suggestions and no matching repair suggestions; The repair execution and verification module is used to perform operations according to the executable repair suggestion and record key information. It extracts the core fault characteristics before repair as the verification baseline, and sequentially verifies the alarm clearing, indicator regression and root cause elimination. Finally, it outputs the resolution signal or the list of unrepaired items. The diagnostic assessment and attribution module is used to evaluate diagnostic results through a three-level verification mechanism of confidence score, data flow integrity, and repair result verification. It stores the identified failure cases in the diagnostic failure case library, classifies and statistically analyzes the failure types and locates the root causes, and outputs an attribution analysis report.

2. The automatic fault diagnosis system for IT systems based on a large language model according to claim 1, characterized in that, The diagnostic analysis module performs the following analysis process: S1: Data preprocessing and feature extraction steps: Clean, normalize, and context-enhanced the collected multi-source heterogeneous operation and maintenance data, and extract features to obtain an initial standardized dataset; S2: Input the preprocessed initial standardized dataset into a pre-set large language model, and the large language model outputs structured diagnostic results; S3: The structured diagnostic results include root cause classification, chain of evidence, and confidence score; S4: Based on the root cause classification in the structured diagnostic results, further match and output an executable repair suggestion.

3. The automatic fault diagnosis system for IT systems based on a large language model according to claim 1, characterized in that, The matching process for the executable repair suggestion: Based on the root cause classification in the structured diagnostic results, a pre-built library of executable remediation suggestions is retrieved. The root cause classification in the structured diagnostic results is then precisely matched with the root cause classification associated with each suggestion in the executable remediation suggestion library. Specifically: A preset text similarity algorithm is used to semantically match the root cause classification in the structured diagnostic results with the root cause classification associated in the executable repair suggestion library, so as to obtain the executable repair suggestion corresponding to the root cause classification or mark the root cause classification as a state to be supplemented. Output the executable repair suggestions obtained from the matching. For root cause categories marked as pending supplementation, output a prompt message indicating that there are no matching repair suggestions.

4. The automatic fault diagnosis system for IT systems based on a large language model according to claim 1, characterized in that, The analysis process of the repair execution and verification module is as follows: T1: Perform the operation according to the feasible repair suggestion, and record the key information during the operation process; T2: Extract the core fault characteristics of the target IT before repair as a verification baseline; T3: Based on the fault alarm type in the verification baseline, confirm whether the fault alarm has been cleared and no new alarm of the same type has been generated. If so, generate a feedback signal; otherwise, record the alarm duration and new alarm details, and then build a repair feedback list.

5. The automatic fault diagnosis system for IT systems based on a large language model according to claim 4, characterized in that, When a feedback signal is generated, the instantaneous value and the average value of the parameter corresponding to the abnormal indicator in the verification baseline after repair are extracted (the average value within the preset time period after repair). It is determined whether the value has returned to the normal threshold range. If yes, an incremental signal is generated. If no, the abnormal indicators that have not returned to the normal threshold range are recorded, and an indicator feedback list is constructed.

6. The automatic fault diagnosis system for IT systems based on a large language model according to claim 5, characterized in that, When generating a progressive signal, for the output root cause classification, verify whether the corresponding root cause features have been eliminated: if the root cause classification is eliminated, generate a resolution signal; if the root cause classification is not eliminated, output an unresolved list.

7. The automatic fault diagnosis system for IT systems based on a large language model according to claim 1, characterized in that, The process for obtaining the attribution analysis report is as follows: Step 1: Extract the confidence score from the structured diagnostic results, analyze the confidence score to obtain the identification failure signal corresponding to the identification failure case or the identification success signal; Step 2: When a successful identification signal is generated, determine whether there is a process abnormality in the collection and processing of multi-source heterogeneous operation and maintenance data, and obtain the identification failure case or the diagnosis normal signal corresponding to the diagnosis abnormality signal. Step 3: When a normal diagnostic signal is generated, the repair results of the executable repair suggestion plan are further analyzed to obtain the corresponding failure case or successful diagnostic signal. Step 4: Store the failed cases in the diagnostic failure case database according to a unified standard format; Step 5: Based on the diagnostic failure case library, classify and statistically analyze the failure types (insufficient confidence type, data flow abnormal type, and ineffective repair type), locate the root cause for each failure type, and finally output an attribution analysis report.

8. An automatic fault diagnosis method for IT systems based on a large language model, wherein the method is applied to the automatic fault diagnosis system for IT systems based on a large language model as described in any one of claims 1-7, characterized in that, Includes the following steps: Step 1: Data Acquisition: Automatically collect multi-source heterogeneous operation and maintenance data by deploying agents in the target IT environment or connecting to existing monitoring systems; Step 2: Data Preprocessing and Feature Extraction Steps: Clean, normalize, and context-enhanced the collected multi-source heterogeneous operation and maintenance data, and extract features to obtain an initial standardized dataset; Step 3: Diagnostic Analysis Step: Input the preprocessed initial standardized dataset into the pre-set large language model, and the large language model outputs structured diagnostic results; Step 4: Repair Solution Matching Step: Based on the root cause classification in the structured diagnostic results, further match pre-set executable repair suggestions, which include root cause classification and structured operation instructions; Step 5: Repair Execution and Verification: Perform the operation according to the matched executable repair suggestions and verify the repair effect. Finally, output the resolution signal or the list of unrepaired items. Step Six: Diagnostic Result Evaluation Step: Through a three-level verification mechanism of confidence scoring, data flow integrity, and repair result verification, the target IT fault diagnosis results are evaluated in a closed-loop manner throughout the entire process to locate the root cause of the diagnosis failure and output an attribution analysis report.

Images