Fault cause identification support device, fault cause identification support method, and program

Abstract

To provide a fault cause identification support device capable of supporting in identifying a cause of a fault in an IT system.SOLUTION: In a fault cause identification support device, error message acquisition means acquires an error message from an IT system. Configuration information acquisition means acquires configuration information of the IT system. Device state acquisition means acquires state information of devices configuring the IT system based on the error message and the configuration information. Question sentence generation means generates a first question sentence including the error message, the configuration information, the state information, and an instruction sentence for instructing analysis of an error cause. Response means inputs the first question sentence to a large-scale language model and acquires candidates of the error cause as an answer.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present disclosure relates to a technique for identifying the cause of a fault. [Background technology]

[0002] There are known techniques for detecting system failures and identifying their causes. For example, Patent Document 1 describes a control program, a control method, and a control device that improve the efficiency of analyzing the causes of failures in a virtualized system. [Prior art documents] [Patent documents]

[0003] [Patent Document 1] Patent No. 7401764 Summary of the Invention [Problem to be solved by the invention]

[0004] The virtualization and large-scale expansion of IT systems has made operations more complex, making it difficult to identify the cause of a failure when it occurs. Even the method described in Patent Document 1 does not necessarily enable flexible identification of the cause of a failure.

[0005] An object of the present disclosure is to provide a failure cause identification support device capable of supporting identification of the cause of a failure in an IT system. [Means for solving the problem]

[0006] In one aspect of the present disclosure, a failure cause identification support device includes: an error message acquisition means for acquiring an error message from the IT system; a configuration information acquisition means for acquiring configuration information of the IT system; a device status acquisition means for acquiring status information of devices constituting the IT system based on the error message and the configuration information; a question generation means for generating a first question including the error message, the configuration information, the status information, and an instruction for instructing analysis of the cause of the error; a response means for inputting the first question sentence into a large-scale language model and obtaining the candidate error causes as a response; Equipped with.

[0007] In another aspect of the present disclosure, a failure cause identification support method includes: A fault cause identification support method executed by a computer, comprising: Retrieve error messages from your IT systems, acquiring configuration information of the IT system; acquiring status information of devices constituting the IT system based on the error message and the configuration information; generating a first query including the error message, the configuration information, the status information, and an instruction for instructing an analysis of the cause of the error; The first question sentence is input to a large-scale language model, and candidates for the error cause are obtained as an answer.

[0008] In yet another aspect of the disclosure, a program includes: Retrieve error messages from your IT systems, acquiring configuration information of the IT system; acquiring status information of devices constituting the IT system based on the error message and the configuration information; generating a first query including the error message, the configuration information, the status information, and an instruction for instructing an analysis of the cause of the error; The first question sentence is input to a large-scale language model, and a computer is caused to execute a process of obtaining candidates for the error cause as an answer. [Effects of the Invention]

[0009] According to the present disclosure, it is possible to assist in identifying the cause of a failure in an IT system. [Brief explanation of the drawings]

[0010] [Figure 1] 1 is a diagram illustrating an overall configuration of a failure cause identification support system according to the present disclosure. [Figure 2] 1 is a block diagram showing a hardware configuration of a failure cause identification support device according to the present disclosure. [Figure 3] 1 is a block diagram showing a functional configuration of a failure cause identification support device according to the present disclosure. [Figure 4] FIG. 10 is an explanatory diagram of processing by a configuration information acquisition unit. [Figure 5] An example of a question is shown below. [Figure 6] An example answer is shown below. [Figure 7] 10 is a flowchart of a failure cause analysis process. [Figure 8] An example of a question sentence in the first modification example is shown below. [Figure 9] An example of a question sentence in the second modification example is shown below. [Figure 10] FIG. 10 is a block diagram showing a functional configuration of another failure cause identification support device according to the present disclosure. [Figure 11] 10 is a flowchart of a process performed by another failure cause identification support device according to the present disclosure. DETAILED DESCRIPTION OF THE INVENTION

[0011] Hereinafter, preferred embodiments of the present disclosure will be described with reference to the drawings.

[0012] First Embodiment [Overall configuration] 1 shows the overall configuration of a failure cause identification support system to which a failure cause identification support device according to the present disclosure is applied. The failure cause identification support system 1 includes a failure cause identification support device 10 and a plurality of devices 20 that constitute an IT system. Note that when distinguishing between individual devices, a subscript is added to the device 20, and when not distinguished, the devices are simply referred to as "device 20." The failure cause identification support device 10 and the devices 20 can communicate with each other via wired or wireless communication.

[0013] When a failure occurs in the device 20, the failure cause identification support device 10 presents candidates for the cause of the failure. Specifically, the failure cause identification support device 10 generates a question for causing a large-scale language model (LLM) such as ChatGPT (registered trademark) to analyze the cause of the failure based on an error message received from the device 20, partial configuration information of the IT system, and the state of the device 20. Then, the failure cause identification support device 10 inputs the question into the LLM and obtains an answer to the question (the cause of the failure) from the LLM.

[0014] As described above, the failure cause identification support device 10 uses LLM to analyze the cause of a failure. This eliminates the need for the failure cause identification support device 10 to define rules for identifying the cause of a failure for each system, and allows the failure cause to be analyzed flexibly.

[0015] The device 20 is a device that constitutes an IT system, such as a container or a virtual machine. When an error occurs on the device 20, the device 20 transmits an error message to the failure cause identification support device 10. For example, when an error occurs in software executed by the device 20a, the device 20a transmits the error message to the failure cause identification support device 10.

[0016] [Hardware configuration] 2 is a block diagram showing the hardware configuration of a failure cause identification support device 10 according to the first embodiment. As shown in the figure, the failure cause identification support device 10 includes an interface (I / F) 11, a processor 12, a memory 13, a recording medium 14, and a database (DB) 15.

[0017] The I / F 11 inputs and outputs data to and from external devices. Specifically, the I / F 11 receives error messages and the like from the device 20.

[0018] The processor 12 is a computer such as a CPU (Central Processing Unit), and controls the entire fault cause identification support device 10 by executing a program prepared in advance. The processor 12 may be a GPU (Graphics Processing Unit), a DSP (Digital Signal Processor), an MPU (MicroProcessing Unit), an FPU (Floating Point number Processing Unit), a PPU (Physics Processing Unit), a TPU (Tensor Processing Unit), a quantum processor, a microcontroller, or a combination of these. The processor 12 executes fault cause analysis processing, which will be described later.

[0019] The memory 13 is configured by a ROM (Read Only Memory), a RAM (Random Access Memory), etc. The memory 13 is also used as a working memory while the processor 12 is executing various processes.

[0020] The recording medium 14 is a non-volatile, non-transitory recording medium such as a disk-shaped recording medium or semiconductor memory, and is configured to be detachable from the failure cause identification support device 10. The recording medium 14 records various programs to be executed by the processor 12. When the failure cause identification support device 10 executes various processes, the programs recorded on the recording medium 14 are loaded into the memory 13 and executed by the processor 12.

[0021] The DB 15 stores data used when the failure cause identification support device 10 executes a failure cause analysis process. For example, the DB 15 stores configuration information of the IT system and the status of the devices that make up the IT system. Instead of the DB 15 storing the status of each device, the processor 12 may receive the status of each device from an external device (not shown) via the I / F 11, or may receive the status from the devices that make up the IT system.

[0022] The display unit 16 is, for example, a liquid crystal display, and displays the analysis results of the cause of the failure. The input unit 17 is, for example, a mouse, a keyboard, and the like, and is used by the administrator of the failure cause identification support device 10 to perform necessary management.

[0023] [Function Configuration] 3 is a block diagram showing the functional configuration of the failure cause identification support device 10 according to the first embodiment. Functionally, the failure cause identification support device 10 includes, in addition to the display unit 16 described above, an error message acquisition unit 101, a configuration information acquisition unit 102, an equipment status acquisition unit 103, a question generation unit 104, a question answering unit 105, a configuration information storage unit 15a, and an equipment status storage unit 15b.

[0024] The configuration information storage unit 15a and the device status storage unit 15b are realized by the DB 15 shown in Fig. 2. The error message acquisition unit 101, the configuration information acquisition unit 102, the device status acquisition unit 103, the question generation unit 104, and the question answering unit 105 are configured by the processor 12 shown in Fig. 2.

[0025] First, the failure cause identification support device 10 receives an error message from the device 20 via the I / F 11. The error message is input to the error message acquisition unit 101. The error message includes the time the error occurred, the content of the error, etc. The error message acquisition unit 101 outputs the received error message to the configuration information acquisition unit 102, the device status acquisition unit 103, and the question generation unit 104.

[0026] The configuration information storage unit 15a stores configuration information of the IT system in advance. The configuration information of the IT system indicates various information related to the devices that make up the IT system. The configuration information acquisition unit 102 extracts configuration information of the devices related to the error (hereinafter also referred to as "partial configuration information") from the configuration information of the IT system based on the error message.

[0027] Specifically, the configuration information storage unit 15a of this embodiment stores configuration information of an IT system as a knowledge graph. The configuration information acquisition unit 102 extracts a knowledge graph of a predetermined range (hereinafter also referred to as a "partial knowledge graph") from the entire knowledge graph based on the source of an error. FIG. 4 is a diagram for explaining the processing of the configuration information acquisition unit 102. FIG. 4(A) shows an example of a knowledge graph stored in the configuration information storage unit 15a. In the knowledge graph of FIG. 4(A), the components of the IT system are represented by nodes, and the relationships between the components are represented by edges. For example, in FIG. 4(A), a directed edge is added from the "Compute-1" node to the "elasticsearch-2" node, and the relationship indicates "HOST" (i.e., that the elasticsearch-2 container is running on the physical machine called Compute-1). Also, in Figure 4(A), a bidirectional edge is added between the “elasticsearch-2” node and the “prometheus-v1” node, indicating that the relationship is “INTERACTS_WITH” (i.e., information is exchanged).

[0028] FIG. 4(B) shows an example of a partial knowledge graph. In FIG. 4(B), it is assumed that the failure cause identification support device 10 receives the error message "elasticsearch-2 got an error." The configuration information acquisition unit 102 acquires a partial knowledge graph that includes components that are within a predetermined number of hops from "elasticsearch-2," which is the source of the error. In FIG. 4(B), the configuration information acquisition unit 102 acquires a partial knowledge graph that includes components that are within one hop from the source of the error.

[0029] The configuration information acquisition unit 102 outputs the partial knowledge graph as partial configuration information to the device status acquisition unit 103. Note that the configuration information acquisition unit 102 may output the entire knowledge graph (i.e., the configuration information of the IT system) as is to the device status acquisition unit 103 instead of the partial knowledge graph, but by using the partial knowledge graph, the cause of the failure can be analyzed more accurately.

[0030] Returning to FIG. 3, the device status storage unit 15b stores the status of each device in advance. The device status is data indicating the operating status of the device, and includes, for example, metrics data such as CPU usage rate, RAM usage rate, amount of transferred data, amount of received data, and message logs such as syslog. The device status acquisition unit 103 acquires the value of each data item from the device status storage unit 15b based on the error message and partial configuration information. It is assumed that it is predetermined which data item value the device status acquisition unit 103 acquires. The device status acquired by the device status acquisition unit 103 (i.e., the value of a specified data item) will hereinafter also be referred to as "status information."

[0031] Specifically, the device status acquisition unit 103 acquires device status information related to the error based on the partial configuration information. The device status acquisition unit 103 may acquire metrics data as predetermined statistical values ​​such as average values, minimum values, and maximum values ​​over a predetermined period. Furthermore, the device status acquisition unit 103 may use multiple predefined log templates for message logs and count the number of message logs that match each template.

[0032] Furthermore, the device status acquisition unit 103 acquires status information at a predetermined time based on the time when the error occurred. For example, the device status acquisition unit 103 may acquire status information at the time closest to the time when the error occurred, or may acquire status information at a time a predetermined period prior to the time when the error occurred.

[0033] The device state acquisition unit 103 outputs the partial configuration information and the state information input from the configuration information acquisition unit 102 to the question generation unit 104 .

[0034] Instead of acquiring the status information from the device status storage unit 15b, the device status acquisition unit 103 may acquire the status information by inquiring about an external data lake in which the device statuses are stored. Alternatively, each device may store its own status information and transmit the status information to the device status acquisition unit 103 in response to a request from the device status acquisition unit 103.

[0035] The question generator 104 generates a question to be input to the LLM based on the error message, partial configuration information, and state information. FIG. 5 shows an example of a question. The question generator 104 generates a question as shown in FIG. 5(B) from the IT system configuration and error message shown in FIG. 5(A). The IT system configuration in FIG. 5(A) includes three physical machines: compute-1, compute-2, and Infra-1, and multiple containers are running on each physical machine.

[0036] The question in FIG. 5(B) includes an input area 51 for partial configuration information and status information, an input area 52 for an error message, and an input area 53 for an instruction statement.

[0037] A partial knowledge graph written in JSON format is input into the input area 51. The input area 51 includes node information 51a related to the nodes of the partial knowledge graph and edge information 51b related to the edges of the partial knowledge graph. The node information 51a in FIG. 5(B) shows, as an example, information related to the "elasticsearch-2" node and information related to the "prometheus-v1" node. Note that the node information 51a also includes state information. For example, the "elasticsearch-2" node includes state information such as the average CPU utilization rate (avg_cpu_util), the average amount of data transferred (avg_bw), and the average latency (avg_latency). The edge information 51b in FIG. 5(B) also shows, as an example, the relationship between the "compute-2" node and the "prometheus-v1" node.

[0038] An error message received from the device 20 is input into the input area 52. A prepared instruction is input into the instruction input area 53. In the instruction input area 53 of Fig. 5(B), an instruction is input, which describes that the top three components that are the root cause of the error should be presented, and that the reason should be explained in one sentence.

[0039] Returning to FIG. 3, the question generation unit 104 outputs the generated question to the question answering unit 105.

[0040] The question answering unit 105 inputs a question to the LLM and obtains a response from the LLM. FIG. 6 shows an example of a response from the LLM. Note that the response in FIG. 6 is assumed to be a response from the LLM to the question in FIG. 5(B). In FIG. 6, "prometheus-v1," "istio-basic-v1," and "elasticsearch-1" are presented as components that are likely to be the root cause of the error, along with reasons for their existence. Note that FIG. 6 lists "prometheus-v1" as the component that is most likely to be the root cause of the error, and the reasons for this include the fact that "prometheus-v1" and "elasticsearch-3" are hosted on the same "compute-2" server, and that a resource conflict occurred between "prometheus-v1" and "elasticsearch-3," which may have affected "elasticsearch-2," which is interacting with "elasticsearch-3."

[0041] Returning to FIG. 3, question answering unit 105 outputs the answer to display unit 16. Display unit 16 displays the answer on a display. By looking at the display, the user can infer the cause of the failure.

[0042] In the above configuration, the error message acquisition unit 101 is an example of an error message acquisition means, the configuration information acquisition unit 102 is an example of a configuration information acquisition means, the device status acquisition unit 103 is an example of a device status acquisition means, the question generation unit 104 is an example of a question generation means, and the question answering unit 105 is an example of a response means.

[0043] [Failure cause analysis processing] Next, the fault cause analysis processing will be explained. Fig. 7 is a flowchart of the fault cause analysis processing by the fault cause identification support device 10. This processing is realized by the processor 12 shown in Fig. 2 executing a program prepared in advance and operating as each element shown in Fig. 3.

[0044] First, the error message acquisition unit 101 acquires an error message from the device 20 (step S11). The error message acquisition unit 101 outputs the error message to the configuration information acquisition unit 102, the device status acquisition unit 103, and the question generation unit 104.

[0045] Next, the configuration information acquisition unit 102 extracts partial configuration information from the configuration information of the IT system based on the error message (step S12). The configuration information acquisition unit 102 outputs the partial configuration information to the device status acquisition unit 103.

[0046] Next, the device status acquisition unit 103 acquires device status information from the device status storage unit 15b based on the error message and the partial configuration information (step S13). The device status acquisition unit 103 outputs the partial configuration information and the status information to the question generation unit 104.

[0047] Next, the question generation unit 104 generates a question to be input to the LLM based on the error message, the partial configuration information, and the state information (step S13). The question includes the partial configuration information, the state information, an error message, and an instruction. The question generation unit 104 outputs the generated question to the question answering unit 105. Next, the question answering unit 105 inputs the question to the LLM and obtains an answer from the LLM (step S14). The question answering unit 105 outputs the answer to the display unit 16. The display unit 16 displays the answer on the display (step S15). Then, the processing ends.

[0048] [Variations] Next, a description will be given of modifications of the first embodiment. The following modifications can be applied to the first embodiment in appropriate combinations.

[0049] (Variation 1) The configuration information acquisition unit 102 may select configuration information that is effective for identifying the cause of the error from the partial configuration information and output it to the device status acquisition unit 103.

[0050] For example, the configuration information acquisition unit 102 can select configuration information effective for identifying the cause of an error by using the LLM. Specifically, the configuration information acquisition unit 102 generates a question to be input to the LLM based on an error message and partial configuration information extracted from the configuration information storage unit 15a. FIG. 8 shows an example of the question. The configuration information acquisition unit 102 inputs an error message, partial configuration information, and the number of components (nodes) to be output into input fields 1 to 3, respectively, to generate a question. The configuration information acquisition unit 102 inputs the generated question to the LLM and acquires configuration information effective for identifying the cause of the error as a response from the LLM. Then, the configuration information acquisition unit 102 outputs the configuration information effective for identifying the cause of the error to the device status acquisition unit 103. Note that the configuration information acquisition unit 102 can also generate a question using configuration information of the IT system instead of partial configuration information.

[0051] As described above, by using configuration information that is effective in identifying the cause of an error in subsequent processing, the cause of the failure can be analyzed more accurately.

[0052] (Variation 2) In the first embodiment, the device status acquisition unit 103 acquires the values ​​of predetermined data items. Alternatively, the device status acquisition unit 103 may select a data item that is effective in identifying the cause of the error and acquire the value of that item.

[0053] For example, by using the LLM, the device status acquisition unit 103 can select data items that are effective in identifying the cause of an error. Specifically, the device status acquisition unit 103 generates a query to be input to the LLM based on the error message and the partial configuration information. FIG. 9 shows an example of the query. The device status acquisition unit 103 inputs the error message, a list of data items that can be acquired from the device status storage unit 15b, and the number of data items to be output into input fields 4 to 6, respectively, to generate the query. The device status acquisition unit 103 inputs the generated query to the LLM and acquires data items that are effective in identifying the cause of the error as a response from the LLM. Then, the device status acquisition unit 103 acquires the values ​​of the data items that are effective in identifying the cause of the error from the device status storage unit 15b, and outputs the values ​​to the query generation unit 104.

[0054] As described above, by using the values ​​of data items that are effective in identifying the cause of the error in subsequent processing, the cause of the failure can be analyzed more accurately.

[0055] Second Embodiment 10 is a block diagram showing the functional configuration of a failure cause identification support device according to the second embodiment. The failure cause identification support device 200 includes an error message acquisition unit 201, a configuration information acquisition unit 202, a device status acquisition unit 203, a question generation unit 204, and a response unit 205.

[0056] 11 is a flowchart of processing by the fault cause identification support device of the second embodiment. The error message acquisition means 201 acquires an error message from an IT system (step S201). The configuration information acquisition means 202 acquires configuration information of the IT system (step S202). The device status acquisition means 203 acquires status information of devices constituting the IT system based on the error message and the configuration information (step S203). The question generation means 204 generates a first question including the error message, the configuration information, the status information, and an instruction statement for instructing analysis of the cause of the error (step S204). The response means 205 inputs the first question into a large-scale language model and acquires candidates for the cause of the error as a response (step S205).

[0057] According to the failure cause identification support device 200 of the second embodiment, it is possible to support identification of the cause of a failure in an IT system.

[0058] A part or all of the above-described embodiments can be described as, but not limited to, the following supplementary notes.

[0059] (Appendix 1) an error message acquisition means for acquiring an error message from the IT system; a configuration information acquisition means for acquiring configuration information of the IT system; a device status acquisition means for acquiring status information of devices constituting the IT system based on the error message and the configuration information; a question generation means for generating a first question including the error message, the configuration information, the status information, and an instruction for instructing analysis of the cause of the error; a response means for inputting the first question sentence into a large-scale language model and obtaining the candidate error causes as a response; A fault cause identification support device comprising:

[0060] (Appendix 2) a configuration information storage means for storing configuration information of the IT system; 2. The fault cause identification support device according to claim 1, wherein the configuration information acquisition means acquires the configuration information from the configuration information storage means.

[0061] (Appendix 3) 3. The fault cause identification support device according to claim 2, wherein the configuration information storage means stores the configuration information of the IT system as a knowledge graph.

[0062] (Appendix 4) The fault cause identification support device according to claim 3, wherein the configuration information acquisition means acquires, as the configuration information, a partial knowledge graph obtained by extracting a predetermined range of the knowledge graph from the knowledge graph based on the error message.

[0063] (Appendix 5) the knowledge graph has nodes that represent components of the IT system and edges that represent relationships between the components; the configuration information acquisition means acquires, from the knowledge graph, a partial knowledge graph including a component that is a source of an error and other components related to the component that is the source of the error; 5. The fault cause identification support device according to claim 4, wherein the other components are components within a predetermined number of hops from the component that is the source of the error.

[0064] (Appendix 6) The fault cause identification support device according to any one of appendices 1 to 5, wherein the configuration information acquisition means inputs a second question sentence, including the error message, the configuration information of the IT system, and an instruction sentence for instructing the output of configuration information effective in identifying the cause of the error, into a large-scale language model, and acquires the configuration information as an answer.

[0065] (Appendix 7) The fault cause identification support device according to any one of appendices 1 to 6, wherein the device status acquisition means inputs a third question sentence, including the error message, the configuration information, and an instruction sentence for instructing output of data items effective in identifying the cause of the error, into a large-scale language model, and acquires the status information based on the data items acquired as a response.

[0066] (Appendix 8) 8. The fault cause identification support device according to claim 1, further comprising a display unit that displays the candidate error causes.

[0067] (Appendix 9) A fault cause identification support method executed by a computer, comprising: Retrieve error messages from your IT systems, acquiring configuration information of the IT system; acquiring status information of devices constituting the IT system based on the error message and the configuration information; generating a first query including the error message, the configuration information, the status information, and an instruction for instructing an analysis of the cause of the error; A fault cause identification support method that inputs the first question sentence into a large-scale language model and obtains candidates for the error cause as an answer.

[0068] (Appendix 10) Retrieve error messages from your IT systems, acquiring configuration information of the IT system; acquiring status information of devices constituting the IT system based on the error message and the configuration information; generating a first query including the error message, the configuration information, the status information, and an instruction for instructing an analysis of the cause of the error; a program that causes a computer to execute a process of inputting the first question sentence into a large-scale language model and obtaining candidates for the error cause as an answer;

[0069] Although the present disclosure has been described above with reference to the embodiments and examples, the present disclosure is not limited to the above-described embodiments and examples. Various modifications that can be understood by a person skilled in the art can be made to the configuration and details of the present disclosure within the scope of the present disclosure. [Explanation of symbols]

[0070] 1. Fault Cause Identification Support System 10. Fault Cause Identification Support Device 15 Database (DB) 15a Configuration information storage unit 15b Device status memory section 16 Display 20 equipment 101 Error message acquisition section 102 Configuration information acquisition unit 103 Device status acquisition unit 104 Question generation section 105 Question and Answer Section

Claims

1. an error message acquisition means for acquiring an error message from the IT system; a configuration information acquisition means for acquiring configuration information of the IT system; a device status acquisition means for acquiring status information of devices constituting the IT system based on the error message and the configuration information; a question generation means for generating a first question including the error message, the configuration information, the status information, and an instruction for instructing an analysis of the cause of the error; a response means for inputting the first question sentence into a large-scale language model and obtaining the candidate error causes as a response; A fault cause identification support device comprising:

2. a configuration information storage means for storing configuration information of the IT system; 2. The fault cause identification support device according to claim 1, wherein said configuration information acquisition means acquires said configuration information from said configuration information storage means.

3. 3. The fault cause identification support device according to claim 2, wherein the configuration information storage means stores the configuration information of the IT system as a knowledge graph.

4. 4. The fault cause identification support device according to claim 3, wherein the configuration information acquisition means acquires, as the configuration information, a partial knowledge graph obtained by extracting a predetermined range of the knowledge graph from the knowledge graph based on the error message.

5. the knowledge graph has nodes that represent components of the IT system and edges that represent relationships between the components; the configuration information acquisition means acquires, from the knowledge graph, a partial knowledge graph including a component that is a source of an error and other components related to the component that is the source of the error; 5. The fault cause identification support device according to claim 4, wherein the other component is a component located within a predetermined number of hops from the component that is the source of the error.

6. 2. The fault cause identification support device according to claim 1, wherein the configuration information acquisition means inputs a second question sentence, which includes the error message, the configuration information of the IT system, and an instruction sentence for instructing the output of configuration information that is effective in identifying the cause of the error, into a large-scale language model, and acquires the configuration information as an answer.

7. 2. The fault cause identification support device according to claim 1, wherein the device status acquisition means inputs a third question sentence, including the error message, the configuration information, and a directive sentence for instructing output of data items effective in identifying the cause of the error, into a large-scale language model, and acquires the status information based on the data items acquired as the answer.

8. 2. The fault cause identification support device according to claim 1, further comprising a display means for displaying the candidate error causes.

9. A fault cause identification support method executed by a computer, comprising: Retrieving error messages from IT systems Acquire configuration information of the IT system; acquiring status information of devices constituting the IT system based on the error message and the configuration information; generating a first query including the error message, the configuration information, the status information, and an instruction for instructing analysis of the cause of the error; A fault cause identification support method that inputs the first question sentence into a large-scale language model and obtains candidates for the error cause as an answer.

10. Retrieving error messages from IT systems Acquire configuration information of the IT system; acquiring status information of devices constituting the IT system based on the error message and the configuration information; generating a first query including the error message, the configuration information, the status information, and an instruction for instructing analysis of the cause of the error; a program that causes a computer to execute a process of inputting the first question sentence into a large-scale language model and obtaining candidates for the error cause as an answer;

Images