A fault root cause positioning method, device and medium

Abstract

The application provides a fault root cause positioning method, device and medium, and relates to the technical field of data processing; the method determines a target abnormal node and its corresponding predicted abnormal score and node selection explanation text B from an initial abnormal node based on a call chain path from the starting point of a call chain graph to the initial abnormal node, the node identifier of the initial abnormal node, abnormal index data, target abnormal logs, historical fault cases and a large model; the initial abnormal node is obtained based on the call chain graph and the abnormal index data; based on the data source type corresponding to B and the preset data source type set, the adjustment weight corresponding to the predicted abnormal score is determined; based on the adjustment weight and the predicted abnormal score, the target abnormal score corresponding to the target abnormal node is obtained, and the root cause positioning result is determined accordingly; not only the fault call chain topology and quantitative index data are fused, but also the fault semantic information contained in the unstructured text such as logs is effectively utilized, and the accuracy of root cause positioning is improved.

Description

Technical Field

[0001] This invention relates to the field of data processing technology, and in particular to a method, device and medium for locating the root cause of a fault. Background Technology

[0002] In modern distributed systems and microservice architectures, the call relationships between services are becoming increasingly complex. Once a failure occurs, it usually affects multiple components and layers. Most existing root cause localization methods are based on the topology of the fault call chain diagram and various quantitative indicator data. They use a preset scoring strategy to calculate anomaly scores for each node in the call chain diagram, and sort the nodes according to their anomaly scores. Finally, the top-ranked nodes are regarded as potential root causes.

[0003] However, the above methods mainly focus on structured topological information and numerical indicators in the process of root cause localization. They are difficult to effectively mine and understand the key fault semantic information contained in unstructured texts such as logs and alarms. As a result, the basis for root cause judgment is not comprehensive enough, causing the ranking of abnormal nodes to deviate from the priority of the real root cause nodes, which ultimately affects the accuracy and reliability of root cause localization. Summary of the Invention

[0004] To address the aforementioned technical problems, the technical solution adopted by this invention is as follows: According to a first aspect of the present invention, a method for locating the root cause of a fault is provided, the method comprising the following steps: S1. Based on the key dataset and large model, select at least one target anomaly node from several initial anomaly nodes, and obtain a list of predicted anomaly scores A and node selection description text B; where A = (A1, A2, ..., A...). i , ..., A n ), A i For the i-th target anomaly node C i The corresponding predicted anomaly score; 1≤i≤n, where n is the number of target anomaly nodes; the initial anomaly node is a node in the fault call chain graph, obtained based on the call chain graph and the anomaly index data corresponding to the fault; the key dataset includes: the node identifier of each initial anomaly node, several call chain paths from the starting point of the call chain graph to the initial anomaly node, and the anomaly index data corresponding to each initial anomaly node, the target anomaly log, and historical fault cases.

[0005] S2. If E does not include D, then α = 0; if E includes D, then α is obtained based on D and the key dataset; D is the data source type corresponding to B, and E is a preset set of data source types, including log type, indicator type and case type; α is the adjustment weight corresponding to the predicted anomaly score.

[0006] When D is a log class, α is obtained based on the semantic similarity between B and the target exception log; When D is an indicator class, if B successfully matches the abnormal indicator data, then set α=1; otherwise, set α=0. When D is a case class, if B successfully matches a historical failure case, then let α=1; otherwise, let α=0.

[0007] S3, based on A i And α, obtain C i The corresponding target anomaly score is used to determine the root cause localization result.

[0008] According to a second aspect of the present invention, a non-transitory computer-readable storage medium is provided, wherein a computer program is stored in the storage medium, and the computer program is loaded and executed by a processor to implement the aforementioned method.

[0009] According to a third aspect of the present invention, an electronic device is provided, comprising: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the aforementioned method.

[0010] The present invention has at least the following beneficial effects: This invention provides a method, device, and medium for fault root cause localization. The method, based on a key dataset and a large model, selects at least one target anomaly node from several initial anomaly nodes and obtains a list of predicted anomaly scores and node selection instructions. The list of predicted anomaly scores includes the predicted anomaly score corresponding to each target anomaly node. Initial anomaly nodes are nodes in the fault's call chain graph, obtained based on the call chain graph and corresponding anomaly indicator data. The key dataset includes: a node identifier for each initial anomaly node, several call chain paths from the start of the call chain graph to the initial anomaly node, anomaly indicator data corresponding to each initial anomaly node, target anomaly logs, and historical fault cases. Based on the data source type corresponding to the node selection instructions and a preset set of data source types, adjustment weights corresponding to the predicted anomaly scores are determined. Based on the predicted anomaly scores and adjustment weights corresponding to the target anomaly nodes, the target anomaly score corresponding to the target anomaly node is obtained, and the root cause localization result is determined based on the target anomaly score. As can be seen, this invention not only integrates fault call chain topology and quantitative indicator data, but also effectively utilizes the fault semantic information contained in unstructured text such as logs. By introducing historical fault cases and interpretable logical reasoning through a large model, it performs semantically enhanced anomaly re-evaluation on initial abnormal nodes, thereby filtering out target abnormal nodes. Furthermore, by combining the predicted anomaly score and the adjustment weight corresponding to the predicted anomaly score obtained based on the node selection description text, which can reflect the credibility of the large model's reasoning basis, the target anomaly score of each target abnormal node is calculated. The root cause localization result is determined based on the target anomaly score, which significantly improves the accuracy, reliability, and scenario generalization ability of root cause localization. Attached Figure Description

[0011] To more clearly illustrate the technical solutions in the embodiments of the present invention, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0012] Figure 1 This is a flowchart of a fault root cause localization method provided in an embodiment of the present invention. Detailed Implementation

[0013] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0014] It should be noted that the terms "first," "second," etc., in the specification, claims, and accompanying drawings of this invention are used to distinguish similar tasks and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that embodiments of the invention described herein can be implemented in orders other than those illustrated or described herein. Furthermore, the terms "comprising" and "having," and any variations thereof, are intended to cover non-exclusive inclusion; for example, a process, method, system, product, or server that comprises a series of steps or units is not necessarily limited to those explicitly listed, but may include other steps or units not explicitly listed or inherent to such processes, methods, products, or devices.

[0015] Embodiments of the present invention provide a method for locating the root cause of a fault, the method comprising the following steps, such as... Figure 1 As shown: S1. Based on the key dataset and large model, select at least one target anomaly node from several initial anomaly nodes, and obtain a list of predicted anomaly scores A and node selection description text B; where A = (A1, A2, ..., A...). i , ..., A n ), A i For the i-th target anomaly node C i The corresponding predicted anomaly score; 1≤i≤n, where n is the number of target anomaly nodes; the initial anomaly node is a node in the fault call chain graph, obtained based on the call chain graph and the anomaly index data corresponding to the fault; the key dataset includes: the node identifier of each initial anomaly node, several call chain paths from the starting point of the call chain graph to the initial anomaly node, and the anomaly index data corresponding to each initial anomaly node, the target anomaly log, and historical fault cases.

[0016] Specifically, in step S1, target prompt words are constructed based on the key dataset and the preset prompt word template. The target prompt words are input into the large model, which selects at least one target abnormal node from all the initial abnormal nodes and outputs the node identifier of each target abnormal node, the predicted abnormal score corresponding to the node identifier of each target abnormal node, and B.

[0017] Specifically, the large model is a large language model.

[0018] Specifically, data from the key dataset is injected into placeholders in a preset prompt word template to generate target prompt words; the preset prompt word template is a prompt word template pre-set by those skilled in the art according to actual needs, and will not be described in detail here.

[0019] Specifically, the node selection description text serves as the reasoning basis for the large model in natural language form, generated based on the target prompt words, and is used to explain why the initial abnormal node was selected as the target abnormal node.

[0020] Specifically, the predicted anomaly score should be no less than 0 and no greater than 1.

[0021] Specifically, the abnormal indicator data corresponding to the initial abnormal node includes the node identifier, the indicator name of at least one preset monitoring indicator, and the current indicator value corresponding to each indicator name.

[0022] Specifically, the anomaly index data corresponding to the initial abnormal node also includes an anomaly severity label, which is used to characterize the severity of the anomaly of the corresponding node, including: no anomaly, abnormal, and severe anomaly.

[0023] Furthermore, the anomaly level label is determined based on the current index values ​​of each preset monitoring indicator corresponding to the node. Those skilled in the art will understand that any existing method for determining the anomaly level label based on the current index values ​​of each preset monitoring indicator corresponding to a node falls within the scope of this invention. For example: if the current index value of each preset monitoring indicator corresponding to a node is less than the first preset monitoring threshold of its corresponding preset monitoring indicator, then the anomaly level label is determined to be "no anomaly"; if among the current index values ​​of all preset monitoring indicators corresponding to a node, there is one that exceeds the first preset monitoring threshold of its corresponding preset monitoring indicator, and there is no current index value that exceeds the second preset monitoring threshold of its corresponding preset monitoring indicator, then the anomaly level label is determined to be "abnormal"; otherwise, the anomaly level label is determined to be "severely abnormal"; the second preset monitoring threshold is greater than the first preset monitoring threshold; further details will not be elaborated here.

[0024] Specifically, the preset monitoring indicators are key performance indicators that can determine whether the corresponding node is abnormal through their indicator values, including at least error rate and latency.

[0025] Specifically, the node identifier is a unique identifier for the node.

[0026] Specifically, the current indicator value is the current indicator value.

[0027] Specifically, before step S1, the following steps S01-S02 are also performed: S01. For each initial exception node, based on the call chain graph, obtain the longest path from the starting point of the call chain graph to the initial exception node, and use the longest path as the candidate call path corresponding to the initial exception node.

[0028] Specifically, the longest path can be understood as the path that includes the most nodes.

[0029] Specifically, the starting point of the call chain graph is the first time a user request or system event associated with the fault enters the service interface or execution unit of the distributed system.

[0030] S02. Perform deduplication processing on all candidate call paths according to the preset deduplication rules, and use the deduplicated candidate call paths as the call chain paths from the starting point of the call chain graph to the initial exception node; wherein, the preset deduplication rules are: if L j For L e If the continuous subpaths are L, then L j Delete; L j For the j-th candidate call path, L e Let be the e-th candidate call path, 1≤j≤m, 1≤e≤m and e≠j, where m is the total number of candidate call paths; for example: if candidate call path 1 is: node A→node B→node C→node D; and candidate call path 2 is: node A→node B→node C→node D→node E; then it can be determined that candidate call path 1 is a continuous sub-path of candidate call path 2, and candidate call path 1 is deleted.

[0031] Through the above steps, for each initial abnormal node, the longest path from the starting point of the call chain graph to the initial abnormal node is obtained, and this longest path is used as the candidate call path corresponding to the initial abnormal node. This effectively preserves the most complete fault propagation context. Compared with selecting only any one or the shortest path, the longest path contains more nodes and dependencies between nodes, and can more comprehensively reflect the position of the initial abnormal node in the entire path and its possible dependency relationships. Furthermore, all candidate call paths are deduplicated according to a preset deduplication rule, and the deduplicated candidate call paths are used as the call chain paths from the starting point of the call chain graph to the initial abnormal node. This reduces the number of duplicate or highly overlapping candidate call paths, providing richer structured input for the subsequent large model to understand the fault propagation path. At the same time, without losing key context, it reduces the complexity of subsequent prompt word construction and the input noise of the large model, thereby improving the overall accuracy and interpretability of root cause localization.

[0032] Specifically, for each initial abnormal node, the abnormal log of the initial abnormal node within the target time period is determined as the target abnormal log corresponding to the initial abnormal node; the end time of the target time period is the time when the fault occurred, and the duration of the target time period is a preset duration; the preset duration is a duration pre-set by those skilled in the art according to actual needs, such as 1 hour, 2 hours, 3 hours, which will not be elaborated here.

[0033] Specifically, exception logs are log records generated by system components during operation that reflect their abnormal states; including but not limited to error stacks, timeout information, connection failure prompts, or resource exhaustion alarms.

[0034] Through the above steps, the abnormal logs of the initial abnormal node within the target time period are identified as the target abnormal logs corresponding to the initial abnormal node. By limiting the target abnormal logs to logs within a preset time period before the fault occurred, the focus is effectively placed on log content related to the current fault, avoiding interference from irrelevant historical logs, and providing more accurate and reliable semantic input for the large model.

[0035] Specifically, the historical fault cases corresponding to the initial abnormal node are obtained by querying the fault case database. The fault case database includes several fault cases, each of which includes fault description information, a fault case identifier corresponding to the fault description information, and a node identifier of the root cause node corresponding to the fault description information. If the node identifier of the initial abnormal node is consistent with the node identifier of the root cause node in the fault case, then the fault case is regarded as the historical fault case corresponding to the initial abnormal node.

[0036] Specifically, the failure case database includes failure cases corresponding to failures that have actually occurred and whose root cause analysis has been completed.

[0037] Specifically, the fault case identifier is a unique identifier for the fault case.

[0038] By matching the initial abnormal nodes with the historical faults in the fault case database whose root causes have been confirmed, the relevant historical fault cases can be accurately obtained, and past diagnostic experience can be effectively reused. This not only enhances the contextual understanding of the current fault, but also provides high-value prior knowledge for large model reasoning, thereby improving the accuracy and reliability of root cause judgment.

[0039] S2. If E does not include D, then α = 0; if E includes D, then α is obtained based on D and the key dataset; D is the data source type corresponding to B, and E is a preset set of data source types, including log type, indicator type and case type; α is the adjustment weight corresponding to the predicted anomaly score.

[0040] Specifically, when D is a log class, α is obtained based on the semantic similarity between B and the target abnormal log; when D is an indicator class, if B successfully matches the abnormal indicator data, α is set to 1; otherwise, α is set to 0; when D is a case class, if B successfully matches the historical fault case, α is set to 1; otherwise, α is set to 0.

[0041] Specifically, 0 ≤ α ≤ 1; where, the larger α is, the higher the reliability of the predicted outlier score.

[0042] Specifically, while outputting the anomaly identification results, the large model also outputs the data source type corresponding to the node selection description text. The data source types corresponding to the node selection description text include: log type, indicator type, historical case type, and other auxiliary information type.

[0043] Specifically, the anomaly identification results should include at least one node selection description text.

[0044] Specifically, when the anomaly identification result includes only one node selection description text, proceed to step S2 to obtain α.

[0045] Furthermore, when the anomaly identification result includes multiple node selection description texts, for each node selection description text, the adjustment weight corresponding to that node selection description text is obtained based on the data source type and E corresponding to the node selection description text; the average value of the adjustment weights corresponding to all node selection description texts is taken as α; wherein, the adjustment weight corresponding to that node selection description text is obtained based on the data source type and E corresponding to the node selection description text, using the same method as obtaining α in step S2.

[0046] Through the above steps, when the data source type corresponding to the node selection description text is log type, the adjustment weight corresponding to the predicted anomaly score is obtained based on the semantic similarity between the node selection description text and the target abnormal log; when the data source type corresponding to the node selection description text is indicator type or case type, the adjustment weight corresponding to the predicted anomaly score is determined based on its matching result with abnormal indicator data or historical failure cases; when the data source type corresponding to the node selection description text is not any of log type, indicator type, or case type, the adjustment weight corresponding to the predicted anomaly score is determined to be 0; furthermore, when there are multiple node selection description texts, all node selection description texts are... The average of the corresponding adjustment weights is used as the adjustment weight for the predicted anomaly score. By introducing a data source type-aware dynamic adjustment mechanism, the adjustment weights can truly reflect the strength and verifiability of the factual basis for the large model's reasoning. This not only enhances the transparency and credibility of the scoring process but also effectively suppresses the interference of unfounded or low-relevance explanations on the results. Furthermore, by combining the predicted anomaly score with the adjustment weights corresponding to the predicted anomaly score obtained based on the node selection description text, which reflects the credibility of the large model's reasoning basis, the target anomaly score for each target anomaly node is calculated. The root cause localization result is determined based on the target anomaly score, significantly improving the accuracy and reliability of root cause localization.

[0047] Specifically, in the step of obtaining α based on the semantic similarity between B and the target anomaly log, sub-steps S21-S23 are included: S21. For each target anomalous log in the key dataset, the vector similarity between the semantic feature vector corresponding to B and the semantic feature vector of the target anomalous log is taken as the semantic similarity between B and the target anomalous log; wherein, the vector dimension of the semantic feature vector corresponding to B and the semantic feature vector of the target anomalous log are the same.

[0048] Specifically, feature extraction is performed on the target anomalous log to obtain the semantic feature vector of the target anomalous log; wherein, as those skilled in the art know, any method in the prior art for feature extraction of the target anomalous log to obtain the corresponding semantic feature vector is within the protection scope of this invention, such as: embedding methods based on pre-trained language models (such as BERT, Sentence-BERT) to map the target anomalous log into a fixed-dimensional semantic feature vector, which will not be elaborated here.

[0049] Furthermore, the semantic feature vector corresponding to B is obtained by using the same method as obtaining the semantic feature vector corresponding to the target anomaly log.

[0050] Specifically, the vector similarity is no greater than 1. The greater the vector similarity, the more similar the semantic feature vector of the corresponding target anomaly log is to the semantic feature vector corresponding to B.

[0051] Optionally, the cosine similarity between the semantic feature vector corresponding to B and the semantic feature vector of the target anomaly log can be used as the vector similarity between the semantic feature vector corresponding to B and the semantic feature vector of the target anomaly log. In some other embodiments, other methods can be used to obtain the vector similarity between the semantic feature vector corresponding to B and the semantic feature vector of the target anomaly log. For example, the vector distance between the semantic feature vector corresponding to B and the semantic feature vector of the target anomaly log can be converted into a value between 0 and 1, and this value can be used as the vector similarity between the semantic feature vector corresponding to B and the semantic feature vector of the target anomaly log. This will not be elaborated further here.

[0052] S22. Sort all semantic similarities in descending order to obtain a semantic similarity sequence, and take the first f semantic similarities in the semantic similarity sequence as the target similarity; f is a preset quantity threshold; the preset quantity threshold is a quantity threshold set in advance by those skilled in the art according to actual needs, such as 3, 5, which will not be elaborated here.

[0053] S23. When P > 0, let α = P; when P ≤ 0, let α = 0; P is the average of all target similarities.

[0054] Through the above steps, the vector similarity between the semantic feature vector corresponding to the node selection description text and the semantic feature vector of the target anomaly log is used as the semantic similarity between the node selection description text and the target anomaly log. After sorting all semantic similarities in descending order, the top few semantic similarities in the sorting results are selected as the target similarities. When the average of all target similarities is greater than 0, the average of all target similarities is used as the adjustment weight corresponding to the predicted anomaly score; otherwise, the adjustment weight corresponding to the predicted anomaly score is determined to be 0. This ensures that the adjustment weight is only assigned a valid value when there is a substantial semantic relationship between the node selection description text and the actual target anomaly log. This effectively suppresses the interference of unfounded or fictitious explanations on the target anomaly score, significantly improving the rationality of the obtained target anomaly score and the accuracy and reliability of the root cause localization results.

[0055] Specifically, step S2 also includes the following sub-steps S201-S204: S201. When D is an indicator class, perform structured parsing on B to obtain several key indicator data contained in B. The key indicator data includes: node identifier, indicator name, standard indicator value corresponding to the indicator name, and comparison relationship; the comparison relationship includes higher than, lower than, and equal to. For example, if B is "the error rate of auth-service is higher than 1%, significantly exceeding the normal threshold, which is the root cause of this failure", then the node identifier in the key indicator data obtained based on B is "auth-service", the indicator name is "error rate", the standard indicator value corresponding to the indicator name is "1%", and the comparison relationship is "higher than".

[0056] S202. For each key indicator data corresponding to B, when the node identifier in the abnormal indicator data in the key dataset is consistent with the node identifier in the key indicator data, and the abnormal indicator data includes the indicator name in the key indicator data, the current indicator value corresponding to the indicator name in the abnormal indicator data is taken as the indicator observation value corresponding to the key indicator data; for example, when the node identifier in the abnormal indicator data in the key dataset is "auth-service", the indicator name is "error rate", and the current indicator value corresponding to the indicator name is "8%", the indicator observation value corresponding to the key indicator data is "8%".

[0057] S203. Compare the standard indicator values ​​in the key indicator data with the corresponding indicator observation values, and determine the matching result of the key indicator data based on the comparison results and the comparison relationship in the key indicator data; the matching result includes successful matching and failed matching.

[0058] Specifically, the comparison results include: the observed value of the indicator is greater than the standard indicator value, the observed value of the indicator is less than the standard indicator value, and the observed value of the indicator is equal to the standard indicator value.

[0059] Specifically, in step S203, if the comparison relationship in the key indicator data is "higher than", then if the comparison result shows that the observed value of the indicator is greater than the standard indicator value, the matching result corresponding to the key indicator data is determined to be a successful match; otherwise, the matching result corresponding to the key indicator data is determined to be a failed match. If the comparison relationship in the key indicator data is "lower than", then if the comparison result shows that the observed value of the indicator is less than the standard indicator value, the matching result corresponding to the key indicator data is determined to be a successful match; otherwise, the matching result corresponding to the key indicator data is determined to be a failed match. If the comparison relationship in the key indicator data is "equal to", then if the comparison result shows that the observed value of the indicator is equal to the standard indicator value, the matching result corresponding to the key indicator data is determined to be a successful match; otherwise, the matching result corresponding to the key indicator data is determined to be a failed match. For example, if the observed value of the key indicator data is "8%", the standard indicator value is "1%", and the comparison relationship in the key indicator data is "higher than", then it can be known that the observed value of the indicator is greater than the standard indicator value, and the matching is determined to be successful.

[0060] S204. If all the key indicator data corresponding to B are successfully matched, then B is determined to be successfully matched with the abnormal indicator data; otherwise, B is determined to be unsuccessfully matched with the abnormal indicator data.

[0061] Through the above steps, when the data source type corresponding to the node selection description text is log type, the node selection description text is structured and parsed to extract key indicator data. This data is then matched with abnormal indicator data in the key dataset to determine the corresponding indicator observation value. The standard indicator value in the key indicator data is compared numerically with the corresponding indicator observation value. Based on the comparison results and the comparison relationships within the key indicator data, the matching result for that key indicator data is determined. If all matching results for the key indicator data corresponding to the node selection description text are successful, then the node selection description text and the abnormal indicator data are considered successfully matched; otherwise, the matching is considered unsuccessful. This process automates and objectively verifies the inference results of the large model, effectively ensuring that the judgment has a real indicator basis and avoiding subjective inferences without factual support. This significantly improves the credibility of weight adjustment, the accuracy of target anomaly scores, and the accuracy and reliability of the final root cause localization results.

[0062] Specifically, step S2 also includes the following sub-steps S2001-S2002: S2001. When D is a case class, perform structured parsing on B to obtain several fault case identifiers corresponding to B.

[0063] S2002. If each fault case identifier corresponding to B belongs to the fault case identifier set corresponding to the key dataset, then it is determined that B is successfully matched with the historical fault case; otherwise, it is determined that B is not matched with the historical fault case. The fault case identifier set corresponding to the key dataset includes the fault case identifier in each historical fault case in the key dataset.

[0064] Through the above steps, when the data source type corresponding to the node selection description text is a case type, the corresponding fault case identifier is obtained by structured parsing of the node selection description text. When each fault case identifier corresponding to the node selection description text belongs to the fault case identifier set corresponding to the associated dataset, it is determined that the node selection description text and the historical fault case are successfully matched; otherwise, it is determined that the node selection description text and the historical fault case are not matched. This prevents the large model from fabricating or misciting historical cases, and ensures that the large model's case-based reasoning has a real and traceable basis, thereby significantly improving the credibility of weight adjustment, the accuracy of target anomaly scores, and the accuracy and reliability of the final root cause localization results.

[0065] S3, based on A i And α, obtain C i The corresponding target anomaly score is used to determine the root cause localization result.

[0066] Specifically, in step S3, all target anomaly nodes are sorted in descending order of their target anomaly scores to obtain root cause localization results.

[0067] Through the above steps, based on the key dataset and large model, at least one target anomaly node is selected from several initial anomaly nodes, and a list of predicted anomaly scores and node selection instructions are obtained. The list of predicted anomaly scores includes the predicted anomaly score corresponding to each target anomaly node. Initial anomaly nodes are nodes in the fault's call chain graph, obtained based on the call chain graph and the corresponding anomaly indicator data. The key dataset includes: the node identifier of each initial anomaly node, several call chain paths from the start of the call chain graph to the initial anomaly node, the anomaly indicator data corresponding to each initial anomaly node, the target anomaly log, and historical fault cases. Based on the data source type corresponding to the node selection instructions and the preset data source type set, the adjustment weights corresponding to the predicted anomaly scores are determined. Based on the predicted anomaly scores and predicted anomaly scores of the target anomaly nodes... The system adjusts the weights corresponding to constant scores to obtain the target anomaly scores for target anomaly nodes, and determines the root cause localization results based on the target anomaly scores. It not only integrates fault call chain topology and quantitative indicator data, but also effectively utilizes the fault semantic information contained in unstructured text such as logs. By introducing historical fault cases and interpretable logical reasoning through a large model, it performs semantically enhanced anomaly re-evaluation on the initial anomaly nodes, thereby filtering out target anomaly nodes. Furthermore, by combining the adjusted weights corresponding to the predicted anomaly scores and the predicted anomaly scores obtained based on the node selection description text, which can reflect the credibility of the large model's reasoning, the system calculates the target anomaly scores for each target anomaly node. The target anomaly nodes are then accurately ranked according to the target anomaly scores to determine the root cause localization results, significantly improving the accuracy, reliability, and scenario generalization ability of root cause localization.

[0068] Specifically, while obtaining the initial abnormal nodes based on the call chain graph and the abnormal indicator data corresponding to the fault, the initial abnormal score corresponding to each initial abnormal node is also obtained.

[0069] Specifically, C i The corresponding target anomaly score H i Meets the following conditions: H i =W1×F i +W2×A i ×α; W1 is the importance weight corresponding to the initial anomaly score; F i For C i The score is obtained by normalizing the corresponding initial anomaly score; W2 is the importance weight corresponding to the predicted anomaly score.

[0070] Specifically, W1 represents the importance of the initial anomaly score; the larger W1 is, the higher the importance of the initial anomaly score. W2 represents the importance of the predicted anomaly score; the larger W2 is, the higher the importance of the predicted anomaly score. The specific values ​​of W1 and W2 are set by those skilled in the art according to actual needs, for example: W1=0.7, W2=-0.3; W1=0.6, W2=0.4; W1=W2=0.5, which will not be elaborated here.

[0071] Through the above steps, the initial anomaly score and the predicted anomaly score are weighted and fused, and the adjustment weight corresponding to the predicted anomaly score dynamically generated based on the node selection description text is introduced to calculate the target anomaly score. This not only preserves the objective and stable evaluation results based on the call chain and indicator data, but also fully integrates the semantic understanding of unstructured data such as logs, call chains, and historical failure cases by the large model, as well as the contextual reasoning ability of the large model. Furthermore, the target anomaly nodes are sorted based on the target anomaly score to obtain the root cause localization results, which significantly improves the accuracy, robustness, and adaptability to different failure scenarios of root cause localization.

[0072] In a specific embodiment, before step S1, the following sub-steps S001-S005 are included: obtaining initial abnormal nodes based on the call chain diagram and the abnormal indicator data corresponding to the fault, and obtaining the initial abnormal score corresponding to each initial abnormal node: S001. Extract the fault call chain graph T from the graph database. T includes several nodes and dependency edges between nodes. Nodes are used to represent service instances, microservices, hosts, etc. The fault call chain graph is the complete call chain graph corresponding to the fault.

[0073] Specifically, the graph database is a database system that supports attribute graph models, such as Neo4j database, which will not be elaborated further here.

[0074] S002. Inject the abnormal indicator data corresponding to the fault into the attribute fields of each node in T so that T can be updated; the abnormal indicator data corresponding to the fault includes the abnormal indicator data corresponding to each node in T.

[0075] Specifically, for each node in T, the abnormal indicator data corresponding to the node includes: node identifier, the name of at least one preset monitoring indicator, and the current indicator value corresponding to each indicator name.

[0076] Specifically, for each node in T, the abnormality index data corresponding to the node also includes an abnormality degree label.

[0077] S003. Perform a pruning operation on T, removing all connected subgraphs whose anomaly degree labels are all normal, as well as call paths whose path length is less than a preset path length threshold, so that T can be updated; the preset degree threshold is a threshold set by those skilled in the art according to actual needs, such as 3 or 4, which will not be elaborated here.

[0078] Specifically, the call path is a directed path that starts from the beginning of the call chain graph and ends at a certain node in T.

[0079] Specifically, the path length of the call path is the number of nodes included in the call path.

[0080] S004. For each node in T, obtain the initial anomaly score corresponding to the node.

[0081] Specifically, the y-th node J in T y The corresponding initial anomaly score U y Meets the following conditions: U y =∑ q(y) x=1 (V yx ×Z yx )×(1+γ×DESC y / DESC max )×GJ y Where 1 ≤ y ≤ q, and q is the number of nodes in T; V xy For J y The preset weight Z corresponding to the x-th preset monitoring indicator. yx For J y The anomaly intensity is obtained by normalizing the current value of the corresponding x-th preset monitoring indicator, where 1 ≤ x ≤ q(y), and q(y) is J. y The corresponding number of preset monitoring indicators; γ is the influence breadth adjustment factor; DESC y For J y Number of reachable downstream nodes, DESC max GJ is the maximum number of downstream nodes corresponding to all nodes in T; y For J y The corresponding upstream cleanliness factor; where, when J y When all nodes directly and indirectly dependent on the upstream have anomaly level labels of no anomaly, GJ is determined. y =1, otherwise, determine GJ y =β, β<1.

[0082] Specifically, ∑ q(y) x=1 V yx=1, where the specific value of the preset weight of the preset monitoring indicator is set in advance by those skilled in the art according to the importance of the preset monitoring indicator, and will not be elaborated here.

[0083] Specifically, 0 ≤ γ ≤ 1, and the specific value of γ is preset by those skilled in the art according to actual needs, and will not be elaborated here.

[0084] Specifically, the number of downstream nodes corresponding to a node is the number of downstream nodes that can be reached from that node.

[0085] Specifically, β is a preset constant less than 1, for example, 0.5, which will not be elaborated further here. S005. Sort all nodes in T in descending order of initial abnormal scores, and take the first g nodes in the sorting results as initial abnormal nodes, where g is a preset node number threshold. The preset node number threshold is a value set by those skilled in the art according to actual needs, such as 3 or 4, which will not be elaborated here.

[0086] Through the above steps, firstly, the complete call chain graph corresponding to the fault is extracted from the graph database, and the abnormal indicator data of each node is injected into its attribute fields to achieve a structured expression of the system's operating status in a unified graph structure. Then, the updated call chain graph is pruned, removing connected subgraphs with only normal nodes and excessively short call paths, allowing the graph structure to further focus on key areas that may participate in fault propagation and effectively reducing interference from irrelevant information. Based on this, for each node in the pruned call chain graph, a multi-dimensional anomaly assessment is performed, considering the anomaly intensity, impact breadth, and upstream cleanliness of its preset monitoring indicators, to obtain an initial anomaly score. This ensures that the initial anomaly score not only reflects the node's own anomaly level but also incorporates its contextual role in the call topology, significantly improving the accuracy of the initial anomaly score. Finally, all nodes are sorted in descending order of the initial anomaly score, and the top few are selected as initial anomaly nodes for use as input data to build a large model. This ensures that the input data has high relevance and low noise characteristics, effectively controlling the inference cost of the large model and providing a high-quality foundation for subsequent semantic enhancement and accurate ranking, thereby improving the overall accuracy of root cause localization.

[0087] Specifically, F i Meets the following conditions: F i =(Q i -Q min ) / (Q max -Q min) , where Q i C i The corresponding initial anomaly score, Q min Q is the minimum of the initial anomaly scores for all nodes in T.max It is the maximum value among the initial anomaly scores corresponding to all nodes in T.

[0088] Embodiments of the present invention also provide a non-transitory computer-readable storage medium that can be disposed in an electronic device to store a computer program related to implementing a method in the method embodiments, the computer program being loaded and executed by the processor to implement the method provided in the above embodiments.

[0089] Embodiments of the present invention also provide an electronic device, including: a processor, a memory, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the method provided in the above embodiments.

[0090] Embodiments of the present invention also provide a computer program product including program code, which, when the program product is run on an electronic device, causes the electronic device to perform the steps of the methods described above in various exemplary embodiments of the present invention.

[0091] While specific embodiments of the invention have been described in detail by way of examples, those skilled in the art should understand that the examples are for illustrative purposes only and are not intended to limit the scope of the invention. Those skilled in the art should also understand that various modifications can be made to the embodiments without departing from the scope and spirit of the invention.

Claims

1. A method for locating the root cause of a fault, characterized in that, The method includes the following steps: S1. Based on the key dataset and large model, select at least one target anomaly node from several initial anomaly nodes, and obtain a list of predicted anomaly scores A and node selection description text B; where A = (A1, A2, ..., A...). i , ..., A n A i For the i-th target anomaly node C i The corresponding predicted anomaly score; 1≤i≤n, where n is the number of target anomaly nodes; the initial anomaly node is a node in the fault call chain graph, obtained based on the call chain graph and the anomaly index data corresponding to the fault; the key dataset includes: the node identifier of each initial anomaly node, several call chain paths from the starting point of the call chain graph to the initial anomaly node, and the anomaly index data corresponding to each initial anomaly node, target anomaly logs, and historical fault cases. S2. If E does not include D, then α = 0; if E includes D, then α is obtained based on D and the key dataset; D is the data source type corresponding to B, and E is a preset set of data source types, including log type, indicator type and case type; α is the adjustment weight corresponding to the predicted anomaly score. When D is a log class, α is obtained based on the semantic similarity between B and the target exception log; When D is an indicator class, if B successfully matches the abnormal indicator data, then set α=1; otherwise, set α=0. When D is a case class, if B successfully matches a historical failure case, then let α=1; otherwise, let α=0. The step of obtaining α based on the semantic similarity between B and the target anomaly log includes the following sub-steps: S21. For each target anomalous log in the key dataset, the vector similarity between the semantic feature vector corresponding to B and the semantic feature vector of the target anomalous log is taken as the semantic similarity between B and the target anomalous log; wherein, the vector dimension of the semantic feature vector corresponding to B is the same as that of the semantic feature vector of the target anomalous log. S22. Sort all semantic similarities in descending order to obtain a semantic similarity sequence, and take the first f semantic similarities in the semantic similarity sequence as the target similarity; f is a preset quantity threshold; S23. When P > 0, let α = P; when P ≤ 0, let α = 0; P is the average of all target similarities. Step S2 also includes the following sub-steps: S201. When D is an indicator class, perform structured parsing on B to obtain several key indicator data contained in B. The key indicator data includes: node identifier, indicator name, standard indicator value corresponding to the indicator name, and comparison relationship. S202. For each key indicator data corresponding to B, when the node identifier in the abnormal indicator data in the key dataset is consistent with the node identifier in the key indicator data, and the abnormal indicator data includes the indicator name in the key indicator data, the current indicator value corresponding to the indicator name in the abnormal indicator data is taken as the indicator observation value corresponding to the key indicator data. S203. Compare the standard indicator values ​​in the key indicator data with the corresponding indicator observation values, and determine the matching result of the key indicator data based on the comparison results and the comparison relationship in the key indicator data; the matching result includes successful matching and failed matching. S204. If all the key indicator data corresponding to B are successfully matched, then B is determined to be successfully matched with the abnormal indicator data; otherwise, B is determined to be unmatched with the abnormal indicator data. S3, based on A i And α, obtain C i The corresponding target anomaly score is used to determine the root cause localization result.

2. The fault root cause localization method according to claim 1, characterized in that, The abnormal indicator data corresponding to the initial abnormal node includes the node identifier, the indicator name of at least one preset monitoring indicator, and the current indicator value corresponding to each indicator name.

3. The fault root cause localization method according to claim 1, characterized in that, The historical fault cases corresponding to the initial abnormal node are obtained by querying the fault case database. The fault case database includes several fault cases, each of which includes fault description information, a fault case identifier corresponding to the fault description information, and a node identifier of the root cause node corresponding to the fault description information. If the node identifier of the initial abnormal node is consistent with the node identifier of the root cause node in the fault case, then the fault case is regarded as the historical fault case corresponding to the initial abnormal node.

4. The fault root cause localization method according to claim 3, characterized in that, Step S2 also includes the following sub-steps: S2001. When D is a case class, perform structured parsing on B to obtain several fault case identifiers corresponding to B. S2002. If each fault case identifier corresponding to B belongs to the fault case identifier set corresponding to the key dataset, then it is determined that B is successfully matched with the historical fault case; otherwise, it is determined that B is not matched with the historical fault case. The fault case identifier set corresponding to the key dataset includes the fault case identifier of each historical fault case in the key dataset.

5. The fault root cause localization method according to claim 1, characterized in that, While obtaining the initial abnormal nodes based on the call chain graph and the abnormal indicator data corresponding to the fault, the initial abnormal score corresponding to each initial abnormal node is also obtained.

6. The fault root cause localization method according to claim 5, characterized in that, C i The corresponding target anomaly score H i Meets the following conditions: H i =W1×F i +W2×A i ×α; W1 is the importance weight corresponding to the initial anomaly score; F i For C i The score is obtained by normalizing the corresponding initial anomaly score; W2 is the importance weight corresponding to the predicted anomaly score.

7. A non-transitory computer-readable storage medium, characterized in that, The storage medium stores a computer program, which is loaded and executed by a processor to implement the fault root cause localization method as described in any one of claims 1-6.

8. An electronic device, comprising: A processor, a memory, and a computer program stored in the memory and executable on the processor, characterized in that, when the processor executes the computer program, it implements the fault root cause localization method as described in any one of claims 1-6.

Images