A database fault diagnosis method and system based on operation and maintenance knowledge graph

Abstract

The application discloses a database fault diagnosis method and system based on operation and maintenance knowledge graph, and relates to the technical field of knowledge graphs; the technical key points are as follows: real-time alarm log data and entity server resource indexes of a database cluster are acquired; a double-layer initial operation and maintenance graph containing a double-layer topological structure is constructed; a target fault diagnosis subgraph is generated; initial state vectors of each node in the target fault diagnosis subgraph are acquired; the initial state vectors and a pre-constructed cross-layer fault propagation attention mask are input into a graph attention network model that has been pre-trained; initial attention coefficients are obtained; a mask penalty scalar corresponding to a connection path of a source node and a target node in the cross-layer fault propagation attention mask is acquired, and feature transmission weights are obtained; hidden layer features of neighbor nodes are weighted and aggregated according to the feature transmission weights; and a fault root cause positioning result for the database cluster is output; the application improves the accuracy of distributed database fault diagnosis.

Description

Technical Field

[0001] This invention relates to the field of knowledge graph technology, specifically to a database fault diagnosis method and system based on an operation and maintenance knowledge graph. Background Technology

[0002] With the rapid development of the digital economy, cloud-native distributed databases, with their advantages of high concurrency, high availability, and elastic scalability, are widely deployed on a large scale in distributed computing platforms containing massive server nodes. They are widely used in core business scenarios such as financial transactions, internet services, government big data, and IoT data storage. To ensure the stable operation of database clusters, mainstream industry solutions generally adopt intelligent fault diagnosis technology based on operation and maintenance knowledge graphs. The core execution logic is as follows: through agent collection programs deployed on each server node, the full alarm logs and running events of the database cluster are continuously collected. Information such as alarm subjects, associated instances, and call chains are extracted through text rule matching and entity relationship extraction to construct a static operation and maintenance knowledge graph. Then, relying on traditional graph traversal algorithms or conventional graph neural networks, the entire knowledge graph is subjected to global reasoning analysis, traversing all topological connections to locate the root cause node of the fault that triggered the batch alarms.

[0003] The inventors discovered through long-term engineering practice that the aforementioned existing technical solutions have significant inherent technical defects and cannot adapt to the fault propagation characteristics of cross-layer coupled operation of distributed databases. Specifically, cloud-native databases generally adopt a two-layer deployment architecture of upper-layer logical database instances plus lower-layer physical computing nodes. Multiple database instances often share the CPU, memory, disk I / O, and storage resources of the same physical server. When hardware resource contention occurs on the lower-layer physical computing nodes, it is very easy to trigger a chain reaction of cross-layer batch alarms. For example, if a business database instance suddenly experiences high-concurrency read and write operations that preempt a large amount of CPU and memory resources of the host machine, it will cause other subordinate database instances on the same server to experience a series of derivative alarms such as query timeouts, transaction execution failures, connection exhaustion, cache invalidation, and excessively high disk read and write latency. In a short period of time, the cluster can generate hundreds of relationships. Alarm information causes the constructed knowledge graph to instantly generate a massive number of concurrent nodes and dense edge relationships, resulting in a rapid expansion of the graph topology. Conventional graph reasoning algorithms, when performing fault diagnosis reasoning, fail to distinguish the essential difference between upper-layer business logic call relationships and the actual load state of the underlying physical hardware. They cannot identify invalid weak associations, noisy associations, and real fault propagation paths in the topology, and can only perform indiscriminate global traversal and feature learning on all connected edges in the graph. This approach consumes a lot of memory and computing resources, increasing fault reasoning latency and failing to meet the operational requirements of second-level troubleshooting for online businesses. Furthermore, the massive number of invalid topological edges and metric noise continuously interfere with the feature learning process of the neural network, obscuring the core features of real fault nodes. This can easily lead the model to misjudge surface-derived alarm nodes as the root cause of the fault, reducing the accuracy of database fault root cause localization. Summary of the Invention

[0004] To achieve the above objectives, the present invention provides the following technical solution: A database fault diagnosis method based on operation and maintenance knowledge graph, comprising: Obtain real-time alarm log data and entity server resource metrics from the database cluster; Identify logical database entity nodes in real-time alarm log data and map the logical database entity nodes to the corresponding entity computing power support nodes to construct a two-layer initial operation and maintenance map containing a two-layer topology structure; Based on the physical server resource indicators, the hardware contention tension value between physical computing power support nodes is determined, and the initial two-layer operation and maintenance map is pruned based on the hardware contention tension value to generate the target fault diagnosis sub-map. Obtain the initial state vector of each node in the target fault diagnosis subgraph; input the initial state vector and the pre-constructed cross-layer fault propagation attention mask into the pre-trained graph attention network model; In the hidden layer of the graph attention network model, the hidden layer features of the source node and the hidden layer features of the target node are concatenated to obtain the initial attention coefficients; the mask penalty scalar corresponding to the connection path between the source node and the target node is obtained in the cross-layer fault propagation attention mask; and the combination value of the initial attention coefficients and the mask penalty scalar is nonlinearly mapped using a preset activation function to obtain the feature propagation weights. The hidden layer features of neighboring nodes are weighted and aggregated according to the feature propagation weights to output the root cause diagnosis feature vector. Analyze the root cause diagnosis feature vector and output the root cause location results for the database cluster.

[0005] Furthermore, a two-layer initial operation and maintenance graph containing a two-layer topology is constructed, including: Based on preset named entity recognition rules, database instance identifiers are identified from real-time alarm log data as logical database entity nodes; Query the pre-set resource scheduling configuration table to obtain the entity server identifiers that have a host deployment relationship with the database instance identifier, and use them as entity computing power support nodes; Directed edges are used to connect logical database entity nodes and entity computing power support nodes to generate a two-layer initial operation and maintenance graph.

[0006] Furthermore, based on physical server resource metrics, the hardware contention tension values ​​between physical computing power support nodes are determined, including: Obtain computing power queuing latency data and storage page swapping rate from the physical server resource metrics; The computing power queuing latency data and storage page swapping rate are normalized according to the preset unit unification rules to generate a basic performance consumption matrix. Determine the covariance between each element in the basic performance consumption matrix, and use the obtained covariance result as the hardware contention tension value between the entity computing power support nodes.

[0007] Furthermore, a target fault diagnosis subgraph is generated, including: Acquire historical data of hardware contention tension values ​​within a preset time period to determine the image edge trimming threshold; Compare the relationship between the hardware contention tension value corresponding to each directed edge in the two-layer initial operation and maintenance graph and the graph edge pruning threshold. Cut off directed edges whose hardware contention tension values ​​are below the graph edge pruning threshold, retain the remaining logical database entity nodes, entity computing power support nodes, and directed edges, and generate the target fault diagnosis subgraph.

[0008] Furthermore, the root cause diagnostic feature vector is analyzed, including: The root cause diagnosis feature vector is input into a preset fully connected classification layer for linear transformation to generate a probability distribution matrix of multiple candidate fault categories. The label category corresponding to the highest probability element in the probability distribution matrix is ​​selected as the root cause localization result.

[0009] Furthermore, the computing power queuing latency data and storage page swapping rate are normalized according to a preset unit unification rule, including: The deviation between the generated computing power queuing delay data and the first reference delay constant is normalized based on the first reference delay constant to generate the delay deviation rate. Determine the deviation between the storage page swap rate and the second baseline swap constant, and perform normalization based on the second baseline swap constant to generate the storage deviation rate; By combining the latency skew rate as the real part and the storage skew rate as the imaginary part, a complex-form basic performance consumption matrix is ​​generated.

[0010] Furthermore, historical data on hardware contention tension values ​​within a preset time period are obtained to determine the graph edge trimming threshold, including: Establish a fixed-length sliding data collection window on the timeline; Calculate the arithmetic mean and standard deviation of all hardware contention tension values ​​within the current sliding data collection window; The composite value is determined based on the arithmetic mean, preset weighting coefficients, and standard deviation, and the resulting composite value is used as the edge trimming threshold of the graph.

[0011] Furthermore, before using the graph attention network model, parameter training of the graph attention network model is also included, including: Obtain sample graph data and corresponding true root cause labels, input them into the initial graph network architecture for forward propagation, and output the predicted distribution features. Determine the cross-entropy between the predicted distribution features and the true root cause labels as the basic classification error; Determine the proportion of entity computing power support nodes with topological disconnection in the sample graph data, and use it as a topological distortion penalty term; The basic classification error and the topology distortion penalty term are combined to form the final error function. The backpropagation algorithm is used to update the network layer node parameters of the initial graph network architecture to complete the training and obtain the graph attention network model.

[0012] Furthermore, the hidden layer features of neighboring nodes are weighted and aggregated based on the feature propagation weights, including: Obtain the timestamps of alarms generated by each node in the target fault diagnosis subgraph, and determine the time lag interval between the source node and the target node; The time lag interval is mapped based on a preset time sensitivity function to generate a time-series state decay factor; The mapping rule of the time sensitivity function is as follows: when the time lag interval is within the preset fault propagation time window, the output is an enhancement coefficient greater than 1; otherwise, the output is an attenuation coefficient less than 1. The feature transfer weights and the temporal state decay factor are fused element by element to obtain the spatiotemporal fusion transfer weights. The hidden layer features of neighboring nodes are weighted and aggregated based on the spatiotemporal fusion transfer weights, and the root cause diagnosis feature vector containing temporal evolution information is output.

[0013] A database fault diagnosis system based on operation and maintenance knowledge graph, comprising: The metrics acquisition module acquires real-time alarm log data and entity server resource metrics from the database cluster. The graph construction module identifies logical database entity nodes in real-time alarm log data and maps logical database entity nodes to corresponding entity computing power support nodes to construct a two-layer initial operation and maintenance graph containing a two-layer topology structure. The fault diagnosis subgraph generation module determines the hardware contention tension value between the entity computing power support nodes based on the entity server resource indicators, and prunes the two-layer initial operation and maintenance map based on the hardware contention tension value to generate the target fault diagnosis subgraph. The model building module obtains the initial state vectors of each node in the target fault diagnosis subgraph; and inputs the initial state vectors and the pre-built cross-layer fault propagation attention mask into the pre-trained graph attention network model. The weight generation module concatenates the hidden features of the source node and the hidden features of the target node in the hidden layer of the graph attention network model to obtain the initial attention coefficients; it obtains the mask penalty scalar corresponding to the connection path between the source node and the target node in the cross-layer fault propagation attention mask, and uses a preset activation function to perform nonlinear mapping on the combination value of the initial attention coefficients and the mask penalty scalar to obtain the feature propagation weights. The feature output module performs weighted aggregation of the hidden layer features of neighboring nodes based on the feature propagation weights, and outputs the root cause diagnosis feature vector. The results output module parses the root cause diagnostic feature vector and outputs the root cause localization results for the database cluster.

[0014] This invention provides a database fault diagnosis method and system based on operation and maintenance knowledge graph, which has the following beneficial effects: 1. This invention addresses the shortcomings of traditional static graphs, such as high redundancy and inability to adapt to hardware resource contention faults. It constructs a two-layer operation and maintenance knowledge graph with separate logical and physical layers, and dynamically prunes the graph based on hardware contention tension values. Compared to the traditional method of constructing a full static graph based solely on alarm associations and performing indiscriminate traversal and reasoning, this invention combines real server hardware load conditions to filter effective topology relationships. This effectively filters out batch-derived alarms and invalid topology noise caused by hardware contention, simplifies the graph to obtain highly correlated fault subgraphs, reduces the computational overhead and latency of graph model reasoning, and solves the practical problems of high computing power consumption and low reasoning efficiency in cluster batch fault scenarios.

[0015] 2. To address the shortcomings of traditional graph inference algorithms, such as their inability to distinguish between logical alarms and physical faults and their susceptibility to noise interference leading to root cause misjudgments, this invention introduces a cross-layer fault propagation attention mask combined with a spatiotemporal fusion weighted aggregation mechanism. By imposing differentiated weight constraints on the cross-layer fault propagation path and optimizing feature weight allocation based on the fault temporal propagation law, this invention suppresses feature interference from derived alarm nodes, strengthens the feature representation of the root cause of underlying physical hardware faults, compensates for the shortcomings of undifferentiated feature learning in conventional graph neural networks, and improves the accuracy and reliability of root cause localization in cross-layer coupled fault scenarios in distributed databases.

[0016] 3. This invention optimizes the training loss function of graph attention networks by introducing a topological distortion penalty term on top of the basic classification error, which is more in line with the real operation and maintenance conditions of node disconnection and topological anomalies in distributed database clusters. Compared with traditional models that rely solely on classification error for training, this invention improves the model's generalization and adaptation capabilities to complex distorted topologies and batch cascading failure scenarios, improves the poor adaptability of traditional intelligent diagnostic models under complex field conditions, and enhances the overall engineering practicality of the fault diagnosis solution. Attached Figure Description

[0017] Figure 1 This is a flowchart illustrating the steps of the present invention. Figure 2 This is a system architecture diagram of the present invention. Detailed Implementation

[0018] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of the present invention.

[0019] Example 1: Please refer to Figure 1 This embodiment provides a database fault diagnosis method based on an operation and maintenance knowledge graph, including: Step 101: Obtain real-time alarm log data and entity server resource metrics from the database cluster. Specifically, through the operation and maintenance collection agent deployed on each node of the distributed database cluster, real-time alarm log data generated during cluster operation is continuously collected. The alarm log data includes various business alarm information such as database connection anomalies, transaction timeouts, query failures, cache invalidations, and high read / write latency, fully recording the alarm generation time, alarm node, alarm type, and alarm description. Simultaneously, hardware resource operation metrics of each entity server are collected, mainly including core resource operating data such as CPU computing power queuing latency, memory utilization, storage page swapping rate, disk I / O load, and network throughput. All collected data is synchronously stored in the operation and maintenance time-series database at a second-level sampling frequency, providing data for subsequent graph construction and fault diagnosis. Fault analysis provides raw data support; the real-time alarm log data mentioned here refers to the structured and semi-structured fault alarm records generated in real time during the online operation of the database cluster; the physical server resource indicators are quantitative time-series data reflecting the load status of the underlying physical computing power nodes; for example, the distributed database cluster includes 3 business database nodes and 2 physical computing power server nodes. The operation and maintenance data collection agent program captures the database connection timeout and read / write latency alarm logs of node 1 in real time with a sampling period of 1 second. At the same time, it collects the corresponding physical server's CPU computing power queuing latency of 8ms, memory utilization rate of 85%, and storage page exchange rate of 12%. All data is stored in the InfluxDB operation and maintenance time-series database in real time to provide raw data support for the subsequent construction of fault maps; Step 102: Identify the logical database entity nodes in the real-time alarm log data and map them to the corresponding entity computing power support nodes to construct a two-layer initial operation and maintenance graph with a two-layer topology. Specifically, perform text parsing and entity recognition on the collected real-time alarm log data, extract the unique database instance identifier contained in the log, and define each independently running database instance as a logical database entity node. This level of node corresponds to the upper-layer business logic running unit. Based on the cluster's pre-configured resource scheduling relationship, match the physical server actually mounted and deployed for each logical database instance, and define the corresponding physical server as an entity computing power support node. This level of node corresponds to the lower-layer physical computing power bearing unit. Establish a hierarchical mapping relationship between logical database entity nodes and entity computing power support nodes through directed association edges, while retaining the business call relationship between nodes. By linking and sharing resources, a two-layer initial operation and maintenance graph is ultimately constructed, comprising upper-layer logical business and lower-layer physical computing power, fully restoring the hierarchical deployment and resource association topology of the database cluster. For example, the database instance identifiers DB_001 and DB_002 are extracted from the alarm logs, and the two database instances are defined as two independent logical database entity nodes. Based on the cluster Kubernetes resource scheduling configuration table, it is found that DB_001 is mounted on physical server SVR_01 and DB_002 is mounted on physical server SVR_02, and SVR_01 and SVR_02 are defined as entity computing power support nodes. DB_001 and SVR_01, and DB_002 and SVR_02 are respectively connected by directed edges from top to bottom, and the business call association edges of the two database instances are added, thus completing the two-layer initial operation and maintenance graph. Step 103: Determine the hardware contention tension value between physical computing power support nodes based on physical server resource indicators, and prune the initial two-layer operation and maintenance map based on the hardware contention tension value to generate a target fault diagnosis sub-map. Specifically, select computing power queuing latency data and storage page swapping rate data from physical server resource indicators that can directly reflect the hardware resource contention status. Eliminate the numerical dimension differences of different indicators through normalized dimension unification processing to construct a basic performance consumption matrix that can quantify the differences in node load. Quantify the degree of resource contention conflict between different physical computing power support nodes through a complete covariance calculation process to obtain the hardware contention tension value. The higher the tension value, the more intense the resource contention conflict between the corresponding physical nodes and the higher the fault correlation. Based on historical operating data, complete the linkage calculation of threshold adaptive adjustment and compensation amount to dynamically determine the map edge pruning threshold and accurately distinguish... To address both normal resource fluctuations and fault-level resource contention in the cluster, weakly correlated topological edges with hardware contention tension values ​​below a threshold and no substantial fault correlations in the initial two-layer operation and maintenance graph are truncated and removed, retaining only highly correlated nodes and topological edges. This process denoises and simplifies the graph, generating a target fault diagnosis subgraph for accurate fault reasoning. For example, 5-minute time-series computing power queuing latency and storage page exchange rate data for physical servers SVR_01 and SVR_02 are selected and normalized to construct a 2x2 basic performance consumption matrix. Covariance calculations show a hardware contention tension value of 0.78 for the two nodes, indicating high-intensity resource contention. Combining this with the cluster's historical operating data from the past hour, an adaptive pruning threshold of 0.48 is calculated. Weakly correlated topological edges with tension values ​​of 0.2 and 0.3 are removed, retaining only highly correlated topological relationships to generate a simplified target fault diagnosis subgraph. Step 104: Obtain the initial state vector of each node in the target fault diagnosis subgraph; input the initial state vector and the pre-constructed cross-layer fault propagation attention mask into the pre-trained graph attention network model; specifically, perform feature encoding on all logical database entity nodes and entity computing power support nodes in the target fault diagnosis subgraph, extract multi-dimensional features such as alarm type, load status, runtime latency, and fault history of each node, and convert them into fixed-dimensional initial state vectors to achieve quantitative representation of node features; pre-construct a cross-layer fault propagation attention mask based on the cross-layer fault propagation law of the database. The mask can distinguish between logical layer alarm propagation paths and physical layer fault propagation paths, and impose weight constraints on invalid cross-layer propagation paths. The initial state vectors of all nodes and the cross-layer fault propagation attention mask are synchronously input into the trained graph attention network model to provide input for the model's hierarchical feature learning and weight calculation. For example, features are extracted from two nodes, DB_001 and SVR_01, in the target subgraph. The features of node DB_001 include "read / write latency alarm, 75% load, and 1 historical cache failure", while the features of node SVR_01 include "high CPU queuing latency and memory overload". The multi-dimensional features are encoded into a 64-dimensional fixed initial state vector. A mask is pre-constructed to block invalid paths from logical node faults to physical nodes. All node vectors and the mask are synchronously input into the trained two-layer graph attention network model. Step 105: In the hidden layer of the graph attention network model, the hidden layer features of the source node and the target node are concatenated to obtain the initial attention coefficients; the mask penalty scalar corresponding to the connection path between the source node and the target node is obtained in the cross-layer fault propagation attention mask, and the combination value of the initial attention coefficients and the mask penalty scalar is nonlinearly mapped using a preset activation function to obtain the feature propagation weights; specifically, after the shallow feature extraction of the initial state vectors of each node is completed in the model's hidden layer, all source nodes and target nodes with topological relationships in the subgraph are traversed, and the hidden layer features of the source node and the target node are dimensionally concatenated. The initial attention coefficients of the inter-node association are calculated through linear transformation. The initial attention coefficients are used to initially characterize the fault propagation association strength between nodes; the pre-built... The mask penalty scalar for the propagation path of the corresponding node in the mask is constructed to penalize and correct the initial attention coefficients of invalid and interfering propagation paths. The corrected combined values ​​are nonlinearly mapped using the ReLU activation function to eliminate invalid feature associations, and finally obtain the feature transfer weights that accurately represent the node's fault propagation capability. For example, with physical node SVR_01 as the source node and logical node DB_001 as the target node, the 32-dimensional feature vectors of their hidden layers are concatenated and linearly transformed to obtain an initial attention coefficient of 0.85. The forward propagation path in the mask has no penalty, and the penalty scalar is 1.0. If it is a reverse invalid path, the penalty scalar is 0.3. After correction by the ReLU activation function, the feature transfer weight of the path is finally obtained as 0.83, which accurately represents the correlation strength of the upward propagation of physical faults. Step 106: Weighted aggregation of the hidden layer features of neighboring nodes based on feature transfer weights, outputting a root cause diagnosis feature vector. Specifically, based on the topological relationships of the target fault diagnosis subgraph, and taking the current node to be diagnosed as the center, traverse all its first-order and second-order neighboring nodes, retrieving the feature transfer weights between each neighboring node and the center node; weighted summation and fusion aggregation of the hidden layer features of each neighboring node based on the weight magnitude, while retaining the core feature information of the node itself and filtering out the interference features of weakly associated neighboring nodes, finally aggregating to obtain a fused global topological relationship. The root cause diagnosis feature vector is derived from the node features. This feature vector carries the core feature information of the cluster failure. For example, taking the node to be diagnosed, DB_001, as the center, its first-order neighbor node is the physical node SVR_01, and its second-order neighbor node is another shared storage node SVR_03 in the cluster. The corresponding feature transfer weights of 0.83 and 0.21 are retrieved respectively, and the features of the two neighbor nodes are weighted and aggregated. The interference of the weakly correlated node features with weight 0.21 is weakened, and the features of DB_001 itself are superimposed. Finally, a 128-dimensional root cause diagnosis feature vector is obtained. Step 107: Analyze the root cause diagnostic feature vector and output the root cause localization result for the database cluster. Specifically, input the high-dimensional root cause diagnostic feature vector into the preset fully connected classification layer, and generate probability distribution matrices for various preset fault types through linear dimensionality reduction and feature mapping. Compare the probability values ​​of each fault type in the matrix, select the fault label and node position corresponding to the maximum probability value, and finally output the accurate root cause localization result, including fault type, fault level, fault node number, and fault location. For example, input the aggregated 128-dimensional feature vector into the fully connected classification layer to generate a probability distribution matrix, in which the probability of physical hardware resource contention fault is 92.3%, the probability of database instance abnormal fault is 5.2%, and the probability of network fault is 2.5%. Select the fault label corresponding to the maximum probability, and the final output result is: CPU and storage resource contention fault of the SVR_01 node in the physical computing power layer is the root cause of this cluster read / write delay alarm.

[0020] In one implementation, the graph attention network model can adopt a two-layer stacked structure. The first layer completes the extraction of local node features and topological features, and the second layer completes cross-node feature interaction and adaptive weight adjustment to adapt to complex cluster topology fault scenarios. For example, the first layer network extracts the local features of load, alarm, and latency of each node, as well as the topological association features between nodes, and the second layer network completes the cross-node feature interaction between SVR_01 and DB_001, and between SVR_01 and SVR_03, and adaptively fine-tunes the fault propagation weights to adapt to multi-node coupled fault scenarios.

[0021] In another implementation, the hardware contention tension value can be dynamically adjusted in terms of calculation dimensions based on the cluster deployment scale. Small-scale clusters use single-node covariance calculation, while large-scale clusters use regional covariance aggregation calculation to ensure the quantification accuracy of the tension value. For example, for small-scale test clusters with fewer than 10 nodes, the tension value is obtained by directly calculating the covariance of each node pairwise. For large-scale production clusters with more than 50 nodes, the cluster is divided into multiple sub-regions according to business partitions. The covariance of each sub-region is calculated independently and then aggregated to obtain the global tension value, thus avoiding large-scale node calculation errors.

[0022] The above technical solutions address the issues of high redundancy and low fault association identification in traditional static graphs by constructing a two-layer operation and maintenance knowledge graph to accurately match the cross-layer deployment architecture of the database cluster. Dynamic noise reduction and pruning of the graph are achieved based on hardware contention tension values. Attention masks are used to correct the weights of node feature transmission, suppressing feature interference from derived alarms and invalid topologies, thus overcoming the shortcomings of indiscriminate feature learning in traditional graph models. Through multi-level feature aggregation and classification parsing, accurate root cause localization of cross-layer coupled faults in distributed databases is achieved, effectively reducing the computational overhead of fault inference and the probability of misdiagnosis, and improving the efficiency and stability of cluster fault operation and maintenance.

[0023] In some embodiments, constructing a two-layer initial operation and maintenance graph containing a two-layer topology includes: Step 201: Based on preset named entity recognition rules, identify database instance identifiers as logical database entity nodes from real-time alarm log data. Specifically, pre-configure named entity recognition rules adapted to the database alarm log format. The rules include keyword matching templates and regular expression matching expressions for database instance ID, instance name, service port, business identifier, etc. Perform line-by-line text matching and entity extraction on the real-time collected alarm logs to accurately extract the unique corresponding database instance identifier in the logs. Map each independent database instance identifier to a logical database entity node to complete the construction of the upper-layer business logic layer nodes. All logical database entity nodes fully cover all business running instances in the cluster. For example, preset regular expression matching is used to match instance IDs in the format "DB_XXX" and port identifiers in "port:3306" in the logs. For the log content "2026-06-01 10:20:00DB_0033306 port query timeout", the database instance identifier DB_003 is accurately extracted through rule matching and mapped to a brand-new logical database entity node to supplement the business logic layer. Step 202: Query the pre-set resource scheduling configuration table to obtain the entity server identifier that has a host deployment relationship with the database instance identifier, and use it as the entity computing power support node. Specifically, the cluster operation and maintenance system pre-stores the resource scheduling configuration table, which fully records the mounting and deployment relationships, resource allocation relationships, and shared resource mapping relationships of all database instances and physical servers. Using the extracted database instance identifier as the search index, traverse and query the resource scheduling configuration table to match the unique identifier of the physical server that hosts the database instance. Map the physical server identifier to the entity computing power support node to complete the construction of the lower-level physical computing power layer node and realize the one-to-one correspondence or many-to-many shared mapping between business nodes and physical nodes. For example, using the extracted DB_003 as the search index, query the pre-stored resource scheduling configuration table to match the instance deployed on the physical server SVR_02. At the same time, the server also mounts the DB_004 instance. Use SVR_02 as the entity computing power support node to realize the shared mapping relationship of a single physical node corresponding to multiple logical business nodes. Step 203: Connect logical database entity nodes and entity computing power support nodes using directed edges to generate a two-layer initial operation and maintenance graph. Specifically, with entity computing power support nodes as the bottom-layer basic nodes and logical database entity nodes as the upper-layer business nodes, construct a top-down directed association edge based on the actual deployed resource carrying relationship to represent the fault propagation logic of "physical nodes carrying business nodes, and physical faults propagating upwards to trigger business alarms." Simultaneously, for multiple logical database entity nodes under the same physical server, supplement horizontal resource sharing association edges to fully restore cluster resource sharing... The topological characteristics of fault cascading propagation ultimately generate a complete and accurately correlated two-layer initial operation and maintenance graph. For example, with SVR_02 as the bottom node and DB_003 and DB_004 as the top nodes, vertical directed edges SVR_02→DB_003 and SVR_02→DB_004 are constructed respectively to represent the upward propagation logic of physical faults. At the same time, horizontal shared resource association edges between DB_003 and DB_004 are added to restore the topological relationship of the two instances sharing the computing power and storage resources of SVR_02, thus completing the construction of the two-layer initial operation and maintenance graph.

[0024] Through the above technical solution, a two-layer graph is constructed based on preset entity recognition rules and inherent cluster resource scheduling configuration. No manual topology construction is required, and the graph can be automatically constructed and updated in real time. The graph strictly distinguishes between the business logic layer and the physical computing power layer, which is in line with the cross-layer deployment architecture of cloud-native databases. This provides a topological foundation for subsequent layered fault analysis and hardware contention fault identification, avoiding the problem that a single-layer graph cannot distinguish fault levels.

[0025] In some embodiments, determining the hardware contention tension value between entity computing power support nodes based on entity server resource metrics includes: Step 301: Obtain computing power queuing latency data and storage page swapping rate from the physical server resource indicators; specifically, retrieve computing power queuing latency data and storage page swapping rate data for each physical computing power support node within a preset sampling period from the operation and maintenance time series database; where computing power queuing latency data is the average waiting latency for server CPU to process tasks, directly reflecting the degree of CPU resource contention and congestion; storage page swapping rate is the frequency of page replacement between server memory and disk, directly reflecting memory resource overload and storage resource contention status. These two types of indicators can comprehensively quantify the hardware resource competition status of physical nodes; for example, the preset sampling period is 1 minute, and retrieve 10 consecutive sampling points of SVR_01 and SVR_02 from the time series database, where the average computing power queuing latency of SVR_01 is 7.6ms and the storage page swapping rate is 11.8%, and the average computing power queuing latency of SVR_02 is 7.2ms and the storage page swapping rate is 11.2%, which are used to quantify the hardware resource contention status of the two nodes; Step 302: Normalize the computing power queuing latency data and storage page exchange rate according to the preset dimension unification rules to generate a basic performance consumption matrix. Specifically, for the differences in the numerical dimensions and value ranges of latency and ratio indicators, configure exclusive dimension unification normalization rules to eliminate the differences in dimensions and numerical magnitudes between the two types of indicators. Structure the normalized indicator data of all nodes, with server nodes as rows and indicator types as columns, to construct a basic performance consumption matrix with unified dimensions and comparable values. Each element in the matrix corresponds to the quantified value of a single resource load of a single physical node. For example, for two different dimension indicators, millisecond-level latency and percentage ratio, after processing with exclusive normalization formulas, arrange the normalized computing power latency and storage exchange rate data of SVR_01 and SVR_02 by rows and columns to construct a 2×2 basic performance consumption matrix, so as to achieve unified quantitative comparison of different indicator data. Step 303: Determine the covariance between each element in the basic performance consumption matrix, and use the obtained covariance result as the hardware contention tension value between the entity computing power support nodes; The complete algorithm calculation process for this step is supplemented as follows: First, select any two entity computing power support nodes A and B to be calculated, and extract the normalized time-series data of all computing power delay deviation rate and storage deviation rate of the two nodes within the same sampling period to form two sets of feature sequences with consistent dimensions; Second, calculate the arithmetic mean of the feature sequences of node A and node B respectively to obtain the mean benchmark of the two sets of sequences; Third, calculate the deviation of node A's feature from the mean of A and the deviation of node B's feature from the mean of B at each sampling point in time sequence, and multiply the two sets of deviations to obtain the deviation product value at a single time point; Fourth, accumulate the deviation product values ​​of all sampling points to obtain the total deviation product sum; Fifth, use the unbiased estimation rule of sample covariance to divide the total deviation product sum by (time-series sampling points) The covariance value between the two nodes is obtained by subtracting 1 from the number of nodes. This covariance value is the hardware contention tension value. If the tension value is positive and the larger the value, the more synchronized the trends of computing power and storage resource load changes of the two nodes are, and the stronger the correlation between resource contention conflicts and fault linkage. If it is close to 0 or negative, it means that there is no significant resource contention correlation between the nodes. Through this complete calculation process, the intensity of hardware resource contention conflict and the degree of fault linkage between physical nodes can be accurately quantified. For example, nodes SVR_01 and SVR_02 are selected, and the normalized feature sequence of 10 sampling points is extracted. After calculating the mean of the two sets of sequences, the deviation product is calculated point by point and accumulated. Finally, the covariance is calculated to be 0.78 through unbiased estimation. The tension value is positive and the value is relatively high, which proves that there is a significant hardware resource contention and fault linkage relationship between the two nodes. If the calculated tension value is -0.12, it means that the load changes of the two nodes are not related and there is no resource contention.

[0026] By using the above technical solution, core operating condition indicators that can directly reflect hardware resource contention are selected, and data is uniformly quantified through normalization processing. Relying on the complete calculation process of the standardized covariance algorithm, the load linkage and resource competition relationship between nodes is explored. The obtained hardware contention tension value objectively matches the actual operating conditions of the cluster, providing a reliable quantitative basis for subsequent accurate graph pruning and invalid topology filtering, and solving the problem that traditional technologies cannot quantify the degree of physical node resource contention.

[0027] In some embodiments, generating a target fault diagnosis subgraph includes: Step 401: Obtain historical data of hardware contention tension values ​​within a preset time period to determine the graph edge pruning threshold. Specifically, retrieve historical time-series data of hardware contention tension values ​​between all pairs of physical computing power support nodes within the preset time period. Based on the distribution pattern of historical data, statistically obtain the initial critical threshold suitable for the normal operation of the cluster. Combine the threshold adaptive adjustment amount and the linkage rules of the operation condition compensation amount to complete the threshold correction, realize the dynamic adaptive adjustment of the threshold, adapt to different cluster sizes and operating load states, and avoid the problem of over-pruning or incomplete pruning caused by a fixed threshold. For example, with a preset time period of 1 hour, retrieve 45 sets of historical tension value data of all physical nodes in the cluster. Statistically, the initial critical threshold under normal operating conditions is 0.4. After combining the current high load condition adjustment amount of 0.08 and the compensation amount linkage correction, the final adaptive threshold is adjusted to 0.48, which is suitable for the current cluster load state. Step 402: Compare the hardware contention tension value corresponding to each directed edge in the two-layer initial operation and maintenance graph with the graph edge pruning threshold. Specifically, traverse all directed topological edges connecting logical nodes and physical nodes, and physical nodes and physical nodes in the two-layer initial operation and maintenance graph, match the hardware contention tension value of the node corresponding to each topological edge, and compare the tension value with the pruning threshold one by one to distinguish between highly correlated valid topological edges and low-correlation invalid topological edges. For example, traverse the 8 topological edges in the graph, where the tension value of edge SVR_01-SVR_02 is 0.78 and the tension value of edge SVR_01-DB_001 is 0.65, both greater than the threshold of 0.48; while the tension value of edge SVR_01-SVR_03 is 0.22 and the tension value of edge DB_001-DB_002 is 0.31, both less than the threshold, thus completing the distinction and screening of valid and invalid edges. Step 403: Cut off directed edges with hardware contention tension values ​​below the graph edge pruning threshold, retaining the remaining logical database entity nodes, entity computing power support nodes, and directed edges to generate a target fault diagnosis subgraph. Specifically, for topological edges with tension values ​​below the threshold, they are determined to be invalid weakly related edges with no substantial hardware contention association and no fault propagation value, and are directly cut off and removed. For topological edges with tension values ​​above the threshold, they are determined to be valid related edges with real resource contention and fault propagation potential, and are retained. At the same time, all original nodes are completely retained, and only redundant topological edges are simplified, ultimately generating a target fault diagnosis subgraph with a simplified structure, valid associations, and a focus on the core relationship of fault propagation. For example, cut off two invalid topological edges with tension values ​​of 0.22 and 0.31, retain all database logical nodes and physical computing power nodes, as well as 6 highly related topological edges, and remove invalid topological associations caused by normal slight load fluctuations in the cluster to generate a target fault diagnosis subgraph focusing on the core propagation relationship of this fault.

[0028] The above technical solution dynamically generates pruning thresholds based on historical cluster operation data. By linking the adjustment amount and the compensation amount to adapt to fluctuations in operating conditions, it achieves adaptive and accurate noise reduction of the graph topology, eliminates invalid topological associations corresponding to batch derived alarms caused by hardware contention, simplifies the graph structure, reduces the computational load and latency of subsequent graph model inference, and at the same time retains the core topological relationships of real fault propagation, ensuring the integrity and accuracy of fault diagnosis.

[0029] In some embodiments, parsing the root cause diagnostic feature vector includes: Step 501: Input the root cause diagnosis feature vector into a preset fully connected classification layer for linear transformation to generate a probability distribution matrix of multiple candidate fault categories. Specifically, the preset fully connected classification layer is offline trained to adapt to various fault features in the database, enabling the mapping from high-dimensional feature vectors to fault category probabilities. Input the aggregated root cause diagnosis feature vector into the fully connected classification layer, and through linear transformation and dimension mapping of the weight matrix, output a probability distribution matrix containing all preset fault categories such as hardware resource contention faults, database instance anomalies, read / write overload, network transmission faults, and cache faults. The value of each element in the matrix corresponds to the probability of occurrence of the corresponding fault category. Supplement to the algorithm calculation process in this step: Assume the root cause diagnosis feature vector is an N-dimensional input vector, and the fully connected layer presets M sets of weight parameters... M sets of bias parameters, where M is the preset number of fault categories; first, matrix multiplication of the vector and weight matrix is ​​performed to achieve dimensionality reduction mapping of high-dimensional features; then, the corresponding bias parameters are superimposed dimension by dimension to obtain the original scores of each fault category; finally, the Softmax activation function is used to complete the normalization process, converting all original scores into probability values ​​in the 0-1 interval, and the sum of the probability values ​​of all fault categories is 1, finally generating a well-ordered fault probability distribution matrix; for example, inputting a 128-dimensional root cause diagnostic feature vector, with a preset M=5 fault categories, 5 sets of original scores are obtained through linear dimensionality reduction of the weight matrix and bias superposition, and after Softmax normalization, a 5×1 probability distribution matrix is ​​generated, corresponding to the occurrence probabilities of hardware contention, instance anomaly, load overload, network failure, and cache failure, respectively; Step 502: Select the label category corresponding to the largest probability element in the probability distribution matrix as the root cause localization result. Specifically, iterate through the probability values ​​corresponding to all fault categories in the probability distribution matrix, filter out the fault label, fault level, and associated node information corresponding to the maximum value, and determine the result as the final root cause localization result. This accurately locates the fault type and the fault occurrence node, and completes the intelligent analysis and output of the root cause of the fault. For example, iterate through the probability matrix values, and the hardware resource contention fault probability of 92.3% is the maximum value. The corresponding fault level is the physical computing power layer, and the fault node is SVR_01. Based on this, the result is determined as the final root cause localization result.

[0030] The above technical solution achieves accurate classification and mapping of high-dimensional fault features through a fully connected classification layer, and selects the optimal root cause of the fault based on probability distribution. The analysis logic is simple, efficient and accurate, and can adapt to complex coupled fault scenarios in clusters. It can effectively distinguish between surface-derived alarms and underlying real fault roots, and improve the accuracy of fault location.

[0031] In some embodiments, the computing power queuing latency data and storage page swapping rate are normalized according to a preset unit unification rule, including: Step 601: Generate the deviation between the computing power queuing latency data and the first benchmark latency constant, and perform normalization processing based on the first benchmark latency constant to generate a latency deviation rate; specifically, the first benchmark latency constant is the standard value of server computing power queuing latency under normal and stable cluster operation, preset according to cluster hardware configuration and normal load; calculate the difference between the real-time collected computing power queuing latency data and the first benchmark latency constant to obtain the latency deviation; perform a ratio calculation between the latency deviation and the first benchmark latency constant to complete the normalization processing of the latency data and generate a dimensionless [data / data]. The latency deviation rate accurately represents the degree of deviation of the current computing power latency from the normal operating condition. The complete calculation process is as follows: Latency deviation = Real-time computing power queuing latency - First reference latency constant; Latency deviation rate = Latency deviation ÷ First reference latency constant; For example, the preset normal first reference latency constant of the cluster is 5ms. At a certain sampling time, the real-time computing power queuing latency of SVR_01 is 7.5ms. The latency deviation = 7.5 - 5 = 2.5ms, and the latency deviation rate = 2.5 ÷ 5 = 0.5, which indicates that the current CPU computing power queuing latency is 50% higher than the normal level. Step 602: Determine the deviation between the storage page swap rate and the second baseline swap constant, and normalize it based on the second baseline swap constant to generate a storage deviation rate. Specifically, the second baseline swap constant is the standard storage page swap rate under stable cluster operation conditions, which is a preset fixed parameter of the system. Calculate the difference between the real-time storage page swap rate and the second baseline swap constant to obtain the storage swap deviation. Normalize the ratio of the deviation to the second baseline swap constant to generate a dimensionless storage deviation rate, quantifying the degree of overload deviation of the current storage resources. Complete calculation process: Storage swap deviation = Real-time storage page swap rate - Second baseline swap constant; Storage deviation rate = Storage swap deviation ÷ Second baseline swap constant; For example, the preset second baseline swap constant is 8%, the real-time storage page swap rate of SVR_01 is 12%, the storage swap deviation = 12% - 8% = 4%, and the storage deviation rate = 4% ÷ 8% = 0.5, indicating that the current storage page swap frequency is 50% higher than normal. Step 603: Using the latency deviation rate as the real part and the storage deviation rate as the imaginary part, a complex-form basic performance consumption matrix is ​​generated. Specifically, a complex-form matrix structure is constructed using the normalized latency deviation rate as the complex real part and the storage deviation rate as the complex imaginary part. Each complex element in the matrix simultaneously carries the load deviation characteristics of the node's computing power resources and storage resources, realizing the fusion representation of the two types of core resource contention characteristics, and providing more comprehensive data support for subsequent covariance calculation and tension value quantification. Complete calculation process: Complex performance characteristic value of a single node = latency deviation rate + storage deviation rate × i, where i is the imaginary unit. All complex characteristic values ​​are batch arranged according to the node dimension and time sequence dimension to generate a complete basic performance consumption matrix. For example, the complex performance characteristic value of a single node SVR_01 = 0.5 + 0.5i, and the corresponding characteristic value of SVR_02 = 0.44 + 0.4i. The complex characteristic values ​​of 10 consecutive sampling points of the two nodes are batch arranged to generate a 2-row, 10-column complex basic performance consumption matrix. Through the above technical solutions, the differences in dimensions and magnitudes between latency and ratio indicators are completely eliminated by normalizing the benchmark constant deviation. By using a complex matrix to fuse dual-dimensional resource characteristics, compared with the single indicator calculation method, it can more comprehensively and accurately reflect the overall contention status of server hardware resources and improve the quantitative accuracy of hardware contention tension values.

[0032] In some embodiments, acquiring historical data of hardware contention tension values ​​within a preset time period and determining the graph edge trimming threshold includes: Step 701: Establish a fixed-length sliding data collection window on the timeline; specifically, a fixed-duration sliding time window is preset as the data collection interval, and the window duration can be adaptively adjusted according to the cluster operation and maintenance accuracy requirements; continuously slide and update the window data on the timeline, and collect the hardware contention tension values ​​between all physical computing power support nodes within the window in real time to ensure that the collected data closely matches the recent real-time operating conditions of the cluster; for example, the preset sliding window duration is 5 minutes, and the window data is updated every 10 seconds, continuously collecting the hardware contention tension values ​​between all physical nodes in the cluster within the window, updating the dataset within the window in real time, and adapting to the dynamic load changes of the cluster; Step 702: Calculate the arithmetic mean and standard deviation of all hardware contention tension values ​​within the current sliding data collection window. Specifically, perform statistical analysis on all tension value data collected within the sliding window to calculate the overall arithmetic mean, representing the average resource contention level of the cluster under normal conditions. Calculate the standard deviation to represent the fluctuation range and operational dispersion of the tension values, comprehensively understanding the normal distribution and fluctuation characteristics of cluster resource contention. Complete calculation process supplement: Arithmetic mean calculation: Accumulate all hardware contention tension values ​​within the sliding window, divide by the total number of valid data points in the window to obtain the mean μ; Standard deviation calculation: Substitute the difference between each tension value and the mean, square the values, sum them, divide by the total number of data points, and take the square root to obtain the standard deviation σ, accurately representing the dispersion of operational fluctuations. For example, if the current sliding window contains 20 sets of valid tension value data, the summation yields a mean μ = 0.32 and a standard deviation σ = 0.08, accurately reflecting the current average resource contention level and load fluctuation range of the cluster. Step 703: Determine the composite value based on the arithmetic mean, preset weight coefficients, and standard deviation. Use the resulting composite value as the graph edge trimming threshold. Specifically, preset weight coefficients to adapt to cluster operating conditions balance the influence of the mean and fluctuation deviation. The critical threshold is obtained by synthesizing the value using the formula "mean + weight coefficient × standard deviation". This threshold takes into account both the normal operating level of the cluster and the fluctuation characteristics of the operating conditions, and can accurately distinguish between normal resource fluctuations and abnormal fault-level resource contention. The composite value is determined as the final graph edge trimming threshold. Threshold adaptive adjustment amount, compensation amount correlation logic + numerical example supplement: Core calculation formula: Final threshold T = μ + α × σ, where α is the preset weight compensation amount (fixed value range [1.0, 3.0], which can be configured as needed), and α × σ is the threshold adaptive adjustment amount; Correlation logic: The compensation amount α is the adjustment benchmark, and the adjustment amount follows the adjustment. The operating condition fluctuation σ dynamically changes. The greater the cluster load fluctuation and the higher the σ value, the greater the upward adjustment, and the threshold adaptively rises to avoid erroneously deleting valid faulty associated edges under high load. When the cluster load is stable and the σ value is small, the upward adjustment is small, and the threshold closely matches the normal average value, accurately filtering weak and invalid associations. Specific implementation example: Set a sliding window to collect 10 sets of tension values, calculate the mean μ=0.32, standard deviation σ=0.08, preset compensation amount α=2.0; upward adjustment amount = 2.0×0.08=0.16; final threshold T=0.32+0.16=0.48; when the cluster experiences sudden load fluctuations, σ rises to 0.15, the upward adjustment amount increases synchronously to 0.3, and the threshold adaptively rises to 0.62 to adapt to high fluctuation conditions; when the cluster operates stably, σ drops to 0.03, the upward adjustment amount drops to 0.06, and the threshold falls back to 0.38, accurately filtering weak association noise. The above technical solution uses a sliding window to dynamically collect historical data and combines the mean and standard deviation to synthesize an adaptive pruning threshold. Through a linkage mechanism that uses a fixed compensation amount as a benchmark and an upward adjustment amount to dynamically adapt to fluctuations, compared with a fixed threshold, it can adapt to the dynamic fluctuations of cluster load, avoid the problems of incorrect or missed pruning of the map caused by load fluctuations, and improve the adaptive capability of map noise reduction and pruning.

[0033] In some embodiments, prior to using the graph attention network model, parameter training of the graph attention network model is further included, including: Step 801: Obtain sample graph data and corresponding true root cause labels, input them into the initial graph network architecture for forward propagation, and output predicted distribution features. Specifically, collect operation and maintenance graph data under historical cluster failure scenarios as sample graph data. The sample data covers various typical failure scenarios such as hardware resource contention, instance anomalies, and load overload. Manually label the true root cause labels corresponding to each sample graph data to construct a training dataset. Input the sample graph data into the initial graph attention network architecture, complete feature extraction, weight calculation, and feature aggregation through forward propagation, and output the fault feature distribution predicted by the model. For example, collect 1000 sets of historical failure samples, including 300 sets of hardware resource contention failures, 250 sets of database instance anomalies, 250 sets of load overload, and 200 sets of network failure samples. Manually label the root cause labels for each sample graph, input them into the initial network to complete forward propagation, and output the fault prediction distribution features. Step 802: Determine the cross-entropy between the predicted distribution features and the true root cause labels as the basic classification error; Complete calculation process supplement: Using a multi-class cross-entropy loss calculation method, firstly, convert the manually labeled true root cause labels into one-hot encoded vectors, with the true label corresponding to a dimension value of 1 and the other dimensions of 0; then, combining the predicted probabilities of each fault category output by the model, calculate "true label value × ln(predicted probability value)" for each dimension, sum the results of all dimensions and take the opposite number to finally obtain the cross-entropy value; the smaller the cross-entropy value, the higher the fit between the model's predicted distribution and the true fault label, and the smaller the basic classification error; for example, the true fault label is hardware resource contention fault, corresponding to one-hot encoding [1, 0, 0, 0, 0], combined with the predicted probabilities output by the model [0.92, 0.05, 0.02, 0.01, 0], the basic classification error calculated by the cross-entropy formula is 0.08, the smaller error value indicates a higher prediction fit; Step 803: Determine the proportion of entity computing power support nodes with topological disconnection in the sample graph data, as the topology distortion penalty term; Complete calculation process supplement: Count the number of physical nodes N1 in a single sample graph that cause topology failure due to faults, disconnection, or service offline, and count the total number of all physical nodes N2 in the sample graph; Topology distortion penalty term P = N1 ÷ N2, with a value range of [0, 1]. The more disconnected nodes there are and the more severe the graph distortion, the larger the penalty term value; For example, a sample graph contains 10 physical computing power nodes, of which 2 nodes are disconnected due to faults and topology failure, N1=2, N2=10, and the calculated topology distortion penalty term P=0.2 is used to penalize the topology distortion scenario; Step 804: Combine the basic classification error and the topology distortion penalty term to form the final error function. Use the backpropagation algorithm to update the network layer node parameters of the initial graph network architecture to complete the training and obtain the graph attention network model. Complete calculation process supplement: Preset classification error weight λ1 and distortion penalty weight λ2, satisfying λ1+λ2=1. Common configurations are λ1=0.8 and λ2=0.2. Final error Loss = λ1 × cross-entropy classification error + λ2 × topology distortion penalty term. Through the backpropagation algorithm, iteratively update the model weights and bias parameters layer by layer according to the error gradient, continuously monitoring the process during iteration. To test the convergence of the error, when the numerical fluctuation of the error in multiple consecutive iterations is less than a preset minimum threshold and no longer decreases significantly, the model training is considered to have converged, and the final graph attention network model is obtained. Specifically, the basic classification error and the topological distortion penalty term are weighted and fused to construct a final error function that takes into account both the accuracy of conventional classification and the ability to adapt to distorted topology. The weight parameters and bias parameters of the graph attention network are iteratively updated layer by layer through the backpropagation algorithm to continuously optimize the model's feature extraction and weight allocation capabilities until the error function converges, the model training is completed, and the final graph attention network model adapted to complex topological fault scenarios is obtained. For example, if the classification error in a certain iteration is 0.08 and the topology penalty term is 0.2, substituting these values ​​into the formula, we get the final Loss = 0.8 × 0.08 + 0.2 × 0.2 = 0.104. The model parameters are updated through backpropagation, and the training continues iteratively until the error stabilizes within 0.05 and no longer fluctuates, thus completing the model training.

[0034] By introducing a topology distortion penalty term during model training, the above technical solution can better reflect real-world operational conditions such as database cluster node disconnection, topology distortion, and batch cascading failures. This improves the model's generalization ability to complex and abnormal topology scenarios and addresses the problem of model misdiagnosis under complex conditions.

[0035] In some embodiments, the hidden layer features of neighboring nodes are weighted and aggregated according to the feature propagation weights, including: Step 901: Obtain the timestamp of alarm generation by each node in the target fault diagnosis subgraph, and determine the time lag interval between the source node and the target node. Specifically, retrieve the alarm generation timestamps of all alarm nodes in the target fault diagnosis subgraph, take the underlying physical fault node as the source node and the upper-layer derived alarm node as the target node, calculate the time difference between the fault occurrence time of the source node and the alarm generation time of the target node to obtain the fault propagation time lag interval between nodes, so as to accurately restore the time sequence propagation characteristics of faults. For example, the fault occurrence timestamp of the physical node SVR_01 is 10:20:05, and the timestamp of the derived alarm DB_001 query timeout is 10:20:08, the calculated fault propagation time lag interval between the two nodes is Δt=3s; Step 902: Map the time lag interval based on a preset time sensitivity function to generate a time sequence state attenuation factor. Specifically, preset a time sensitivity function adapted to the fault propagation law of the database, and the function is configured with a fixed fault propagation time window. When the time lag interval between nodes is within the range of the time window, it is determined as valid time-sequence fault propagation, and a coefficient greater than 1 is output to enhance the feature transfer weight. When the time lag interval exceeds the time window, it is determined as an uncorrelated time-sequence alarm and an invalid lag alarm, a coefficient less than 1 is output to perform attenuation suppression on the features, and finally the time sequence state attenuation factor of each node association path is generated. The calculation process is as follows: set the preset valid fault propagation time window as [Tmin, Tmax], and the measured time sequence lag interval as Δt. The time sensitivity function is calculated in segments: if Tmin≤Δt≤Tmax, the attenuation factor γ=1+β×(Tmax-Δt) / Tmax, where β is a preset enhancement coefficient with a value ranging from 0.2 to 0.5. If Δt<Tmin or Δt>Tmax, the attenuation factor γ=1-δ×|Δt-Tmid| / Tmid, where δ is the attenuation coefficient with a value range of 0.3 to 0.7, and Tmid is the median value of the time window, so as to realize the enhancement of valid time sequence paths and the suppression of invalid time sequence paths. For example, the preset valid time window is [Tmin=1s, Tmax=5s], the enhancement coefficient β=0.3, and the current Δt=3s is within the window range, the calculated attenuation factor γ=1+0.3×(5-3) / 5=1.12, which enhances the weight of this valid propagation path. If Δt=8s exceeds the window, it is determined as an invalid lag alarm, and the attenuation factor γ=0.7, which attenuates and suppresses the path weight. The value of δ is set according to the time sequence characteristics of fault propagation in the distributed database cluster: when δ is less than 0.3, the suppression force on out-of-window asynchronous alarms is insufficient, and irrelevant time sequence noise is easily mixed in. When δ is greater than 0.7, the cascaded fault features with slight timeout are prone to excessive attenuation, and valid association information is lost. The interval of 0.3 to 0.7 has been verified by multiple sets of pressure tests, which can balance the effects of noise suppression and real fault feature retention, and the median value δ=0.5 is preferentially selected as the standard configuration in engineering practice.

[0036] Step 903: Perform element-wise fusion processing on the feature transfer weight and the temporal state decay factor to obtain the spatiotemporal fusion transfer weight; Complete calculation process supplement: For each set of source node-target node association paths, multiply the original feature transfer weight W calculated in the spatial dimension with the temporal decay factor γ bit by bit, and the spatiotemporal fusion transfer weight W'=W×γ, simultaneously fusing spatial topological association strength and temporal transmission effectiveness features; Specifically, multiply and fuse the feature transfer weight calculated in the spatial dimension with the state decay factor in the temporal dimension bit by bit, while taking into account the node topological association strength and the rationality of fault temporal transmission, to generate a spatiotemporal fusion transfer weight that fuses spatiotemporal dual-dimensional features, realizing the synergistic constraint of spatial topological features and temporal evolution features; For example, the original spatial feature transfer weight W=0.83 from SVR_01 to DB_001, the temporal decay factor γ=1.12, and the spatiotemporal fusion transfer weight W'=0.83×1.12=0.9296 by bit, strengthening the weight ratio of this effective temporal fault transmission path; Step 904: Weight and aggregate the hidden layer features of neighboring nodes based on the spatiotemporal fusion transfer weights, outputting a root cause diagnosis feature vector containing temporal evolution information. Complete calculation process supplement: Taking the current diagnosis node as the center, traverse all first-order and second-order neighboring nodes, obtaining the hidden layer feature vectors and spatiotemporal fusion transfer weights corresponding to each neighboring node; perform weighted calculations on each neighboring feature vector, accumulating all weighted neighboring feature vectors, while simultaneously superimposing the original feature vector of the central node itself, and finally normalizing to generate a root cause diagnosis feature vector with fixed dimensions and fused spatiotemporal features; specifically, the spatiotemporal fusion transfer weights are used as the weighting basis. The hidden layer features of neighboring nodes are weighted and aggregated. During the feature aggregation process, the evolutionary information of fault temporal propagation is preserved, the real fault features of temporal matching are strengthened, and the interference alarm features of temporal mismatch are weakened. Finally, a root cause diagnosis feature vector with both spatial topological association and temporal evolution characteristics is output. For example, with DB_001 as the central node, the hidden layer features of first-order neighbor SVR_01 and second-order neighbor SVR_03 are weighted and aggregated with fusion weights of 0.93 and 0.21, respectively. The features of DB_001 itself are superimposed and normalized to finally generate a 128-dimensional root cause diagnosis feature vector containing fault temporal propagation information.

[0037] By introducing the above technical solution, a time-series decay factor is introduced to achieve spatiotemporal dual-dimensional weight constraints, which conforms to the real law of database fault propagation and temporal progression, effectively distinguishes between synchronous chain faults and asynchronous interference alarms, further suppresses the characteristic interference of derived alarms and invalid noise, and improves the root cause localization accuracy in cross-layer coupling and time-series chain fault scenarios.

[0038] Example 2: Based on Example 1, this example also provides a database fault diagnosis system based on an operation and maintenance knowledge graph, including: The indicator acquisition module is used to collect alarm log data and physical server hardware resource indicators from the database cluster in real time. It achieves second-level data collection through acquisition agents deployed on each cluster node, synchronously aggregating time-series operating condition data and fault alarm data. It completes the cleaning, deduplication, and structured preprocessing of the raw data, providing standardized input data for subsequent graph construction and fault analysis. For example, acquisition agents deployed on 3 database nodes and 2 physical server nodes collect logs and resource indicators at a frequency of 1 second, automatically cleaning duplicate alarms and invalid zero-value data, and outputting a structured standardized operating condition dataset for use by subsequent modules. The topology construction module is used to identify logical database entity nodes in real-time alarm log data, match resource scheduling configuration tables to complete the hierarchical mapping between logical nodes and physical computing power nodes, and construct a two-layer initial operation and maintenance graph containing logical business layers and physical computing power layers. It achieves automatic extraction of business nodes through named entity recognition and accurate matching of physical nodes through resource configuration mapping, fully restoring the cross-layer topology relationship of the cluster. For example, it automatically identifies DB_001 and DB_002 logical nodes in the logs, matches resource tables to map to SVR_01 and SVR_02 physical nodes, and automatically constructs a two-layer topology graph without the need for manual configuration of the topology structure. The fault diagnosis subgraph generation module is used to extract core server resource indicators, obtain hardware contention tension values ​​through normalization and covariance calculation, dynamically calculate the graph pruning threshold based on a sliding window, and adaptively correct the threshold by combining the linkage rules of adjustment and compensation. Invalid weakly related topological edges of the initial two-layer operation and maintenance graph are pruned and removed to complete graph noise reduction and simplification, generating a target fault diagnosis subgraph focusing on core fault associations, reducing the computational cost of subsequent model inference. For example, CPU computing power queuing latency and storage page swapping rate indicators are extracted, node tension values ​​and adaptive thresholds are calculated, weakly related topological edges in the graph are removed, and the original 12 topological edges are simplified to 6 core fault-related edges, reducing the computational cost of model inference. The model building module is used to encode the features of each node in the target fault diagnosis subgraph and generate the initial state vector of the node; it retrieves the pre-built cross-layer fault propagation attention mask and inputs the initial state vector of the node and the mask into the pre-trained graph attention network model to complete the feature preprocessing and input adaptation before model inference; for example, the features of all nodes in the simplified subgraph are encoded into fixed-dimensional vectors, and the cross-layer mask is matched to block invalid propagation paths. After data preprocessing, the vectors are input into the trained model to ensure the accuracy of model inference. The weight generation module is used to complete the feature concatenation of source nodes and target nodes in the hidden layer of the graph attention network model and calculate the initial attention coefficients. Combined with the penalty scalar of the cross-layer fault propagation attention mask, the module obtains the accurate inter-node feature transfer weights through nonlinear mapping of the activation function, thereby realizing the weight constraint of invalid fault propagation paths and the weight enhancement of real fault paths. For example, the module enhances the weights of valid fault propagation paths from physical to logical and applies penalty decay to the reverse invalid paths from logical to physical, thereby accurately correcting the node fault propagation weights. The feature output module is used to retrieve the alarm timestamps of each node to calculate the time lag interval, generate the time-series state decay factor, and fuse the spatial feature transmission weights to obtain the spatiotemporal fusion transmission weights. Based on the fusion weights, the module completes the weighted aggregation of neighbor node features and outputs a root cause diagnosis feature vector containing both spatiotemporal features, which fully carries the core fault features and temporal evolution laws. For example, the module combines the 3-second fault propagation lag interval to generate the decay factor, fuses the spatial weights to complete feature aggregation, and outputs a fault feature vector that combines topological structure and temporal evolution features. The results output module is used to input the root cause diagnosis feature vector into the fully connected classification layer to complete the fault probability mapping and generate a fault category probability distribution matrix; it filters the fault root cause label and node location corresponding to the optimal probability, and finally outputs the accurate fault type, fault level, and fault node location results to complete the intelligent diagnosis output of cluster faults; for example, the fault probability matrix is ​​obtained through classification layer mapping, the SVR_01 hardware resource contention fault corresponding to the highest probability is filtered, and a complete fault location report is output. Through the above technical solutions, this invention addresses the operational characteristics of cloud-native distributed databases, including cross-layer coupled deployment, hardware resource sharing, and batch cascading alarms. It constructs a two-layer separated operation and maintenance knowledge graph, combining a complete quantization algorithm for hardware contention tension values, an adaptive threshold adjustment and compensation linkage mechanism, to achieve dynamic adaptive pruning of the graph. This filters out batch-derived alarms and invalid topological noise caused by hardware contention at the source, reducing the computational overhead and diagnostic latency of graph model inference. By introducing cross-layer fault propagation attention masks and temporal decay factors, a spatiotemporal dual-dimensional feature weight constraint mechanism is constructed, refining the complete calculation process for various model weights, loss functions, and feature aggregation. This effectively distinguishes between logic layer-derived alarms and physical layer real faults, suppresses invalid feature interference, and strengthens the feature expression of the root cause of underlying faults. Furthermore, by optimizing the training loss function of the graph attention network, it introduces… The topology distortion penalty term enhances the model's generalization and adaptation capabilities to complex operating conditions such as node disconnection, topology distortion, and batch cascading failures. This invention effectively solves the problems of severe redundancy in existing database intelligent fault diagnosis technologies, low inference efficiency, low accuracy in locating complex cross-layer faults, and poor adaptability to operating conditions. It improves the accuracy of root cause diagnosis of distributed database cluster faults, reduces cluster operation and maintenance costs and business downtime risks, and has extremely high engineering practicality and industrial application value. For example, in a 10-node distributed database production cluster, after applying this solution, the fault diagnosis misdiagnosis rate was reduced from 18% of the traditional solution to less than 3%, and the model inference latency was reduced from 200ms to 50ms. It can quickly locate various cross-layer coupled faults such as hardware resource contention and node failures, effectively reducing business downtime and significantly reducing manual operation and maintenance costs.

[0039] The above embodiments can be implemented, in whole or in part, by software, hardware, firmware, or any other combination thereof. When implemented in software, the above embodiments can be implemented, in whole or in part, as a computer program product. Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution.

[0040] The units described as separate components may or may not be physically separate. The components shown as units may or may not be physical units; they may be located in one place or distributed across multiple network units. Some or all of the units can be selected to achieve the purpose of this embodiment, depending on actual needs.

[0041] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any changes or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application.

Claims

1. A database fault diagnosis method based on operation and maintenance knowledge graph, characterized in that, The method includes: Obtain real-time alarm log data and entity server resource metrics from the database cluster; Identify logical database entity nodes in real-time alarm log data and map the logical database entity nodes to the corresponding entity computing power support nodes to construct a two-layer initial operation and maintenance map containing a two-layer topology structure; Based on the physical server resource indicators, the hardware contention tension value between physical computing power support nodes is determined, and the initial two-layer operation and maintenance map is pruned based on the hardware contention tension value to generate the target fault diagnosis sub-map. Obtain the initial state vector of each node in the target fault diagnosis subgraph; input the initial state vector and the pre-constructed cross-layer fault propagation attention mask into the pre-trained graph attention network model; In the hidden layer of the graph attention network model, the hidden layer features of the source node and the hidden layer features of the target node are concatenated to obtain the initial attention coefficients; the mask penalty scalar corresponding to the connection path between the source node and the target node is obtained in the cross-layer fault propagation attention mask; and the combination value of the initial attention coefficients and the mask penalty scalar is nonlinearly mapped using a preset activation function to obtain the feature propagation weights. The hidden layer features of neighboring nodes are weighted and aggregated according to the feature propagation weights to output the root cause diagnosis feature vector. Analyze the root cause diagnosis feature vector and output the root cause location results for the database cluster.

2. The database fault diagnosis method based on operation and maintenance knowledge graph according to claim 1, characterized in that, Construct a two-layer initial operation and maintenance graph containing a two-layer topology, including: Based on preset named entity recognition rules, database instance identifiers are identified from real-time alarm log data as logical database entity nodes; Query the pre-set resource scheduling configuration table to obtain the entity server identifiers that have a host deployment relationship with the database instance identifier, and use them as entity computing power support nodes; Directed edges are used to connect logical database entity nodes and entity computing power support nodes to generate a two-layer initial operation and maintenance graph.

3. The database fault diagnosis method based on operation and maintenance knowledge graph according to claim 1, characterized in that, The hardware contention tension value between physical computing power support nodes is determined based on physical server resource indicators, including: Obtain computing power queuing latency data and storage page swapping rate from the physical server resource metrics; The computing power queuing latency data and storage page swapping rate are normalized according to the preset unit unification rules to generate a basic performance consumption matrix. Determine the covariance between each element in the basic performance consumption matrix, and use the obtained covariance result as the hardware contention tension value between the entity computing power support nodes.

4. The database fault diagnosis method based on operation and maintenance knowledge graph according to claim 1, characterized in that, Generate the target fault diagnosis subgraph, including: Acquire historical data of hardware contention tension values ​​within a preset time period to determine the image edge trimming threshold; Compare the relationship between the hardware contention tension value corresponding to each directed edge in the two-layer initial operation and maintenance graph and the graph edge pruning threshold. Cut off directed edges whose hardware contention tension values ​​are below the graph edge pruning threshold, retain the remaining logical database entity nodes, entity computing power support nodes, and directed edges, and generate the target fault diagnosis subgraph.

5. A database fault diagnosis method based on operation and maintenance knowledge graph according to claim 1, characterized in that, Analysis of root cause diagnostic feature vectors includes: The root cause diagnosis feature vector is input into a preset fully connected classification layer for linear transformation to generate a probability distribution matrix of multiple candidate fault categories. The label category corresponding to the highest probability element in the probability distribution matrix is ​​selected as the root cause localization result.

6. A database fault diagnosis method based on operation and maintenance knowledge graph according to claim 3, characterized in that, The computing power queuing latency data and storage page swapping rate are normalized according to a preset unit unification rule, including: The deviation between the generated computing power queuing delay data and the first reference delay constant is normalized based on the first reference delay constant to generate the delay deviation rate. Determine the deviation between the storage page swap rate and the second baseline swap constant, and perform normalization based on the second baseline swap constant to generate the storage deviation rate; By combining the latency skew rate as the real part and the storage skew rate as the imaginary part, a complex-form basic performance consumption matrix is ​​generated.

7. A database fault diagnosis method based on operation and maintenance knowledge graph according to claim 4, characterized in that, Acquire historical data of hardware contention tension values ​​within a preset time period to determine the image edge trimming threshold, including: Establish a fixed-length sliding data collection window on the timeline; Calculate the arithmetic mean and standard deviation of all hardware contention tension values ​​within the current sliding data collection window; The composite value is determined based on the arithmetic mean, preset weighting coefficients, and standard deviation, and the resulting composite value is used as the edge trimming threshold of the graph.

8. A database fault diagnosis method based on operation and maintenance knowledge graph according to claim 1, characterized in that, Before using the graph attention network model, parameter training of the graph attention network model is also included, including: Obtain sample graph data and corresponding true root cause labels, input them into the initial graph network architecture for forward propagation, and output the predicted distribution features. Determine the cross-entropy between the predicted distribution features and the true root cause labels as the basic classification error; Determine the proportion of entity computing power support nodes with topological disconnection in the sample graph data, and use it as a topological distortion penalty term; The basic classification error and the topology distortion penalty term are combined to form the final error function. The backpropagation algorithm is used to update the network layer node parameters of the initial graph network architecture to complete the training and obtain the graph attention network model.

9. A database fault diagnosis method based on operation and maintenance knowledge graph according to claim 1, characterized in that, The hidden layer features of neighboring nodes are weighted and aggregated based on the feature propagation weights, including: Obtain the timestamps of alarms generated by each node in the target fault diagnosis subgraph, and determine the time lag interval between the source node and the target node; The time lag interval is mapped based on a preset time sensitivity function to generate a time-series state decay factor; The mapping rule of the time sensitivity function is as follows: when the time lag interval is within the preset fault propagation time window, the output is an enhancement coefficient greater than 1; otherwise, the output is an attenuation coefficient less than 1. The feature transfer weights and the temporal state decay factor are fused element by element to obtain the spatiotemporal fusion transfer weights. The hidden layer features of neighboring nodes are weighted and aggregated based on the spatiotemporal fusion transfer weights, and the root cause diagnosis feature vector containing temporal evolution information is output.

10. A database fault diagnosis system based on operation and maintenance knowledge graph, characterized in that, For implementing the database fault diagnosis method based on operation and maintenance knowledge graph as described in any one of claims 1-9, the system comprises: The metrics acquisition module acquires real-time alarm log data and entity server resource metrics from the database cluster. The graph construction module identifies logical database entity nodes in real-time alarm log data and maps logical database entity nodes to corresponding entity computing power support nodes to construct a two-layer initial operation and maintenance graph containing a two-layer topology structure. The fault diagnosis subgraph generation module determines the hardware contention tension value between the entity computing power support nodes based on the entity server resource indicators, and prunes the two-layer initial operation and maintenance map based on the hardware contention tension value to generate the target fault diagnosis subgraph. The model building module obtains the initial state vectors of each node in the target fault diagnosis subgraph; and inputs the initial state vectors and the pre-built cross-layer fault propagation attention mask into the pre-trained graph attention network model. The weight generation module concatenates the hidden features of the source node and the hidden features of the target node in the hidden layer of the graph attention network model to obtain the initial attention coefficients; it obtains the mask penalty scalar corresponding to the connection path between the source node and the target node in the cross-layer fault propagation attention mask, and uses a preset activation function to perform nonlinear mapping on the combination value of the initial attention coefficients and the mask penalty scalar to obtain the feature propagation weights. The feature output module performs weighted aggregation of the hidden layer features of neighboring nodes based on the feature propagation weights, and outputs the root cause diagnosis feature vector. The results output module parses the root cause diagnostic feature vector and outputs the root cause localization results for the database cluster.

Images