Fault positioning method, device, equipment, storage medium and program product

Abstract

Embodiments of the present application provide a fault positioning method, device, equipment, storage medium and program product. The method comprises: obtaining operation and maintenance data of a bank data center, performing intelligent compression processing on alarm events in the operation and maintenance data based on content similarity to obtain high-quality alarm context, generating a scenarioized prompt word in combination with configuration change records, inputting the prompt word into a large language model for multi-dimensional parallel analysis, and finally generating a fault diagnosis report containing root cause positioning based on the analysis result. The method is used to solve the problems of low positioning efficiency, poor accuracy and excessive dependence on manual experience of the fault emergency response in the prior art, and achieves the effect of improving fault positioning speed and accuracy.

Description

Technical Field

[0001] This application relates to the field of computer operation and maintenance, and in particular to a fault location method, apparatus, device, storage medium, and program product. Background Technology

[0002] With the advancement of digital transformation in financial services, the operational complexity of bank data centers is increasing exponentially. The operations and maintenance systems generate massive amounts of alarm events, configuration change records, and self-test information daily; this multi-source, heterogeneous data collectively forms the basis for fault analysis decisions.

[0003] Currently, fault diagnosis methods based on rule engines and expert systems are commonly used. First, various operational data are collected through a monitoring platform. Then, operational experts write diagnostic rules based on their experience. The system infers possible causes of the fault through rule matching and finally generates a diagnostic report containing suspected root causes for operational personnel to refer to.

[0004] However, the maintenance and updating of rules rely heavily on expert experience, making it difficult to adapt to rapidly changing and complex operational environments, thus reducing the accuracy and efficiency of fault location. Summary of the Invention

[0005] This application provides fault location methods, apparatus, devices, storage media, and program products to improve the accuracy and efficiency of fault location.

[0006] In a first aspect, embodiments of this application provide a fault location method, including:

[0007] Obtain operational data from the bank's data center, including alarm events, configuration change records, and system self-test information;

[0008] The alarm events are compressed based on content similarity to obtain the compressed alarm context information;

[0009] Based on alarm context information and configuration change records, generate contextualized prompts;

[0010] Contextualized prompts are input into a large language model for multi-dimensional parallel analysis to obtain multi-dimensional analysis results.

[0011] A fault diagnosis report is generated based on the results of multi-dimensional analysis. The fault diagnosis report includes root cause location information.

[0012] Optionally, alarm events are compressed based on content similarity to obtain compressed alarm context information, specifically including:

[0013] Within a preset time window, candidate alarm events that meet the conditions of temporal consistency and spatial consistency are selected.

[0014] Calculate the semantic similarity of alarm description text between each pair of candidate alarm events;

[0015] Alarm events with semantic similarity exceeding a preset threshold are merged to generate an integrated master alarm record, which includes the frequency information and time range information corresponding to the original alarm events.

[0016] The alarm context information is obtained based on at least one primary alarm record.

[0017] Optionally, based on alarm context information and configuration change records, contextualized prompts are generated, specifically including:

[0018] Based on the fault type indicated by the current alarm event, retrieve the corresponding scenario-based prompt word template from the preset prompt word template library;

[0019] The alarm context information and configuration change records are used as dynamic parameters to populate the contextual prompt word template, generating contextual prompt words.

[0020] Optionally, before populating the scenario-based prompt word template with alarm context information and configuration change records as parameters, emergency plans and historical cases associated with the fault type can be retrieved from the operation and maintenance knowledge base according to the fault type.

[0021] After obtaining the dynamic parameters, the retrieved emergency plans and historical cases are used as knowledge parameters and populated into the scenario-based prompt word template along with the dynamic parameters.

[0022] Optionally, contextualized prompts can be input into a large language model for multi-dimensional parallel analysis to obtain multi-dimensional analysis results, including:

[0023] Contextualized prompts are simultaneously input into various analysis branches of the large language model;

[0024] Configure independent inference contexts for each analysis branch of the large language model, trigger inference calculations for each branch, and monitor the execution status of each task.

[0025] If any branch fails to complete the inference calculation within the preset timeout period, the inference of the branch will be interrupted based on the preset degradation strategy, and the preset degradation result will be output as the analysis result of the corresponding dimension of the branch.

[0026] Optionally, a fault diagnosis report is generated based on the multi-dimensional analysis results, specifically including:

[0027] The multi-dimensional analysis results are fused to obtain the fused fault description.

[0028] Based on the fused fault description, the faulty device node is identified, and the topological relationship connected to the faulty device node is searched in the pre-stored network topology information; and historical fault handling records matching the fault description are retrieved from the historical fault knowledge base.

[0029] Root cause location information is generated based on topological relationships and historical fault handling records; a fault diagnosis report containing causal links is generated based on the root cause location information.

[0030] Secondly, embodiments of this application provide a fault location device, comprising:

[0031] The acquisition module is used to acquire the operation and maintenance data of the bank's data center. The operation and maintenance data includes alarm events, configuration change records and system self-test information.

[0032] The processing module is used to perform alarm compression processing on alarm events based on content similarity to obtain compressed alarm context information;

[0033] The processing module is also used to generate contextualized prompts based on alarm context information and configuration change records;

[0034] The processing module is also used to input contextualized prompts into a large language model for multi-dimensional parallel analysis to obtain multi-dimensional analysis results;

[0035] The processing module is also used to generate fault diagnosis reports based on multi-dimensional analysis results. The fault diagnosis reports include root cause location information.

[0036] Optionally, the processing module is also used to filter out candidate alarm events that meet the conditions of temporal consistency and spatial consistency within a preset time window;

[0037] Calculate the semantic similarity of alarm description text between each pair of candidate alarm events;

[0038] Alarm events with semantic similarity exceeding a preset threshold are merged to generate an integrated master alarm record, which includes the frequency information and time range information corresponding to the original alarm events.

[0039] The alarm context information is obtained based on at least one primary alarm record.

[0040] Optionally, the processing module is also used to retrieve the corresponding scenario-based prompt word template from the preset prompt word template library according to the fault type indicated by the current alarm event being processed;

[0041] The alarm context information and configuration change records are used as dynamic parameters to populate the contextual prompt word template, generating contextual prompt words.

[0042] Optionally, the processing module is also used to retrieve emergency plans and historical cases associated with the fault type from the operation and maintenance knowledge base before populating the alarm context information and configuration change records as parameters into the scenario-based prompt word template, based on the fault type.

[0043] After obtaining the dynamic parameters, the retrieved emergency plans and historical cases are used as knowledge parameters and populated into the scenario-based prompt word template along with the dynamic parameters.

[0044] Optionally, the processing module is also used to simultaneously input contextualized prompts into various analysis branches of the large language model;

[0045] Configure independent inference contexts for each analysis branch of the large language model, trigger inference calculations for each branch, and monitor the execution status of each task.

[0046] If any branch fails to complete the inference calculation within the preset timeout period, the inference of the branch will be interrupted based on the preset degradation strategy, and the preset degradation result will be output as the analysis result of the corresponding dimension of the branch.

[0047] Optionally, the processing module is also used to perform multidimensional fusion processing on the multidimensional analysis results to obtain a fused fault description;

[0048] Based on the fused fault description, the faulty device node is identified, and the topological relationship connected to the faulty device node is searched in the pre-stored network topology information; and historical fault handling records matching the fault description are retrieved from the historical fault knowledge base.

[0049] Root cause location information is generated based on topological relationships and historical fault handling records; a fault diagnosis report containing causal links is generated based on the root cause location information.

[0050] Thirdly, embodiments of this application provide an electronic device, including: a memory and a processor;

[0051] The memory stores the instructions that the computer executes;

[0052] The processor executes computer execution instructions stored in memory, causing the processor to perform the first aspect and / or various possible implementations of the first aspect as described above.

[0053] Fourthly, embodiments of this application provide a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, are used to implement the first aspect and / or various possible implementations of the first aspect.

[0054] Fifthly, embodiments of this application provide a computer program product, including a computer program that, when executed by a processor, implements the first aspect and / or various possible implementations of the first aspect.

[0055] The fault location method, apparatus, device, storage medium, and program product provided in this application first perform semantic similarity-based compression and aggregation on a large number of redundant original alarms, effectively reducing data noise while retaining key temporal and frequency features. Then, using structured prompt word engineering, the compressed alarm context information and configuration change records are dynamically filled into a preset scenario template, forming precise instructions to guide a large language model in professional domain reasoning. Through the multi-dimensional parallel analysis capabilities of the large model, cross-validation and deep reasoning are performed simultaneously on multiple information sources such as alarms and changes, achieving the fusion of multi-dimensional clues into a unified fault scenario. Finally, based on the fused multi-dimensional analysis results, causal reasoning is performed using network topology and historical knowledge base to generate root cause location information containing clear causal links. This effectively solves the problems of low location efficiency, poor accuracy, and excessive reliance on human experience in existing fault emergency response technologies, thereby improving the speed and accuracy of fault location. Attached Figure Description

[0056] The accompanying drawings, which are incorporated in and form part of this specification, illustrate embodiments consistent with this application and, together with the description, serve to explain the principles of this application.

[0057] Figure 1 Flowchart of the fault location method provided in this application Figure 1 ;

[0058] Figure 2 Flowchart of the fault location method provided in this application Figure 2 ;

[0059] Figure 3 Flowchart of the fault location method provided in this application Figure 3 ;

[0060] Figure 4 A schematic diagram of the fault location device provided in this application;

[0061] Figure 5 A schematic diagram of the structure of the electronic device provided in this application.

[0062] The accompanying drawings illustrate specific embodiments of this application, which will be described in more detail below. These drawings and descriptions are not intended to limit the scope of the concept in any way, but rather to illustrate the concept of this application to those skilled in the art through reference to particular embodiments. Detailed Implementation

[0063] Exemplary embodiments will now be described in detail, examples of which are illustrated in the accompanying drawings. When the following description relates to the drawings, unless otherwise indicated, the same numbers in different drawings denote the same or similar elements. The embodiments described in the following exemplary embodiments do not represent all embodiments consistent with this application. Rather, they are merely examples of apparatuses and methods consistent with some aspects of this application as detailed in the appended claims.

[0064] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties. Furthermore, the collection, storage, use, processing, transmission, provision, disclosure, and application of the relevant data all comply with the relevant laws, regulations, and standards of the relevant regions, have taken necessary confidentiality measures, do not violate public order and good morals, and provide corresponding operation portals for users to choose to authorize or refuse.

[0065] This application applies to operational scenarios with high business continuity requirements, such as financial data centers and large enterprise networks. In the core business scenarios of the financial industry, data centers host critical functions such as transaction systems, customer service, data storage, and network communication; their stability directly impacts business continuity and customer experience. For example, when a bank's core transaction system experiences service interruption due to network equipment failure, the system needs to complete fault location and emergency response within minutes.

[0066] Existing technical solutions typically employ graphical operation and maintenance platforms, which assist operation and maintenance personnel in troubleshooting through functions such as topology visualization, alarm aggregation, and rule engines. For example, some banks' real-time monitoring systems support alarm classification, link tracing, and static processing suggestion generation. Operation and maintenance personnel can advance the troubleshooting process by clicking on modules (such as link status and login logs) through a web interface.

[0067] However, existing methods rely on manual intervention, which can easily lead to response delays. Furthermore, due to fixed interface prompts and the fact that they only support simple aggregation of the current alarm, they are difficult to apply to complex fault scenarios such as repeated alarms with similar semantics (e.g., the same template alarm reported multiple times by the same device). This can easily lead to key clues being buried and reduce the accuracy of fault location.

[0068] The fault location method provided in this application acquires operational data from a bank's data center, including alarm events, configuration change records, and system self-test information. It then performs alarm compression based on content similarity to obtain compressed alarm context information. Based on the alarm context information and configuration change records, it generates contextualized prompts. These prompts are input into a large language model for multi-dimensional parallel analysis to obtain multi-dimensional analysis results. Finally, it generates a fault diagnosis report based on the multi-dimensional analysis results, including root cause location information. This method addresses the problems of low efficiency, poor accuracy, and excessive reliance on human experience in existing fault emergency response technologies, thereby improving the speed and accuracy of fault location and contributing to enhanced business continuity in the banking industry.

[0069] The technical solution of this application and how the technical solution of this application solves the above-mentioned technical problems are described in detail below with specific embodiments. These specific embodiments can be combined with each other, and the same or similar concepts or processes may not be described again in some embodiments. The embodiments of this application will now be described with reference to the accompanying drawings.

[0070] Figure 1 Flowchart of the fault location method provided in this application Figure 1 ,like Figure 1 As shown, the method includes:

[0071] S101. Obtain the operation and maintenance data of the bank's data center. The operation and maintenance data includes alarm events, configuration change records and system self-test information.

[0072] More specifically, in the actual operating environment of a bank's data center, by interfacing with an enterprise command center (ECC) platform, it acquires full-volume operational data streams from multiple heterogeneous data sources, including virtual servers (VS), network devices, databases, middleware, and business application systems, in real time. This data is then uniformly aggregated to the data processing platform using standard API interfaces, message queues, or log collection proxies.

[0073] Optionally, alarm events include, but are not limited to, various real-time monitoring alarms such as abnormal server CPU utilization, memory leak alarms, network connection timeouts, disk read / write errors, and service port unavailability. Configuration change logs include, but are not limited to, complete audit logs of manual or automated changes such as system configuration modifications, firewall policy adjustments, load balancer rule updates, and database parameter changes. System self-check information includes, but is not limited to, proactive probe data such as server health check reports, service heartbeat status, and database connection pool status.

[0074] S102. Perform alarm compression processing on the alarm events based on content similarity to obtain compressed alarm context information.

[0075] More specifically, alarm events are compressed based on content similarity to obtain compressed alarm context information. This includes: selecting candidate alarm events that meet the conditions of temporal consistency and spatial consistency within a preset time window; calculating the semantic similarity of the alarm description text between each pair of candidate alarm events; merging alarm events with semantic similarity exceeding a preset threshold to generate an integrated master alarm record, which includes the frequency information and time range information corresponding to the original alarm events; and obtaining alarm context information based on at least one master alarm record.

[0076] For example, the steps for filtering out alarm events with spatial consistency include: identifying multiple alarm events that all originate from the same monitored object (e.g., device, instance, or application), and performing spatial aggregation processing on alarm events with the same source to effectively eliminate information bloat caused by repeated reporting across channels.

[0077] For example, the steps for filtering out alarm events with time consistency include: within a preset time window (e.g., 2 hours), merging similar alarm events occurring in adjacent time periods to filter out fluctuating alarms that are repeatedly triggered within a short period, thereby improving the stability and readability of the operation and maintenance event list.

[0078] For example, after selecting candidate alarm events that meet the conditions of temporal and spatial consistency within a preset time window, a structured semantic comparison is performed on the alarm description text of each candidate alarm event using a similarity calculation formula based on the longest common subsequence (LCS). When the similarity between any two alarm description texts exceeds a preset threshold (e.g., 0.9), it is determined that the alarm events corresponding to these two alarm description texts are equivalent in business semantics. At this point, the two alarm events can be merged and counted, and context-preserving processing can be performed. The formula for structured semantic comparison is as follows:

[0079]

[0080] Where a and b are the alarm description texts for the two alarm events, and the l() function represents the text length. The similarity between alarm event a and alarm event b.

[0081] In one possible implementation, based on a preset time window of one hour, if the switching device continuously reports 12,847 alarms with the content "Interface GigabitEthernet1 / 0 / 1: Input error count exceeds threshold" between 13:00 and 14:00, the system will group these alarms into the same group of candidate alarm events. By calculating the semantic similarity between the alarm description texts in each alarm event (e.g., using the longest common subsequence algorithm to calculate semantic similarity), it is found that the pairwise similarity between the alarm description texts of this group of alarm events is higher than a preset threshold (e.g., 0.95). Therefore, these candidate alarm events are merged into a single main alarm record.

[0082] For example, the main alarm record content is "The interface GigabitEthernet1 / 0 / 1 of device SW-001 accumulated 269 input error alarms between 13:00 and 14:00", while retaining the time distribution characteristics of the original alarm events.

[0083] This embodiment achieves high-precision alarm compression through a triple filtering mechanism. First, the analysis scope is limited by the alarm source and time window. Then, semantic similarity calculation is used to identify alarms with duplicate content. Finally, a merging operation is used to generate alarm context information with frequency statistics. This reduces the interference of alarm noise on the analysis system. In addition, by retaining key time distribution and frequency features, a reliable temporal context foundation is provided for subsequent root cause analysis.

[0084] S103. Generate contextualized prompts based on alarm context information and configuration change records.

[0085] More specifically, based on alarm context information and configuration change records, scenario-based prompt words are generated. This includes: retrieving the corresponding scenario-based prompt word template from the preset prompt word template library according to the fault type indicated by the currently processed alarm event; and filling the scenario-based prompt word template with alarm context information and configuration change records as dynamic parameters to generate scenario-based prompt words.

[0086] For example, when the alarm context indicates "server CPU utilization consistently exceeds 95%" and the fault type is identified as "performance bottleneck," the system will retrieve a "performance problem analysis template" from the preset prompt word template library. The structured instructions of this template are as follows: "Based on the following performance alarm context and recent system changes, analyze the potential root cause and propose troubleshooting suggestions. Alarm details: [Alarm context]. Relevant configuration changes: [Configuration change records]." The system then uses the specific alarm context information (e.g., "Server SVR-APP-01's CPU utilization has surged from 80% to 98% in the last 30 minutes and has remained above 95% for 15 minutes") and the filtered configuration change records (e.g., "Change order CHG20231127001: A new version of the application service TradeEngine, V2.3, was deployed on server SVR-APP-01 at 10:00 today") as dynamic parameters to fill the corresponding placeholders in the template, thereby generating a complete, clear, and specific prompt word that can be directly executed by a large language model for inference tasks.

[0087] This embodiment combines unstructured raw alarm and change data with structured prompt word templates to ensure that the model's reasoning direction is clear and the output format is standardized for specific operation and maintenance tasks, thereby improving the controllability of the analysis process, the consistency of results, and the stability of the response.

[0088] Optionally, before populating the scenario-based prompt word template with alarm context information and configuration change records as parameters, emergency plans and historical cases associated with the fault type are retrieved from the operation and maintenance knowledge base according to the fault type; after obtaining the dynamic parameters, the retrieved emergency plans and historical cases are used as knowledge parameters and populated into the scenario-based prompt word template together with the dynamic parameters.

[0089] In one possible embodiment, the system receives a user input request, such as "Analyze the reasons for the slow response of the trading system." The system then performs question rewriting and intent recognition steps to standardize the input request described in natural language, resulting in the intent "Performance bottleneck fault analysis." Based on this intent, the system enters a scenario-based matching phase: according to the fault type (i.e., "performance bottleneck") indicated by the currently processed alarm event (e.g., "Database server CPU utilization remains too high" alarm), the system retrieves the most matching scenario-based prompt word template from a pre-set prompt word template library through a prompt word template retrieval mechanism. This scenario-based prompt word template is a structured engineering example.

[0090] For example, the scenario-based prompt word template architecture of the above embodiments includes several modular fields, such as intelligent agent role definition field, network operation and maintenance scenario description field, input request field, scenario-based data input field, alarm context data field, scenario-based operation and maintenance knowledge field, analysis result requirement field, system variable field, and visualization format conversion field.

[0091] In one possible implementation, after obtaining the contextualized alert template, the compressed alert description (e.g., the CPU utilization of the database cluster master node increased from 65% to 98% within 10 minutes) is used as the alert context data field, and the associated configuration change record (e.g., the database parameter max_connections was adjusted from 1000 to 5000 2 hours ago) is used as part of the contextualized data input field. This information constitutes the dynamic variables in the contextualized alert template. While populating the dynamic parameters, the system simultaneously retrieves data from a structured operations and maintenance knowledge base based on the identified "performance bottleneck" fault types. For example, retrieve emergency response process documents related to "performance bottlenecks" from the emergency plan knowledge base; retrieve successful case records of similar "CPU overload caused by a surge in connection counts" from the operation and maintenance case knowledge base; extract official instructions on "connection pool configuration and performance tuning" from the product documentation knowledge base; obtain a possible cause chain diagram of "high CPU utilization" from the fault graph or fault tree knowledge base. Integrate these retrieved static domain knowledge into structured text blocks as knowledge parameters for scenario-based operation and maintenance. Then, populate the corresponding fields of the retrieved scenario-based prompt word template according to the format defined in the scenario-based prompt word template architecture. After population, generate scenario-based prompt words.

[0092] This embodiment effectively activates the operational experience accumulated in documents and case libraries by introducing and integrating static domain expertise with dynamic real-time operation and maintenance data. It makes up for the model's lack of in-depth knowledge in specific domains, thereby improving the accuracy of the model's analysis results and the credibility of its decisions in complex and professional operation and maintenance scenarios.

[0093] S104. Input the contextualized prompts into the large language model for multi-dimensional parallel analysis to obtain multi-dimensional analysis results.

[0094] More specifically, contextualized prompts are input into a large language model for multi-dimensional parallel analysis to obtain multi-dimensional analysis results. This includes: simultaneously inputting contextualized prompts into each analysis branch of the large language model; configuring independent inference contexts for each analysis branch of the large language model, simultaneously triggering inference calculations for each branch, and monitoring the execution status of each branch; if any branch fails to complete inference calculations within a preset timeout period, the inference of the branch is interrupted based on a preset degradation strategy, and the preset degradation result is output as the analysis result for the corresponding dimension of the branch.

[0095] In one possible embodiment, Figure 2 Flowchart of the fault location method provided in this application Figure 2 ,like Figure 2 As shown, alarm data, change data, inspection data, configuration data, topology data, and indicator data are simultaneously input into the network operation and maintenance big model (i.e., the big language model), triggering the corresponding prompts in parallel: alarm prompt, change prompt, inspection prompt, configuration prompt, topology prompt, and indicator prompt. Parallel computing and context caching mechanisms ensure that analysis results from different dimensions can be quickly generated and output in asynchronous mode.

[0096] Optionally, each analysis dimension corresponds to an independent analysis branch, such as a lightweight model call instance. The parallel analysis steps are as follows: by creating an independent session context for each branch, it is ensured that the computation and state between branches do not interfere with each other. Subsequently, multiple inference requests are sent to the model in parallel via asynchronous API calls, where each request carries the specific analysis task of one branch.

[0097] In one possible implementation, a configurable mechanism (i.e., a task timeout mechanism) dynamically triggers the comprehensive analysis structured prompting process of the large model. For example, the response status of each branch is continuously monitored. If the "Topology Impact Analysis" branch exceeds a preset timeout threshold (e.g., 5 minutes) due to the need to traverse a complex network topology, the request for that branch is immediately interrupted according to a degradation strategy (e.g., "return simplified analysis conclusion if timeout"), and a preset degradation result is injected, such as "Topology Impact Analysis: Due to calculation timeout, it is recommended to directly check the status of core network devices based on existing alarms." At the same time, the results of other branches that have completed their tasks (e.g., alarm analysis, change analysis) will be collected normally.

[0098] Optionally, the configurable mechanism also includes a task priority strategy and / or a fault priority strategy. The configurable mechanism ensures that the fault location result is output within a preset timeout threshold (e.g., 5 minutes) to meet the timeliness requirements in emergency scenarios.

[0099] This embodiment solves the technical problem of long fault analysis time in existing technologies by using a concurrent task scheduling and execution framework, thereby improving emergency response speed. At the same time, the introduction of monitoring and degradation mechanisms enhances the reliability of parallel execution, ensuring that even when some complex analyses are blocked, the system can still provide a valuable and complete set of analysis results within a preset timeout threshold, thus meeting the requirements of financial-grade emergency scenarios for response speed and stability.

[0100] S105. Generate a fault diagnosis report based on the multi-dimensional analysis results. The fault diagnosis report includes root cause location information.

[0101] More specifically, the fault diagnosis report is generated based on the multi-dimensional analysis results, which includes: performing multi-dimensional fusion processing on the multi-dimensional analysis results to obtain a fused fault description; determining the faulty device node based on the fused fault description, searching for the topological relationship connected to the faulty device node in the pre-stored network topology information; retrieving historical fault handling records that match the fault description from the historical fault knowledge base; generating root cause location information based on the topological relationship and historical fault handling records; and generating a fault diagnosis report containing causal links based on the root cause location information.

[0102] In one possible implementation, analysis results from three parallel branches are received: alarm analysis indicates "significantly increased database server response latency," change analysis indicates "database connection pool configuration was modified 2 hours ago," and self-test analysis indicates "database memory usage consistently exceeds 95%." Based on these analysis results, consistency checks and semantic fusion are first performed to form a comprehensive fault description: the database server's memory pressure increased due to a connection pool configuration change, leading to response latency. Then, based on this fault description, the affected database servers and their associated application servers (i.e., topology relationships) are located in the topology database, and five similar "memory leaks caused by improper connection pool configuration" handling cases (i.e., historical fault handling records) are retrieved from the history database. Combining the obtained topology relationships and historical fault handling records, the root cause is determined to be an excessively low maximum number of connections in the database connection pool, leading to frequent connection creation and destruction, causing memory fragmentation. A diagnostic report containing the complete causal chain is generated based on this root cause information. For example, the causal chain is: configuration change - connection pool pressure - memory leak - response latency - application timeout.

[0103] This embodiment obtains a complete fault causal chain through the synergistic effect of multi-dimensional fusion processing, topological correlation analysis, and historical case matching. This results in a diagnostic report that not only points out the problem but also clearly shows the mechanism and impact path of the problem. This provides maintenance personnel with in-depth analysis results that can be directly used for decision-making and handling, thereby improving the speed of fault location.

[0104] The fault location method provided in this application reduces fault location time and improves emergency response speed by compressing alarms and performing parallel analysis. It improves the accuracy of root cause location information by using knowledge-enhanced prompts and cross-validating multi-dimensional information. Furthermore, it reduces reliance on expert experience by embedding operational knowledge into prompt templates and analysis processes, thereby achieving standardization and sustainable optimization of fault analysis.

[0105] Figure 3 Flowchart of the fault location method provided in this application Figure 3 ,like Figure 3 As shown, in this embodiment... Figure 1 Based on the embodiments, the fault location method is described in detail. This method includes: automatically acquiring multi-source information, specifically including: upon receiving an alarm (e.g., "payment service response timeout"), associating and retrieving other historical or real-time alarm events related to that alarm. Simultaneously, querying for application releases, configuration modifications, or other change records near the alarm time period to obtain configuration change records; and also initiating a one-click self-check function by association, i.e., automatically performing health checks on the services, servers, or network links involved in the alarm, collecting operational status indicators to obtain system self-check information.

[0106] Optionally, the multi-source information obtained above can be used as input to the network operation and maintenance big model. The network operation and maintenance big model can simultaneously trigger three-dimensional analysis: by analyzing the spatiotemporal distribution and pattern of alarms, it can be determined whether it is a batch outbreak and whether it has propagation; by analyzing the configuration change records, it can be assessed whether there is a causal relationship between the recent changes and the current failure; and by analyzing the system self-test information, it can be verified whether the basic status of the service, such as CPU, memory, and network connection, is abnormal.

[0107] Optionally, after the analysis of each dimension is completed, the system enters the comprehensive analysis stage, which involves reasoning from the fused multidimensional results. If the results are clear, the root cause information is directly located (e.g., "Change X caused service dependency anomalies"); if the results are ambiguous, fuzzy recommendations are output to guide the investigation direction.

[0108] Optionally, the user interface includes analysis controls, knowledge assistant controls, linked device controls, and continuous interaction controls. Users can click on the analysis controls in the interactive interface to obtain analysis details and view the complete causal chain and basis of the large model's inference. Users can interact with the interface by clicking on the knowledge assistant control to jump to the knowledge assistant for multi-round dialogue and question-and-answer sessions regarding the current problem. Users can click on the linked device control to directly access the faulty device or monitoring panel with one click. Throughout the above process, users can continuously interact with the system through the continuous interaction controls, enabling the system to iteratively analyze based on new information.

[0109] Figure 4 A schematic diagram of the fault location device provided in this application is shown below. Figure 4 As shown, the fault location device 40 provided in this embodiment includes:

[0110] The acquisition module 401 is used to acquire the operation and maintenance data of the bank's data center. The operation and maintenance data includes alarm events, configuration change records and system self-test information.

[0111] The processing module 402 is used to perform alarm compression processing on alarm events based on content similarity to obtain compressed alarm context information;

[0112] The processing module 402 is also used to generate contextualized prompts based on alarm context information and configuration change records;

[0113] The processing module 402 is also used to input contextualized prompts into a large language model for multi-dimensional parallel analysis to obtain multi-dimensional analysis results;

[0114] The processing module 402 is also used to generate a fault diagnosis report based on the multi-dimensional analysis results. The fault diagnosis report includes root cause location information.

[0115] Optionally, the processing module 402 is also used to filter out candidate alarm events that meet the conditions of time consistency and space consistency within a preset time window;

[0116] Calculate the semantic similarity of alarm description text between each pair of candidate alarm events;

[0117] Alarm events with semantic similarity exceeding a preset threshold are merged to generate an integrated master alarm record, which includes the frequency information and time range information corresponding to the original alarm events.

[0118] The alarm context information is obtained based on at least one primary alarm record.

[0119] Optionally, the processing module 402 is also used to retrieve the corresponding scenario-based prompt word template from the preset prompt word template library according to the fault type indicated by the current alarm event being processed;

[0120] The alarm context information and configuration change records are used as dynamic parameters to populate the contextual prompt word template, generating contextual prompt words.

[0121] Optionally, the processing module 402 is also used to retrieve emergency plans and historical cases associated with the fault type from the operation and maintenance knowledge base before populating the alarm context information and configuration change records as parameters into the scenario-based prompt word template, based on the fault type.

[0122] After obtaining the dynamic parameters, the retrieved emergency plans and historical cases are used as knowledge parameters and populated into the scenario-based prompt word template along with the dynamic parameters.

[0123] Optionally, the processing module 402 is also used to simultaneously input contextual prompts to various analysis branches of the large language model;

[0124] Configure independent inference contexts for each analysis branch of the large language model, trigger inference calculations for each branch, and monitor the execution status of each task.

[0125] If any branch fails to complete the inference calculation within the preset timeout period, the inference of the branch will be interrupted based on the preset degradation strategy, and the preset degradation result will be output as the analysis result of the corresponding dimension of the branch.

[0126] Optionally, the processing module 402 is also used to perform multi-dimensional fusion processing on the multi-dimensional analysis results to obtain a fused fault description;

[0127] Based on the fused fault description, the faulty device node is identified, and the topological relationship connected to the faulty device node is searched in the pre-stored network topology information; and historical fault handling records matching the fault description are retrieved from the historical fault knowledge base.

[0128] Root cause location information is generated based on topological relationships and historical fault handling records; a fault diagnosis report containing causal links is generated based on the root cause location information.

[0129] The fault location device provided in this embodiment can execute the method provided in the above method embodiment. Its implementation principle and technical effect are similar, and will not be described in detail here.

[0130] Figure 5 A schematic diagram of the structure of the electronic device provided in this application. Figure 5 As shown, the electronic device 50 provided in this embodiment includes at least one processor 501 and a memory 502. Optionally, the device 50 further includes a communication component 503. The processor 501, memory 502, and communication component 503 are connected via a bus 504.

[0131] In a specific implementation, at least one processor 501 executes computer execution instructions stored in memory 502, causing at least one processor 501 to perform the above-described method.

[0132] The specific implementation process of processor 501 can be found in the above method embodiments, and its implementation principle and technical effect are similar. It will not be repeated here.

[0133] In the above embodiments, it should be understood that the processor can be a Central Processing Unit (CPU), or other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), etc. The general-purpose processor can be a microprocessor or any conventional processor. The steps of the method disclosed in this invention can be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules within the processor.

[0134] The memory may include random access memory (RAM) and may also include non-volatile memory (NVM), such as at least one disk storage device.

[0135] The bus can be an Industry Standard Architecture (ISA) bus, a Peripheral Component Interconnect (PCI) bus, or an Extended Industry Standard Architecture (EISA) bus, etc. Buses can be categorized as address buses, data buses, control buses, etc. For ease of illustration, the buses shown in the accompanying drawings are not limited to a single bus or a single type of bus.

[0136] This application also provides a computer program product, including a computer program that, when executed by a processor, implements the above-described method.

[0137] This application also provides a computer-readable storage medium storing computer-executable instructions, which, when executed by a processor, implement the above-described method.

[0138] The aforementioned readable storage medium can be implemented by any type of volatile or non-volatile storage device or a combination thereof, such as static random access memory (SRAM), electrically erasable programmable read-only memory (EEPROM), erasable programmable read-only memory (EPROM), programmable read-only memory (PROM), read-only memory (ROM), magnetic storage, flash memory, magnetic disk, or optical disk. The readable storage medium can be any available medium accessible to a general-purpose or special-purpose computer.

[0139] An exemplary readable storage medium is coupled to a processor, enabling the processor to read information from and write information to the readable storage medium. Of course, the readable storage medium can also be a component of the processor. The processor and the readable storage medium can reside in an Application Specific Integrated Circuit (ASIC). Alternatively, the processor and the readable storage medium can exist as discrete components in the device.

[0140] The division of units is merely a logical functional division; in actual implementation, there may be other division methods. For example, multiple units or components may be combined or integrated into another system, or some features may be ignored or not executed. Furthermore, the coupling or direct coupling or communication connection shown or discussed may be indirect coupling or communication connection through some interfaces, devices, or units, and may be electrical, mechanical, or other forms.

[0141] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; that is, they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment according to actual needs.

[0142] In addition, the functional units in the various embodiments of the present invention can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit.

[0143] If a function is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of this invention, or the part that contributes to the prior art, or a part of the technical solution, can be embodied in the form of a software product. This computer software product is stored in a storage medium and includes several instructions to cause a computer device (which may be a personal computer, server, or network device, etc.) to execute all or part of the steps of the methods of the various embodiments of this invention. The aforementioned storage medium includes various media capable of storing program code, such as USB flash drives, portable hard drives, read-only memory (ROM), random access memory (RAM), magnetic disks, or optical disks.

[0144] Those skilled in the art will understand that all or part of the steps of the above-described method embodiments can be implemented by hardware related to program instructions. The aforementioned program can be stored in a computer-readable storage medium. When executed, the program performs the steps of the above-described method embodiments; and the aforementioned storage medium includes various media capable of storing program code, such as ROM, RAM, magnetic disks, or optical disks.

[0145] Finally, it should be noted that other embodiments of the invention will readily occur to those skilled in the art upon consideration of the specification and practice of the invention disclosed herein. This invention is intended to cover any variations, uses, or adaptations of the invention that follow the general principles of the invention and include common knowledge or customary techniques in the art not disclosed herein, and is not limited to the precise structures described above and shown in the accompanying drawings, and various modifications and changes can be made without departing from its scope. The scope of the invention is limited only by the appended claims.

Claims

1. A fault location method, characterized in that, include: Obtain operational data from the bank's data center, including alarm events, configuration change records, and system self-test information; The alarm events are compressed based on content similarity to obtain compressed alarm context information; Based on the alarm context information and the configuration change record, generate contextualized prompts; The contextualized prompts are input into a large language model for multi-dimensional parallel analysis to obtain multi-dimensional analysis results. A fault diagnosis report is generated based on the multi-dimensional analysis results, and the fault diagnosis report includes root cause location information.

2. The method according to claim 1, characterized in that, The alarm events are subjected to alarm compression processing based on content similarity to obtain compressed alarm context information, specifically including: Within a preset time window, candidate alarm events that meet the conditions of temporal consistency and spatial consistency are selected. Calculate the semantic similarity of alarm description text between each pair of candidate alarm events; Alarm events with semantic similarity exceeding a preset threshold are merged to generate an integrated master alarm record, which includes frequency information and time range information corresponding to the original alarm events. The alarm context information is obtained based on at least one primary alarm record.

3. The method according to claim 1, characterized in that, Based on the alarm context information and the configuration change record, contextualized prompts are generated, specifically including: Based on the fault type indicated by the current alarm event, retrieve the corresponding scenario-based prompt word template from the preset prompt word template library; The alarm context information and the configuration change record are used as dynamic parameters to fill the contextual prompt word template, thereby generating contextual prompt words.

4. The method according to claim 3, characterized in that, Also includes: Before filling the scenario-based prompt word template with the alarm context information and the configuration change record as parameters, emergency plans and historical cases associated with the fault type are retrieved from the operation and maintenance knowledge base according to the fault type. After obtaining the dynamic parameters, the retrieved emergency plans and historical cases are used as knowledge parameters and filled into the scenario-based prompt word template together with the dynamic parameters.

5. The method according to claim 1, characterized in that, The contextualized prompts are input into a large language model for multi-dimensional parallel analysis to obtain multi-dimensional analysis results, including: The contextualized prompts are simultaneously input into each analysis branch of the large language model; Configure independent inference contexts for each analysis branch of the large language model, trigger inference calculations for each branch, and monitor the execution status of each task. If any branch fails to complete the inference calculation within the preset timeout period, the inference of the branch will be interrupted based on the preset degradation strategy, and the preset degradation result will be output as the analysis result of the corresponding dimension of the branch.

6. The method according to claim 1, characterized in that, A fault diagnosis report is generated based on the multi-dimensional analysis results, specifically including: The multi-dimensional analysis results are subjected to multi-dimensional fusion processing to obtain a fused fault description; Based on the fused fault description, the faulty device node is identified, and the topological relationship connected to the faulty device node is searched in the pre-stored network topology information; and historical fault handling records matching the fault description are retrieved from the historical fault knowledge base. Root cause location information is generated based on the topological relationship and the historical fault handling records; a fault diagnosis report containing causal links is generated based on the root cause location information.

7. A fault location device, characterized in that, include: The acquisition module is used to acquire the operation and maintenance data of the bank's data center, including alarm events, configuration change records, and system self-test information. The processing module is used to perform alarm compression processing on the alarm event based on content similarity to obtain compressed alarm context information; The processing module is also used to generate contextualized prompts based on the alarm context information and the configuration change record; The processing module is also used to input the contextualized prompt words into a large language model for multi-dimensional parallel analysis to obtain multi-dimensional analysis results; The processing module is also used to generate a fault diagnosis report based on the multi-dimensional analysis results, the fault diagnosis report including root cause location information.

8. An electronic device, characterized in that, include: Memory, processor; The memory stores computer-executed instructions; The processor executes computer execution instructions stored in the memory, causing the processor to perform the method as described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-executable instructions, which, when executed by a processor, are used to implement the method as described in any one of claims 1-6.

10. A computer program product, characterized in that, Includes a computer program that, when executed by a processor, implements the method described in any one of claims 1-6.

Images