Large model-based server operation and fault intelligent diagnosis method, device, equipment and medium

Abstract

The application provides a large model-based server operation and maintenance and intelligent fault diagnosis method, device, equipment and medium, the method comprises the following steps: obtaining the operation and maintenance natural language request input by a user, an agent analyzes current state information based on a large language model, generates a tool calling instruction containing a target tool identifier, an execution parameter and a credential identifier, and the execution parameter does not contain a plaintext password; according to the target tool identifier, a corresponding operation and maintenance tool is called, the operation and maintenance tool obtains credential information according to the credential identifier and performs an operation and maintenance operation to obtain an operation execution result; the agent receives the operation execution result, judges whether the operation and maintenance task is completed, if not, the operation execution result is taken as new current state information to continue generating a next step tool calling instruction, if yes, a diagnosis conclusion is generated and output; by replacing the plaintext password with a credential ID, combining full-link auditing and dangerous operation interception, safe and controllable intelligent operation and maintenance diagnosis is realized.

Description

Technical Field

[0001] This invention relates to the field of server operation and maintenance technology, and in particular to a method, apparatus, equipment and medium for server operation and maintenance and intelligent fault diagnosis based on a large model. Background Technology

[0002] With the rapid development of information technology, the scale of enterprise IT infrastructure is constantly expanding, the number of servers is surging, and system architecture is becoming increasingly complex. Server operation and maintenance, as a key link in ensuring the stable operation of business systems, is facing unprecedented challenges.

[0003] Currently, traditional server maintenance primarily relies on manual operation. Maintenance personnel need to manually execute Linux commands via SSH to check system status, examine log files, and analyze performance metrics; connect to the database using database clients to execute SQL queries to diagnose database problems; and perform HTTP request tests to check API service availability. This process requires maintenance personnel to be proficient in multiple professional skills, including Linux commands, database query statements, and network diagnostic tools. Maintenance experience and troubleshooting knowledge are largely accumulated by senior maintenance personnel, making it difficult to systematically consolidate and pass on. Newly hired maintenance personnel often require a considerable amount of learning and training to become competent. Furthermore, various maintenance tools, such as SSH tools, database management tools, and monitoring systems, are independent and scattered across different systems, lacking a unified entry point and calling method, resulting in cumbersome and inefficient operation processes.

[0004] When a failure occurs, operations and maintenance (O&M) personnel need to manually troubleshoot each issue, which often takes a long time from problem discovery to root cause identification. This slow response time makes it difficult to meet the high availability requirements of business systems, especially when failures occur at night or on holidays, where the response time is even slower. Furthermore, most existing O&M systems lack comprehensive operation auditing capabilities, making it difficult to trace which operations were performed by O&M personnel and their results. This makes it difficult to identify the responsible party and specific actions taken after a security incident.

[0005] In recent years, the development of Large Language Model (LLM) technology has brought new ideas to the field of operations and maintenance (O&M). Agents built based on LLM can understand users' natural language requests, automatically decompose tasks, and invoke relevant tools to perform operations, potentially replacing manual labor in repetitive O&M tasks. However, existing LLM O&M solutions have significant security shortcomings. On the one hand, the context window of the LLM may contain sensitive credentials such as plaintext passwords for servers and database connection strings, posing a risk of leakage. On the other hand, when the LLM autonomously invokes tools, it may execute dangerous commands, such as accidentally executing destructive operations like `rm -rf` or `shutdown`, lacking effective security protection mechanisms. Furthermore, the decision-making process of the LLM during multi-step inference and tool invocation lacks complete documentation, making auditing and tracing difficult after problems occur.

[0006] In summary, the existing technology has at least the following drawbacks: First, there is a high degree of reliance on manual labor. Current operation and maintenance methods rely on maintenance personnel to manually execute commands, view logs, and analyze faults. The degree of automation is low, and the efficiency of operation and maintenance is limited by the number of personnel and their skill levels.

[0007] Second, the knowledge threshold is high. Maintenance personnel need to master professional knowledge such as Linux commands, database queries, and network diagnostics; the training period for new employees is long and costly.

[0008] Third, the response speed is slow. When a fault occurs, manual troubleshooting requires checking the system status item by item and analyzing log files, which is time-consuming and difficult to meet business continuity requirements.

[0009] Fourth, experience is difficult to pass on. The fault diagnosis experience of senior maintenance personnel is mostly accumulated by individuals, lacking an effective knowledge accumulation and sharing mechanism.

[0010] Fifth, the tools are scattered and lack a unified entry point. Operation and maintenance tools such as SSH, database clients, and monitoring systems are independent and scattered across different systems. Operation and maintenance personnel need to frequently switch between multiple tools, making the operation process cumbersome.

[0011] Sixth, there is a high risk of credential security breaches. In existing large-scale model operation and maintenance solutions, sensitive credentials such as server passwords and database passwords may appear in plaintext within the context of large-scale model dialogues, posing a security risk of leakage.

[0012] Seventh, lack of protection against dangerous operations. When the large model executes commands autonomously, there is a lack of effective identification and interception mechanisms for dangerous commands, which may lead to accidental damage to the system.

[0013] Eighth, insufficient audit traceability capabilities. The multi-step reasoning and tool invocation processes of large models lack complete execution log records, making it difficult to trace responsibility after a security incident or operational error. Summary of the Invention

[0014] The technical problem to be solved by this invention is to provide a method, device, equipment and medium for server operation and maintenance and intelligent fault diagnosis based on a large model. By replacing plaintext passwords with credential IDs and combining full-link auditing and dangerous operation interception, a secure and controllable intelligent operation and maintenance diagnosis is achieved.

[0015] In a first aspect, the present invention provides a server operation and maintenance and fault intelligent diagnosis method based on a large model, comprising the following steps: Step S1: Obtain the user's input in natural language for operation and maintenance; Step S2: Input the operation and maintenance natural language request into a preset intelligent agent. The intelligent agent parses the current state information based on a large language model and generates a tool call instruction. The tool call instruction includes the target tool identifier, execution parameters, and credential identifier. The execution parameters do not contain plaintext passwords. Step S3: According to the target tool identifier in the tool call instruction, the corresponding operation and maintenance tool is called. The operation and maintenance tool obtains the required credential information for execution based on the credential identifier, and uses the credential information to perform the corresponding operation and maintenance operation to obtain the operation execution result. Step S4: The agent receives the operation execution result and determines whether the maintenance task has been completed based on the operation execution result. If not completed, the operation execution result is used as new current status information. This current status information is used as input to the agent when returning to step S2, so that the agent can perform comprehensive reasoning based on the maintenance natural language request, historical reasoning process, and the current operation execution result to generate the next tool call instruction. If completed, proceed to step S5. Step S5: Generate and output the operation and maintenance diagnosis conclusion based on all the obtained operation execution results.

[0016] Secondly, the present invention provides a server operation and maintenance and fault diagnosis intelligent device based on a large model, comprising: The input module retrieves user-inputted natural language requests for operations and maintenance. The instruction generation module inputs the operation and maintenance natural language request into a preset intelligent agent. The intelligent agent parses the current state information based on a large language model and generates a tool invocation instruction. The tool invocation instruction includes a target tool identifier, execution parameters, and a credential identifier. The execution parameters do not contain a plaintext password. The tool invocation module invokes the corresponding operation and maintenance tool according to the target tool identifier in the tool invocation instruction. The operation and maintenance tool obtains the required credential information for execution according to the credential identifier, and uses the credential information to perform the corresponding operation and maintenance operation to obtain the operation execution result. In the cyclic decision-making module, the agent receives the operation execution result and determines whether the maintenance task has been completed based on the result. If not, the operation execution result is used as new current status information, which is then used as input to the agent when returning to the instruction generation module. This allows the agent to perform comprehensive reasoning based on the maintenance natural language request, historical reasoning process, and the current operation execution result to generate the next tool call instruction. If the task has been completed, the process proceeds to the conclusion generation module. The conclusion generation module generates and outputs operation and maintenance diagnosis conclusions based on all the obtained operation execution results.

[0017] Thirdly, the present invention provides an electronic device including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the program to implement the method described in the first aspect.

[0018] Fourthly, the present invention provides a computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, implements the method described in the first aspect.

[0019] One or more technical solutions provided by this invention have at least the following technical effects or advantages: 1. By introducing an intelligent agent based on a large language model, this invention allows operations and maintenance personnel to complete server status checks, troubleshooting, and daily operations and maintenance simply by describing problems or needs in natural language. They do not need to master complex Linux commands, database query statements, or network diagnostic tools. This significantly reduces the professional skills required of operations and maintenance personnel and shortens the training cycle for new employees.

[0020] 2. This invention adopts the ReAct (Reasoning + Acting) architecture pattern. The intelligent agent can automatically identify the intent of user requests, decompose tasks, and call tools. It can complete multiple rounds of "thinking → action → observation" iteration within tens of seconds, automatically completing the fault diagnosis process that would take several minutes or even tens of minutes to complete manually. This greatly shortens the fault diagnosis time and improves the availability of business systems.

[0021] 3. This invention employs a core security mechanism that replaces plaintext passwords with credential IDs. The tool invocation instructions of the intelligent agent only contain the credential identifier and no plaintext password. The operation and maintenance tool obtains the necessary credential information for execution from the credential management service based on the credential identifier. The intelligent agent never encounters the plaintext password throughout the process, fundamentally eliminating the risk of password leakage within the large model context window. Simultaneously, the credential information is stored in encrypted form, and front-end transmission uses RSA public key encryption, achieving end-to-end security protection.

[0022] 4. This invention implements a multi-layered security protection mechanism at the tool level. The SSH tool has a built-in blacklist of dangerous commands, which hard-blocks high-risk commands such as rm -rf / , shutdown, reboot, mkfs, and dd if=; the MySQL query tool forces only SELECT queries and prohibits data modification operations such as DROP, DELETE, and UPDATE; at the system prompt level, it restricts the agent from guessing and simulating execution results. The three layers of protection work together to effectively prevent destructive operations that may occur when a large model executes autonomously, ensuring the safety and stability of the production environment.

[0023] 5. This invention establishes a complete five-layer audit log system, including tool execution logs, dangerous operation logs, user request logs, system operation logs, and login logs. Every tool call, every user, every credential, and every command or SQL statement is fully recorded, supporting rapid retrieval by user, time, tool type, and other dimensions. In the event of a security incident, the operator, operation time, operation content, and execution result can be accurately located within 1 to 5 minutes, completely solving the pain point of untraceable operations in traditional operations and maintenance.

[0024] 6. This invention integrates multiple operation and maintenance tools, such as SSH remote command execution, MySQL database query, local shell command execution, and HTTP service health check, into a unified intelligent agent framework. It manages these tools through a unified credential management service and a unified audit log service. Operation and maintenance personnel no longer need to frequently switch between multiple tools, achieving "one entry point and one sentence" to complete all operation and maintenance operations, greatly simplifying the operation and maintenance process.

[0025] 7. This invention solidifies the experience and processes of operation and maintenance fault diagnosis into the system prompts and tool call logic of the intelligent agent. Different fault scenarios (such as high CPU usage, slow database queries, API service unavailability, etc.) have corresponding diagnostic paths. Every successful fault diagnosis process can be recorded and reused, realizing the transformation of operation and maintenance knowledge from personal experience to systematic assets, and effectively solving the problem of the difficulty in passing on the experience of senior operation and maintenance personnel.

[0026] 8. This invention adopts the ReAct architecture pattern. Before each tool call, the agent generates intermediate output containing the reasoning process, and after receiving the tool execution result, it generates intermediate output containing the reflection process. It can dynamically adjust the next action strategy based on the execution result of the previous step. When the tool call fails, the agent can correct the parameters based on the error feedback and automatically retry, possessing strong adaptive and error recovery capabilities, thus improving the completion rate of operation and maintenance tasks.

[0027] 9. This invention provides a unified credential management service for centralized management of credentials for all operation and maintenance tools, supporting fine-grained permission allocation based on both user and department dimensions. Each tool call verifies whether the current user has the necessary permissions, ensuring that users can only access their authorized server and database resources, effectively preventing unauthorized access and permission abuse.

[0028] The above description is merely an overview of the technical solution of the present invention. In order to better understand the technical means of the present invention and to implement it in accordance with the contents of the specification, and in order to make the above and other objects, features and advantages of the present invention more apparent and understandable, specific embodiments of the present invention are described below. Attached Figure Description

[0029] The present invention will be further described below with reference to the accompanying drawings and embodiments.

[0030] Figure 1 This is a flowchart of the method in Embodiment 1 of the present invention; Figure 2 This is a schematic diagram of the device in Embodiment 2 of the present invention. Detailed Implementation

[0031] The overall concept of the technical solution in this application is as follows: This invention proposes a server operation and maintenance and fault intelligent diagnosis method based on a large model, which includes the following core modules: 1. SSH remote execution tool Securely execute remote server commands using SSHTool: @Component public class SSHTool { private static final List <string>FORBIDDEN_COMMANDS = List.of( "rm -rf / ", "shutdown", "reboot", "mkfs", "dd if=" ); @Tool(description = "Rule for executing SSH commands (short connection) using credential ID: " + 1. `output` represents the actual SSH output. 2. A non-empty `error` value indicates execution failure. 3. Guessing server status is strictly prohibited. 4. Simulating Linux output is strictly prohibited. 5. Answers must be based solely on actual SSH results. public ToolResultVo sshExecCmdById(SshExecCmdParam param, ToolContext toolContext) { Long credentialId = param.getCredentialId(); String cmd = param.getCmd(); / / 1. Dangerous command interception String lowerCmd = cmd.toLowerCase(); for (String forbidden : FORBIDDEN_COMMANDS) { if (lowerCmd.contains(forbidden)) { log.warn("Dangerous command intercepted userId={}, cmd={}", userId,cmd); return buildError(inputInfo, "A dangerous command was detected and execution has been refused"); } } / / 2. Permission Verification and Credential Acquisition AccountCredentialDTO server = accountCredentialService.getCredentialForExecution( credentialId, userId, tokenStr); / / 3. SSH connection and execution return doExec(server.getHost(), server.getPort(), server.getUsername(), server.getPassword(), cmd, credentialId, userId); } private ToolResultVo doExec(String host, int port, String username, String password, String cmd, Long credentialId, String userId) { Session session = null; ChannelExec channel = null; try { / / JSch SSH connection JSch jsch = new JSch(); session = jsch.getSession(username, host, port); session.setPassword(password); session.setConfig("StrictHostKeyChecking", "no"); session.connect(CONNECT_TIMEOUT); / / Execute command channel = (ChannelExec) session.openChannel("exec"); channel.setCommand("timeout " + COMMAND_TIMEOUT + "s bash -lc " + quote(cmd)); / / Capture output ByteArrayOutputStream errStream = new ByteArrayOutputStream(); channel.setErrStream(errStream); InputStream inputStream = channel.getInputStream(); channel.connect(CONNECT_TIMEOUT); / / Read the output StringBuilder stdout = new StringBuilder(); byte[] buffer = new byte

[4096] ; while (true) { while (inputStream.available() > 0) { int len = inputStream.read(buffer); if (len < 0) break; stdout.append(new String(buffer, 0, len, StandardCharsets.UTF_8)); } if (channel.isClosed() && inputStream.available() == 0) break; Thread.sleep(100); } int exitCode = channel.getExitStatus(); String stderrText = errStream.toString(StandardCharsets.UTF_8).trim(); / / Record the execution log saveExecutionLog(credentialId, userId, username, cmd, buildFullResult(stdout.toString(), stderrText, exitCode), exitCode != 0 ? "FAIL" : "SUCCESS", exitCode != 0 ? "Command execution failed" : null, startTime); return ToolResultVo.builder() .output(stdout.toString()) .error(exitCode != 0 ? stderrText : null) .build(); finally { / / Resource cleanup if (channel != null) channel.disconnect(); if (session != null) session.disconnect(); } } } 2. Database diagnostic tools Use MySQLQueryTool to perform database status queries and performance diagnostics. @Componentpublic class MySQLQueryTool { @Tool(description = "General SQL query main entry point, executes database queries using credential ID") public ToolResultVo queryDBById(QueryDBByIdParam param, ToolContext toolContext) { Long credentialId = param.getCredentialId(); String sql = param.getSql(); / / 1. SQL security check String checkResult = validateSelectSql(sql); if (checkResult != null) { return buildError(inputInfo, checkResult); } / / 2. Permission verification AccountCredentialDTO dataBase = accountCredentialService.getCredentialForExecution( credentialId, userId, tokenStr); / / 3. Build data source SimpleDriverDataSource dataSource = new SimpleDriverDataSource(); dataSource.setDriver(new Driver()); dataSource.setUrl(String.format("jdbc:mysql: / / %s:%s / %s", dataBase.getFieldData().get("host"), dataBase.getFieldData().get("port"), dataBase.getFieldData().get("database"))); dataSource.setUsername(dataBase.getAccountName()); dataSource.setPassword(dataBase.getPasswordPlain()); / / 4. Execute query try (Connection conn = dataSource.getConnection(); Statement stmt = conn.createStatement(); ResultSet rs = stmt.executeQuery(sql)) { / / Parse result List<Map<String, Object>> results = new ArrayList<>(); ResultSetMetaData metaData = rs.getMetaData(); int columnCount = metaData.getColumnCount(); while (rs.next()) { Map<String, Object> row = new HashMap<>(); for (int i = 1; i <= columnCount; i++) { row.put(metaData.getColumnName(i), rs.getObject(i)); } results.add(row); } saveExecutionLog(credentialId, userId, null, sql, JSON.toJSONString(results), "SUCCESS",null, startTime); return ToolResultVo.builder() .output(JSON.toJSONString(results)) .build(); } } / / SQL security check private String validateSelectSql(String sql) { String lowerSql = sql.toLowerCase().trim(); / / Only SELECT queries are allowed if (!lowerSql.startsWith("select")) { return "Only SELECT queries are allowed"; } / / Dangerous operations are prohibited if (lowerSql.contains("drop ") || lowerSql.contains("delete") || lowerSql.contains("update ") || lowerSql.contains("insert") || lowerSql.contains("truncate") || lowerSql.contains("alter")) { The return value reads "Disable DROP / DELETE / UPDATE / INSERT / TRUNCATE / ALTER operations". } return null; } } 3. Shell local execution tools Using ShellTool to execute commands and perform file operations on a local server: public class ShellTool implements BiFunction <ShellTool.ShellRequest, ToolContext, ToolResultVo> { public static final String DESCRIPTION = """ Executes shell commands on the current operating system. - On Windows, commands are executed using PowerShell - On Linux / Mac, commands are executed using bash """; @Override public ToolResultVo apply(ShellRequest request, ToolContexttoolContext) { String command = request.command; String userId = extractUserId(toolContext); try { ProcessBuilder processBuilder; if (isWindows()) { processBuilder = new ProcessBuilder("powershell.exe","-Command", command); } else { processBuilder = new ProcessBuilder("bash", "-c",command); } processBuilder.redirectErrorStream(true); Process process = processBuilder.start(); / / Read output BufferedReader reader = new BufferedReader( new InputStreamReader(process.getInputStream(),StandardCharsets.UTF_8)); StringBuilder output = new StringBuilder(); String line; while ((line = reader.readLine()) != null) { output.append(line).append("\n"); } int exitCode = process.waitFor(); / / Record log saveExecutionLog(userId, command, output.toString(), exitCode != 0 ? "FAIL" : "SUCCESS", exitCode != 0 ? "Command failed" : null,startTime); return ToolResultVo.builder() .output(output.toString()) .build(); } catch (Exception e) { return ToolResultVo.builder() .error("Command execution failed: " + e.getMessage()) .build(); } } } 4. HTTP service diagnostic tools Perform API health checks and network diagnostics using HttpTool: @Componentpublic class HttpTool { @Tool(description = "HTTP access when Basic authentication is required") public ToolResultVo httpRequestById(HttpRequestByIdParam param, ToolContext toolContext) { / / 1. Permission verification AccountCredentialDTO credential = accountCredentialService.getCredentialForExecution( credentialId, userId, tokenStr); / / 2. Construct an HTTP request String url = buildUrl(target.host(), target.port(), path,target.https()); HttpRequest request = createRequest(method, url); / / 3. Configure SSL (supports ignoring SSL verification) configSSL(request, target.https(), ignoreSSL, certPath,certPassword); / / 4. Configure Headers configHeaders(request, mergedHeaders); / / 5. Execute the request HttpResponse response = request.execute(); / / 6. Record logs saveExecutionLog(credentialId, userId,credential.getAccountName(), method, url, response.body(), response.isOk() ? "SUCCESS" : "FAIL", response.isOk() ? null : "HTTP error",startTime); return processResponse(response, inputInfo); } } 5. Complete execution log system Record detailed information about all operation and maintenance operations: @TableName(value = "tool_execution_log") public class ToolExecutionLogEntity { @TableId(type = IdType.AUTO) private Long id; private String userId; / / Operate on user ID private String username; / / Username (credential) private String toolType; / / Tool type (SSH / HTTP / MySQL / SHELL) private Long credentialId; / / Credential ID private String executionCommand; / / The command / SQL / request to be executed private String executionResult; / / Execution result private String status; / / status (SUCCESS / FAIL) private String errorMessage; / / Error message private Long duration; / / Execution time (milliseconds) private Date createdAt; / / Creation time } 6. Agent Intelligent Diagnostic Process Intelligent diagnostics can be achieved by integrating multiple tools through ReactAgent: public Flux <streamchatvo>streamChat(ChatRequest chatRequest) { / / 1. Build the Agent ReactAgent reactAgent = reactAgentFactory.create(token,enableThinking); / / 2. Set system prompts (including operation and maintenance diagnostic guidance) String systemPrompt = getSystem(userId, sessionType); reactAgent.setSystemPrompt(systemPrompt); / / 3. Streaming execution Flux <nodeoutput>nodeOutputFlux = reactAgent.stream( buildUserMessage(userQuestion, imageUrls), config); / / 4. Convert to streaming response return convertToStreamChatVO(nodeOutputFlux, context); } Typical Fault Diagnosis Scenarios Scenario 1: High server CPU usage; User: Server 192.168.1.100 has very high CPU usage, please check it for me; Agent execution flow: 1. Execute "top -bn1 | head -20" using sshExecCmdById; 2. Analysis of the output revealed that the Java process was consuming 95% of the CPU. 3. Call sshExecCmdById to execute "jstack" <pid>| grep -A 10 'RUNNABLE'"; 4. Analyze the thread stack to locate the specific line of code; 5. Return the diagnostic results and recommendations.

[0032] Scenario 2: Slow database queries User: Queries in the production database are very slow, please help me analyze it; Agent execution flow: 1. Call queryDBById to execute "SHOW PROCESSLIST"; 2. Several long-running queries were discovered; 3. Execute "EXPLAIN SELECT ..." using queryDBById to analyze slow queries; 4. Use queryDBById to execute "SHOW INDEX FROM table_name" to check the index; 5. Return optimization suggestions (add indexes, rewrite SQL, etc.).

[0033] Scenario 3: API service unavailable User: The API service https: / / api.example.com / health is returning a 503 error. Please check it for me. Agent execution flow: 1. Call httpRequestById to perform a health check; 2. Analyze the response status code and response body; 3. Use sshExecCmdById to log in to the server and view the service logs; 4. Execute "systemctl status service-name" using sshExecCmdById; 5. Return the cause of the failure and recovery suggestions.

[0034] Example 1 like Figure 1 As shown, this embodiment provides a server operation and maintenance and fault intelligent diagnosis method based on a large model, including the following steps: Step S1: Obtain the user's input in natural language for operation and maintenance; Step S2: Input the operation and maintenance natural language request into a preset intelligent agent. The intelligent agent parses the current state information based on a large language model and generates a tool call instruction. The tool call instruction includes the target tool identifier, execution parameters, and credential identifier. The execution parameters do not contain plaintext passwords. Step S3: According to the target tool identifier in the tool call instruction, the corresponding operation and maintenance tool is called. The operation and maintenance tool obtains the required credential information for execution based on the credential identifier, and uses the credential information to perform the corresponding operation and maintenance operation to obtain the operation execution result. Step S4: The agent receives the operation execution result and determines whether the maintenance task has been completed based on the operation execution result. If not completed, the operation execution result is used as new current status information. This current status information is used as input to the agent when returning to step S2, so that the agent can perform comprehensive reasoning based on the maintenance natural language request, historical reasoning process, and the current operation execution result to generate the next tool call instruction. If completed, proceed to step S5. Step S5: Generate and output the operation and maintenance diagnosis conclusion based on all the obtained operation execution results.

[0035] In this embodiment, preferably, before the operation and maintenance tool obtains the credential information required for execution based on the credential identifier in step S3, it further includes: querying the authorization information of the credential information based on the credential identifier, wherein the authorization information includes the credential creator, a list of authorized users, and a list of authorized departments; Determine if the current user meets any of the following conditions: (i) The current user is the creator of the credential; (ii) The current user is in the list of authorized users; (iii) The department to which the current user belongs is listed in the authorized departments list; If any condition is met, the verification passes; otherwise, the verification fails, and the process ends.

[0036] In this embodiment, preferably, step S3 further includes the following before the maintenance tool performs the corresponding maintenance operation: When the target tool is a remote command execution tool, the command string in the execution parameters is matched with a preset dangerous command blacklist. If the match is successful, it is determined to be a dangerous operation and is blocked. When it is determined to be a dangerous operation, a dangerous operation log is recorded and an alarm notification is triggered. The dangerous command blacklist includes at least the following keywords: rm -rf / , shutdown, reboot, mkfs, dd if=. When the target tool is a database query tool, check whether the SQL statement in the execution parameters starts with SELECT. If not, block it. If it does, further check whether the SQL statement contains any of the keywords DROP, DELETE, UPDATE, INSERT, TRUNCATE, or ALTER. If it does, block it.

[0037] In this embodiment, preferably, in step S3, the corresponding operation and maintenance tool is at least one of a remote command execution tool, a database query tool, a local command execution tool, and an HTTP service health check tool; The remote command execution tool is used for executing commands on a remote server, the database query tool is used for database queries, the local command execution tool is used for executing commands locally, and the HTTP service health check tool is used for HTTP service health checks.

[0038] In this embodiment, preferably, step S3 further includes: recording an audit log for each tool call, wherein the audit log includes at least the user identifier, tool type, credential identifier, execution content, execution result, status, and execution time.

[0039] In this embodiment, preferably, in step S2, the agent adopts the ReAct architecture pattern, and before generating the tool invocation instruction, it first generates intermediate output containing the reasoning process; In step S3, when the execution parameters in the tool call instruction are in JSON format and the operation and maintenance tool fails to parse the execution parameters, the operation and maintenance tool returns a structured error feedback containing an error format description to the intelligent agent; after the intelligent agent corrects the execution parameters according to the structured error feedback, it returns to step S2 to re-initiate the tool call; In step S4, after receiving the operation execution result, the intelligent agent generates an intermediate output containing a reflection process, and then determines whether the operation and maintenance task has been completed based on the operation execution result.

[0040] In this embodiment, preferably, before step S2, the method further includes: constructing system prompts and injecting the system prompts into the dialogue context of the large language model, wherein the system prompts contain the following constraint rules: (i) The agent is strictly prohibited from guessing the server status; (ii) The aforementioned intelligent agent is strictly prohibited from simulating Linux command execution output; (iii) The agent must respond based solely on the actual results of the operation returned by the tool.

[0041] Based on the same inventive concept, this application also provides an apparatus corresponding to the method in Embodiment 1, as detailed in Embodiment 2.

[0042] Example 2 like Figure 2 As shown, this embodiment provides a server operation and maintenance and fault intelligent diagnosis device based on a large model, including: The input module retrieves user-inputted natural language requests for operations and maintenance. The instruction generation module inputs the operation and maintenance natural language request into a preset intelligent agent. The intelligent agent parses the current state information based on a large language model and generates a tool invocation instruction. The tool invocation instruction includes a target tool identifier, execution parameters, and a credential identifier. The execution parameters do not contain a plaintext password. The tool invocation module invokes the corresponding operation and maintenance tool according to the target tool identifier in the tool invocation instruction. The operation and maintenance tool obtains the required credential information for execution according to the credential identifier, and uses the credential information to perform the corresponding operation and maintenance operation to obtain the operation execution result. In the cyclic decision-making module, the agent receives the operation execution result and determines whether the maintenance task has been completed based on the result. If not, the operation execution result is used as new current status information, which is then used as input to the agent when returning to the instruction generation module. This allows the agent to perform comprehensive reasoning based on the maintenance natural language request, historical reasoning process, and the current operation execution result to generate the next tool call instruction. If the task has been completed, the process proceeds to the conclusion generation module. The conclusion generation module generates and outputs operation and maintenance diagnosis conclusions based on all the obtained operation execution results.

[0043] In this embodiment, preferably, before the operation and maintenance tool obtains the credential information required for execution based on the credential identifier in the tool invocation module, it further includes: querying the authorization information of the credential information based on the credential identifier, wherein the authorization information includes the credential creator, a list of authorized users, and a list of authorized departments; Determine if the current user meets any of the following conditions: (i) The current user is the creator of the credential; (ii) The current user is in the list of authorized users; (iii) The department to which the current user belongs is listed in the authorized departments list; If any condition is met, the verification passes; otherwise, the verification fails and the process ends.

[0044] In this embodiment, preferably, the tool invocation module further includes, before the maintenance tool performs the corresponding maintenance operation, the following: When the target tool is a remote command execution tool, the command string in the execution parameters is matched with a preset dangerous command blacklist. If the match is successful, it is determined to be a dangerous operation and is blocked. When it is determined to be a dangerous operation, a dangerous operation log is recorded and an alarm notification is triggered. The dangerous command blacklist includes at least the following keywords: rm -rf / , shutdown, reboot, mkfs, dd if=. When the target tool is a database query tool, check whether the SQL statement in the execution parameters starts with SELECT. If not, block it. If it does, further check whether the SQL statement contains any of the keywords DROP, DELETE, UPDATE, INSERT, TRUNCATE, or ALTER. If it does, block it.

[0045] In this embodiment, preferably, the corresponding operation and maintenance tool in the tool calling module is at least one of a remote command execution tool, a database query tool, a local command execution tool, and an HTTP service health check tool; The remote command execution tool is used for executing commands on a remote server, the database query tool is used for database queries, the local command execution tool is used for executing commands locally, and the HTTP service health check tool is used for HTTP service health checks.

[0046] In this embodiment, preferably, the tool invocation module further includes: an audit log recording each tool invocation, wherein the audit log includes at least the user identifier, tool type, credential identifier, execution content, execution result, status, and execution time.

[0047] In this embodiment, preferably, in the instruction generation module, the agent adopts the ReAct architecture pattern, and before generating the tool invocation instruction, it first generates intermediate output containing the reasoning process; In the tool invocation module, when the execution parameters in the tool invocation instruction are in JSON format and the operation and maintenance tool fails to parse the execution parameters, the operation and maintenance tool returns a structured error feedback containing an error format description to the intelligent agent; after the intelligent agent corrects the execution parameters according to the structured error feedback, it returns to the instruction generation module to re-initiate the tool invocation. In the cyclic decision-making module, after receiving the operation execution result, the agent generates an intermediate output containing a reflection process, and then determines whether the operation and maintenance task has been completed based on the operation execution result.

[0048] In this embodiment, preferably, the method further includes, before the instruction generation module: constructing system prompts and injecting the system prompts into the dialogue context of the large language model, wherein the system prompts contain the following constraint rules: (i) The agent is strictly prohibited from guessing the server status; (ii) The aforementioned intelligent agent is strictly prohibited from simulating Linux command execution output; (iii) The agent must respond based solely on the actual results of the operation returned by the tool.

[0049] Since the apparatus described in Embodiment 2 of the present invention is an apparatus used to implement the method of Embodiment 1 of the present invention, those skilled in the art can understand the specific structure and variations of the apparatus based on the method described in Embodiment 1 of the present invention, and therefore will not be described again here. All apparatuses used in the method of Embodiment 1 of the present invention fall within the scope of protection of the present invention.

[0050] Based on the same inventive concept, this application provides an electronic device embodiment corresponding to Embodiment 1, as detailed in Embodiment 3.

[0051] Example 3 This embodiment provides an electronic device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it can implement any of the implementation methods in Embodiment 1.

[0052] Based on the same inventive concept, this application provides a storage medium corresponding to Embodiment 1, as detailed in Embodiment 4.

[0053] Example 4 This embodiment provides a computer-readable storage medium storing a computer program thereon. When the computer program is executed by a processor, it can implement any of the implementation methods in Embodiment 1.

[0054] Example 5 The system architecture of this embodiment includes a user interaction module, an intelligent agent scheduling module, an operation and maintenance tool execution module, a credential management module, and a security audit module.

[0055] (I) System Overall Architecture The user interaction module provides a unified human-computer interaction interface, receives maintenance requests input by the user in natural language, passes these requests to the agent scheduling module, and displays the final diagnostic results to the user in natural language. The user interaction module can be implemented as a web interface, command-line interface, or API interface.

[0056] The intelligent agent scheduling module, based on a pre-defined ReactAgent, is used to parse and orchestrate user-inputted natural language requests for operations and maintenance. The module comprises a large language model interface unit, a task decomposition unit, a tool invocation orchestration unit, and a state management unit. The large language model interface unit calls external large language model services for semantic understanding and reasoning; the task decomposition unit breaks down complex operations and maintenance tasks into multiple sub-tasks; the tool invocation orchestration unit generates tool invocation instructions based on the task decomposition results and schedules various operations and maintenance tools; and the state management unit maintains and updates current state information, including the user's original request, historical reasoning processes, historical tool invocation records, and the results of each operation.

[0057] The agent scheduling module employs the ReAct architecture to perform cyclical reasoning and decision-making. Each cycle includes a reasoning phase and an action phase: in the reasoning phase, the agent performs reasoning analysis based on the current state information and outputs the reasoning process; in the action phase, the agent generates tool invocation instructions based on the reasoning results and invokes the corresponding tools. After the tools complete execution, the execution results are fed back to the agent as new current state information, initiating the next round of reasoning, and this cycle continues until the maintenance task is completed.

[0058] The operations and maintenance (O&M) tool execution module includes multiple O&M tools, including SSH tools, MySQL query tools, Shell tools, and HTTP tools. Each tool is used to perform different types of O&M operations. All tools implement a unified tool interface, which includes methods for obtaining tool identifiers, parameter validation, execution, and logging. The credential management module is used to uniformly store and manage various O&M credential information, with each credential stored in RSA encrypted format. The security audit module records a complete audit log for each tool call.

[0059] (II) Voucher Management The credential management module stores and manages the following types of credential information: SSH credentials (host address, port, username, password), MySQL credentials (host address, port, database name, username, password), and HTTP credentials (username, password). The field structure of each credential is defined in JSON format and supports dynamic expansion. Each credential is assigned a unique credential identifier upon creation. Credential information is stored in non-plaintext form; the password field is stored in the database as ciphertext encrypted with an RSA public key. When a front-end user creates or updates a credential, they first encrypt the password using the RSA public key, then transmit the ciphertext to the back-end. The back-end decrypts the ciphertext using the RSA private key and stores it in ciphertext form in the database. This decryption is only performed temporarily when a tool is called, and the plaintext password is immediately cleared from memory after execution.

[0060] The credential management module also provides a unified permission verification interface. Each credential's authorization information includes the credential creator, a list of authorized users, and a list of authorized departments. When a user invokes a credential execution tool, the permission verification interface determines whether the current user is the creator of the credential, whether they are in the list of authorized users for that credential, or whether their department is in the list of authorized departments for that credential. If any of these conditions are met, the verification passes; otherwise, the verification fails and a permission error message is returned.

[0061] (III) Specific Implementation Methods of SSH Tools SSH tools are used to execute commands on remote servers. The execution process includes the following steps: Step A1: Receive the tool invocation instruction transmitted by the intelligent agent scheduling module. The tool invocation instruction includes the target tool identifier, execution parameters and credential identifier. The execution parameters include the command string to be executed, and the execution parameters do not contain plaintext passwords.

[0062] Step A2: Request the corresponding credential information from the credential management module based on the credential identifier. The credential management module first verifies whether the current user has permission to use the credential. If the verification fails, it returns a permission error message; if the verification succeeds, it returns credential information containing the host address, port, username, and password.

[0063] Step A3: Perform a security check on the command string in the execution parameters. The SSH tool has a pre-defined blacklist of dangerous commands, which includes at least the following keywords: rm -rf / , shutdown, reboot, poweroff, halt, init0, systemctl reboot, systemctl poweroff, mkfs, dd if=, :(){. After converting the command string to lowercase, a string inclusion match is performed. If a match is found, it is determined to be a dangerous operation, the command is rejected, a dangerous operation log is recorded, and a security interception message is returned; if no match is found, proceed to step A4.

[0064] Step A4: Establish an SSH connection using the credentials and execute the command. Specifically, use the JSch library to establish an SSH connection, set the connection timeout to 10 seconds, limit the maximum execution time of the command to 30 seconds using a timeout of 30 seconds, capture standard output and standard error output through the Channel's input and error streams respectively, and obtain the exit code to determine the success or failure of the execution.

[0065] Step A5: Generate structured feedback and record audit logs. Construct a structured JSON object using standard output as the `output` field, standard error as the `error` field, and the exit code as the `exitCode` field, and return it to the agent scheduling module. Simultaneously, record the audit log for this tool call to the security audit module.

[0066] (iv) Specific implementation methods of MySQL query tools The MySQL query tool is used to perform query operations on a MySQL database. The specific execution process includes the following steps: Step B1: Receive the tool invocation instruction transmitted by the intelligent agent scheduling module. The tool invocation instruction includes the target tool identifier, execution parameters and credential identifier. The execution parameters include the SQL statement to be executed.

[0067] Step B2: Request the corresponding credential information from the credential management module based on the credential identifier. After verifying the permissions, the credential management module returns credential information containing the host address, port, database name, username, and password.

[0068] Step B3: Perform a security check on the SQL statement in the execution parameters. First, check if it starts with "select". If not, refuse execution. If it does, check if it contains any of the keywords "drop", "delete", "update", "insert", "truncate", or "alter". If it does, it is considered a dangerous operation and refuses execution.

[0069] Step B4: Establish a database connection and execute a query using the credentials. The data source is built using Spring's SimpleDriverDataSource, and SQL queries are executed via JDBC. The maximum number of rows returned in the result set is limited to 200, and the query results are parsed into a JSON string.

[0070] Step B5: Generate structured feedback and record audit logs, return the query results in JSON format to the agent scheduling module, and record audit logs to the security audit module.

[0071] (v) Specific implementation methods of Shell local execution tools The Shell tool is used to execute local commands on the current operating system. The specific execution process includes: receiving a tool invocation instruction from the agent scheduling module, which contains a string of local commands to be executed; performing a security check on the command string and reusing the blacklist mechanism of the SSH tool to block dangerous commands; selecting a command interpreter according to the operating system type, using powershell.exe for Windows and bash for Linux / Mac; ​​creating a process using Java's ProcessBuilder class and executing the command, capturing standard output and exit codes; generating structured feedback and recording audit logs.

[0072] (vi) Specific implementation methods of HTTP service diagnostic tools The HTTP tool is used for health checks and API calls to HTTP / HTTPS services. The specific execution process includes: receiving a tool call instruction from the agent scheduling module, which includes execution parameters such as the request method, target URL, request headers, and request body, as well as a credential identifier; obtaining credential information based on the credential identifier to construct the HTTP Basic authentication header; constructing an HTTP request based on the execution parameters, and de-identifying sensitive headers such as Authorization, Cookie, and Token; executing the HTTP request using the OkHttp client, setting a timeout of 30 seconds, and obtaining the response status code, response headers, and response body; combining the response information into a structured JSON object and returning it to the agent scheduling module, while simultaneously recording audit logs.

[0073] (vii) Specific implementation methods of the security audit module The security audit module uses a MySQL database to store audit logs, including the following five types of log tables: (1) Tool execution log table: records complete information for each tool call, including log ID, user ID, credential username, tool type, credential ID, executed command or SQL statement, execution result, status, error message, execution time and creation time.

[0074] (2) Hazardous Operation Log Table: When a safety check determines that an operation is hazardous, additional hazardous operation information is recorded, including tool type, description of hazardous content, hazard level and creation time, and a notification is triggered to the security administrator via WeChat.

[0075] (3) User request log table: records the user question, Agent type, Token consumption and creation time for each AI dialogue.

[0076] (4) System operation log table: Records the IP address, access URL, request parameters, response results and execution time of all Controller operations through AOP aspect.

[0077] (5) Login Log Table: Records user ID, login IP, login type and login source.

[0078] (viii) Specific implementation of the intelligent agent diagnostic process Step E1: Obtain the user's input of operation and maintenance natural language requests through the user interaction module, such as "The CPU utilization of server 192.168.1.100 is very high, please help me find out the reason".

[0079] Step E2: Construct system prompts and inject them into the dialogue context of the large language model. The system prompts contain the following constraints: agents are strictly prohibited from guessing the server status; agents are strictly prohibited from simulating Linux command execution output; agents must respond based solely on the actual operation execution results returned by the tool.

[0080] Step E3: Input the user request and current state information into the large language model. The agent performs inference analysis, outputs the inference process, and generates tool invocation commands. For example, the agent's first inference output is: "The user reported that the server's CPU usage is high. I need to check the overall CPU usage of the server first," and at the same time generates the SSH tool invocation command to execute top -bn1 |head -20.

[0081] Step E4: The intelligent agent scheduling module sends the tool invocation command to the corresponding operation and maintenance tool for execution and obtains the operation execution result. The SSH tool returns the execution result, showing a CPU utilization of 95.3% and a Java process (PID 12345) utilization of 89.2%.

[0082] Step E5: The agent receives the execution result, uses it as the new current state information for the next round of inference, and generates the next tool invocation command. For example, the agent infers: "The main CPU hog is the Java process (PID 12345), we need to check the thread stack," and generates the SSH tool invocation command to execute jstack 12345 | grep -A 10 'RUNNABLE'.

[0083] Step E6: Repeat steps E4 to E5 until the agent determines that the maintenance task has been completed. For example, based on the thread stack information, the agent locates that the WorkerThread thread may be stuck in an infinite loop on line 156 of the process method in the business class, and determines that the task is complete.

[0084] Step E7: The agent generates an operational diagnosis conclusion based on all obtained operation execution results and outputs it to the user through the user interaction module. For example: "Diagnosis complete. CPU utilization is 95.3%, mainly because the WorkerThread in the Java process (PID 12345) may be stuck in an infinite loop on line 156 of the process method. Recommendations: 1) Check the loop exit condition; 2) Add timeout control; 3) Use a thread pool monitoring tool." Step E8: The security audit module records the audit log of the entire diagnostic process.

[0085] (ix) Specific implementation method of the permission verification process Taking user A executing commands via SSH as an example, the permission verification process is as follows: User A submits a request to execute a command, containing credential identifier 1001. The SSH tool calls the permission verification interface of the credential management module, passing in the current user ID (userA) and credential identifier (1001). The credential management module queries authorization information based on credential identifier 1001: the creator is userB, the list of authorized users is [userC, userD], and the list of authorized departments is [dept1, dept2]. The credential management module determines whether userA is the creator, whether userA is in the list of authorized users, or whether userA's department is in the list of authorized departments. If none of these conditions are met, the verification fails, and a permission error message is returned; if any one of these conditions is met, the verification passes, and credential information is returned.

[0086] (x) Specific implementation method of dangerous command interception process The user inputs "Help me clean up the old logs on the server, execute rm -rf / var / log / .log". The agent generates an SSH tool invocation command with the command string "rm -rf / var / log / .log". During a security check, the SSH tool converts the command string to lowercase and performs a string inclusion match against "rm -rf / " in the blacklist. If a match is found, it's considered a dangerous operation. The SSH tool refuses execution, records the dangerous operation information in the dangerous operation log table, triggers an alert in WeChat Work, and returns a structured error message: "A dangerous command was detected and execution has been refused. This command contains the rm -rf operation, which may cause data loss." (xi) Specific implementation method of JSON parsing error self-repair When the JSON format generated by the agent contains syntax errors, the operations and maintenance tool captures the JSON parsing exception and constructs a structured error feedback to return to the agent scheduling module. The feedback includes the error location and an example of the expected correct format. The agent scheduling module inputs the error information as new current state information into the large language model. The agent corrects the JSON structure based on the error feedback and then re-initiates the tool call.

[0087] (xii) Specific implementation methods for audit log query Security administrators can retrieve audit logs using the query interface of the security audit module, based on criteria such as user ID, time range, tool type, credential ID, and status. For example, querying user A's SSH operations within a certain time period will return all SSH command records within that time period within one second, including the execution time, command content, execution result, and exit status of each command, enabling rapid location and tracing.

[0088] While specific embodiments of the present invention have been described above, those skilled in the art should understand that the specific embodiments described are merely illustrative and not intended to limit the scope of the invention. Equivalent modifications and variations made by those skilled in the art in accordance with the spirit of the invention should be covered within the scope of protection of the claims of the present invention.< / pid> < / nodeoutput> < / streamchatvo> < / string>

Claims

1. A server operation and maintenance and fault intelligent diagnosis method based on a large model, characterized in that: Includes the following steps: Step S1: Obtain the user's input in natural language for operation and maintenance; Step S2: Input the operation and maintenance natural language request into a preset intelligent agent. The intelligent agent parses the current state information based on a large language model and generates a tool call instruction. The tool call instruction includes the target tool identifier, execution parameters, and credential identifier. The execution parameters do not contain plaintext passwords. Step S3: According to the target tool identifier in the tool call instruction, the corresponding operation and maintenance tool is called. The operation and maintenance tool obtains the required credential information for execution based on the credential identifier, and uses the credential information to perform the corresponding operation and maintenance operation to obtain the operation execution result. Step S4: The intelligent agent receives the operation execution result and determines whether the operation and maintenance task has been completed based on the operation execution result; If not completed, the operation execution result is used as the new current state information. This current state information is used as the input of the agent when returning to step S2, so that the agent can perform comprehensive reasoning based on the operation and maintenance natural language request, historical reasoning process and the current operation execution result to generate the next tool call instruction; if completed, proceed to step S5. Step S5: Generate and output the operation and maintenance diagnosis conclusion based on all the obtained operation execution results.

2. The method according to claim 1, characterized in that, In step S3, before the operation and maintenance tool obtains the credential information required for execution based on the credential identifier, it further includes: querying the authorization information of the credential information based on the credential identifier, wherein the authorization information includes the credential creator, the list of authorized users, and the list of authorized departments; Determine if the current user meets any of the following conditions: (i) The current user is the creator of the credential; (ii) The current user is in the list of authorized users; (iii) The department to which the current user belongs is listed in the authorized departments list; If any condition is met, the verification passes; otherwise, the verification fails, and the process ends.

3. The method according to claim 1, characterized in that, In step S3, before the maintenance tool performs the corresponding maintenance operation, the following is also included: When the target tool is a remote command execution tool, the command string in the execution parameters is matched with a preset dangerous command blacklist. If the match is successful, it is determined to be a dangerous operation and is blocked. When it is determined to be a dangerous operation, a dangerous operation log is recorded and an alarm notification is triggered. The dangerous command blacklist includes at least the following keywords: rm -rf / , shutdown, reboot, mkfs, dd if=. When the target tool is a database query tool, check whether the SQL statement in the execution parameters starts with SELECT. If not, block it. If it does, further check whether the SQL statement contains any of the keywords DROP, DELETE, UPDATE, INSERT, TRUNCATE, or ALTER. If it does, block it.

4. The method according to claim 1, characterized in that, In step S3, the corresponding operation and maintenance tool is at least one of the following: remote command execution tool, database query tool, local command execution tool, and HTTP service health check tool; The remote command execution tool is used for executing commands on a remote server, the database query tool is used for database queries, the local command execution tool is used for executing commands locally, and the HTTP service health check tool is used for HTTP service health checks.

5. The method according to claim 1, characterized in that, Step S3 further includes: recording an audit log for each tool call, wherein the audit log includes at least the user identifier, tool type, credential identifier, execution content, execution result, status, and execution time.

6. The method according to claim 1, characterized in that, In step S2, the agent adopts the ReAct architecture pattern, and before generating the tool invocation instruction, it first generates intermediate output containing the reasoning process. In step S3, when the execution parameters in the tool call instruction are in JSON format and the operation and maintenance tool fails to parse the execution parameters, the operation and maintenance tool returns a structured error feedback containing an error format description to the intelligent agent; after the intelligent agent corrects the execution parameters according to the structured error feedback, it returns to step S2 to re-initiate the tool call; In step S4, after receiving the operation execution result, the intelligent agent generates an intermediate output containing a reflection process, and then determines whether the operation and maintenance task has been completed based on the operation execution result.

7. The method according to claim 1, characterized in that, Before step S2, the method further includes: constructing system prompts and injecting the system prompts into the dialogue context of the large language model, wherein the system prompts contain the following constraint rules: (i) The agent is strictly prohibited from guessing the server status; (ii) The aforementioned intelligent agent is strictly prohibited from simulating Linux command execution output; (iii) The agent must respond based solely on the actual results of the operation returned by the tool.

8. A server operation and maintenance and fault diagnosis intelligent diagnostic device based on a large model, characterized in that: include: The input module retrieves user-inputted natural language requests for operations and maintenance. The instruction generation module inputs the operation and maintenance natural language request into a preset intelligent agent. The intelligent agent parses the current state information based on a large language model and generates a tool invocation instruction. The tool invocation instruction includes a target tool identifier, execution parameters, and a credential identifier. The execution parameters do not contain a plaintext password. The tool invocation module invokes the corresponding operation and maintenance tool according to the target tool identifier in the tool invocation instruction. The operation and maintenance tool obtains the required credential information for execution according to the credential identifier, and uses the credential information to perform the corresponding operation and maintenance operation to obtain the operation execution result. The cyclic decision-making module is used to receive the operation execution result and determine whether the operation and maintenance task has been completed based on the operation execution result. If not completed, the operation execution result is used as the new current status information. The current status information is used as the input of the agent when returning to the instruction generation module, so that the agent can perform comprehensive reasoning based on the operation and maintenance natural language request, historical reasoning process and the current operation execution result to generate the next tool call instruction. If completed, proceed to the conclusion generation module; The conclusion generation module generates and outputs operation and maintenance diagnosis conclusions based on all the obtained operation execution results.

9. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the method as described in any one of claims 1 to 7.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that, When the program is executed by the processor, it implements the method as described in any one of claims 1 to 7.

Images