Deep-learning-based method and system for root cause localization in cloud platform alert scenarios

Abstract

The present invention relates to the technical field of artificial intelligence, and in particular to a deep-learning-based method and system for root cause localization in cloud platform alert scenarios. The method comprises the following steps: acquiring cloud platform alert information, alert resource information, resource log information, and alert processing historical information. The beneficial effects are as follows: in the deep-learning-based method and system for root cause localization in cloud platform alert scenarios provided in the present invention, on the basis of collected cloud platform alert information, resource information, log information, etc., different alert scenarios are formed by means of alert clustering; for each alert scenario, the range for log analysis is determined, an association with resources and an association with logs are deeply analyzed, a final fault cause is identified; and for different alert scenarios, descriptions of the fault causes, key alert information, etc., are provided. In this way, scenario-based management is performed on alert, and more accurate problem localization is provided, thereby effectively shortening the period of time for operation and maintenance personnel to locate problems, improving the efficiency, and better ensuring the normal operation of a cloud platform.

Description

A method and system for cloud platform alarm scene root cause positioning based on deep learning

[0001] The present application claims priority to the Chinese patent application No. 202410877041.2, filed on July 2, 2024, and entitled "A method and system for cloud platform alarm scene root cause positioning based on deep learning", the whole content of which is incorporated herein by reference. TECHNICAL FIELD

[0002] The present application relates to the field of artificial intelligence, in particular to a method and system for cloud platform alarm scene root cause positioning based on deep learning. BACKGROUND

[0003] With the development of information technology and cloud computing, the business requirements are constantly changing, and the cluster size of the cloud platform and the services running on the cluster are also increasing.

[0004] At the same time, with the widespread application of container technology and micro-service architecture, the number of resources to be monitored has increased dramatically, and the uncertainty is increasing. Especially when used with a coordinator such as kubernetes, the lifetime of the resource can be very short, making it more difficult to track, and the complexity and distribution of the environment are increasing.

[0005] When the environment has a problem, a large number of alarms may occur in a short period of time, and if the most critical problem cannot be found in time, it may cause huge losses to the business. SUMMARY

[0006] The present application aims to provide a method and system for cloud platform alarm scene root cause positioning based on deep learning to solve the problems raised in the background.

[0007] To achieve the above-mentioned purpose, the present application provides the following technical solution: a method for cloud platform alarm scene root cause positioning based on deep learning, the method comprising the following steps:

[0008] Obtain cloud platform alarm information, alarm resource information, resource log information, and alarm processing history information, and unify and format the above alarm-related information;

[0009] Cluster the processed data using the k-means method, and divide the clustering results into different scenes;

[0010] Extract and preprocess the alarm-related resources and log data of each alarm scene, perform word-to-vector processing, and convert them into digital representations;

[0011] The processed vector data is analyzed by using an LSTM-CNN deep neural network model to obtain abnormal description and root cause under each alarm scene, and the key alarm of the scene is recommended according to the corresponding resource of the abnormality.

[0012] Preferably, the specific operation of clustering the processed data by using the k-means method comprises:

[0013] The alarm time series curve of the cloud platform is collected as a training set, and clustering analysis is performed on the training set to find common information in the training data, thereby reducing the influence of outliers and noise on data analysis;

[0014] The time series curve of the cloud platform is collected as a training set, and the curve data is composed of alarm data at the alarm occurrence time point and alarm data at the n time points before the alarm occurrence, so the time series curve contains n+1 time points;

[0015] The alarm data is uniformly formatted, and the information of the resource is added;

[0016] The training set data is clustered and analyzed to analyze the common information in the training data and automatically classify;

[0017] While analyzing the common information, noise and irrelevant samples are filtered out, thereby improving the data analysis effect and reducing the algorithm running time;

[0018] According to the clustering result, the analysis result of each cluster is processed to find the regularity information of alarm occurrence, thereby determining the alarm scene and performing persistence.

[0019] Preferably, the specific operation of feature extraction and preprocessing of the alarm associated resource and log data of each alarm scene comprises:

[0020] Real-time collection of logs is performed by using a log collection agent, and there are two ways to configure log collection on the agent, one is to configure the path, and the other is to configure the log listening port; the original log content of the resource is obtained in two ways of active collection and passive reception, and these logs are divided into system logs, service logs, platform logs, etc. according to different sources; finally saved in the log index; the log agent used is fluentd;

[0021] For the persisted alarm scene, the alarm related resources are analyzed by traversing the alarm list, the related system logs, service logs and platform logs of each alarm resource in the alarm statistical time end are obtained, and the metadata information of the resource such as resource name, resource host and ip information is added to form the pre-analysis original log;

[0022] The original log is effectively segmented by using a segmentation technology, and the Chinese log is effectively segmented by using open source segmentation software; the segmentation software of the application is jieba segmentation;

[0023] The log after the segmentation processing is subjected to word vector conversion, the log event is converted into a digital vector representation, and a word2vec algorithm is used;

[0024] The log event after the digital vector representation is subjected to a clustering operation by using a single-pass algorithm;

[0025] Each sample after clustering is learned by using an LSTM-CNN, alarm association information is formed, the log event encoded by using a number is input into a neural network model based on LSTM-CNN for evaluation and optimization, the results of the above clustering are used as an initial knowledge base, new logs are continuously added for learning, the knowledge base is continuously adjusted, and the knowledge base is associated with an alarm scene;

[0026] Whether the log in the next time sequence is an abnormal log is evaluated by using the trained neural network model, the alarm is traced according to the abnormal log, and a fault point and a key alarm are judged.

[0027] Preferably, a preliminary alarm scene and a knowledge base model are formed, each alarm scene contains a series of alarms, key alarms, root cause descriptions of the key alarms, and related alarm resources and knowledge base contents; the above model is trained and optimized through historical data; the system is connected to a cloud platform, and the alarm of the cloud platform is subjected to scene root cause positioning in real time.

[0028] A cloud platform alarm scene root cause positioning system based on deep learning, the system is composed of an information acquisition module, a data clustering module, a data preprocessing module and an alarm module;

[0029] The information acquisition module acquires cloud platform alarm information, alarm resource information, resource log information and historical information of alarm processing, and uniformly formats the above alarm related information;

[0030] The data clustering module clusters the processed data by using a k-means method, and divides the clustering results into different scenes;

[0031] The data preprocessing module respectively extracts and preprocesses the alarm associated resources and log data of each alarm scene, performs word vector processing, and converts into a digital representation;

[0032] The alarm module learns and analyzes the processed vector data by using an LSTM-CNN deep neural network model, obtains abnormal descriptions and root causes in each alarm scene, and recommends key alarms of the scene according to the corresponding resources of the abnormality.

[0033] Preferably, the data clustering module collects the alarm time series curve of the cloud platform as a training set, performs clustering analysis on the training set to find common information in the training data, thereby reducing the influence of outliers and noise on data analysis;

[0034] The time series curve of the cloud platform is collected as a training set, and the curve data is composed of alarm data at the alarm occurrence time point and alarm data at the n time points before the alarm occurrence, so the time series curve contains n+1 time points;

[0035] Uniformly format the alarm data and increase the information of the resource;

[0036] Perform clustering analysis on the training set data, analyze the common information in the training data, and automatically classify;

[0037] While analyzing the common information, filter out noise and irrelevant samples, thereby improving the data analysis effect and reducing the algorithm running time;

[0038] According to the clustering results, process the analysis results of each cluster to find the regularity information of alarm occurrence, thereby determining the alarm scene and performing persistence.

[0039] Preferably, the data preprocessing module collects logs in real time through a log collection agent. There are two ways to configure log collection on the agent, one is to configure the path, and the other is to configure the log listening port. Corresponding to the two ways of active collection and passive reception, the original log content of the resource is obtained, and these logs are divided into system logs, service logs, platform logs, etc. according to different sources. Finally, it is saved in the log index. The log agent used is fluentd;

[0040] For the persisted alarm scene, the alarm list is traversed to analyze the alarm-related resources, and the related system logs, service logs, and platform logs of each alarm resource within the alarm statistical time end are obtained, and the metadata information of the resource is added, such as the resource name, the host where the resource is located, and the ip information, to form the pre-analysis original log;

[0041] Use the word segmentation technology to effectively segment the above original log. Chinese log uses open source segmentation software for effective segmentation. The segmentation software of the present application is jieba segmentation;

[0042] The word vector conversion is used for the log after the word segmentation processing, the log event is converted into a digital vector representation, and the word2vec algorithm is used;

[0043] The single-pass algorithm is used for clustering operation for the log event after the digital vector representation;

[0044] Using LSTM-CNN to learn each sample after clustering, forming alarm association information, using digitally encoded log events into LSTM-CNN based neural network model for evaluation and optimization, using the above clustering results as an initial knowledge base, constantly adding new logs for learning, constantly adjusting the knowledge base, and associating the knowledge base to the alarm scene;

[0045] Using the trained neural network model to evaluate whether the log in the next time sequence is an abnormal log, tracing the alarm according to the abnormal log, and determining the fault point and key alarm.

[0046] Preferably, the alarm module forms a preliminary alarm scene and a knowledge base model, each alarm scene contains a series of alarms, key alarms, root cause description of key alarms and related alarm resources and knowledge base content; the above model is trained and optimized through historical data; the system is connected to the cloud platform, and the alarm of the cloud platform is scene root cause positioning in real time.

[0047] Compared with the prior art, the beneficial effects of the present application are:

[0048] The method and system for cloud platform alarm scene root cause positioning based on deep learning provided by the present application form different alarm scenes through alarm clustering according to the collected cloud platform alarm information, resource information, log information, etc., lock the range of log analysis for each alarm scene, deeply analyze the association of resources and logs, identify the final fault cause, and give a description of the fault cause, key alarm information, etc. for different alarm scenes. This way can manage the alarm in the scene, provide more accurate problem positioning, effectively reduce the time of operation and maintenance personnel to locate the problem, improve the efficiency, and better ensure the normal operation of the cloud platform. BRIEF DESCRIPTION OF DRAWINGS

[0049] Fig. 1 is a flow chart of the method of the present application. DETAILED DESCRIPTION

[0050] In order to make the purpose, technical scheme of the present application clear, complete and the advantages more clear and obvious, the embodiments of the present application are further described in detail below in combination with the drawings. It should be understood that the specific embodiments described herein are part of the embodiments of the present application, not all embodiments, and are only used to explain the embodiments of the present application, and do not limit the embodiments of the present application. All other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0051] Embodiment one

[0052] Please refer to Figure 1, the present application provides a technical solution: a cloud platform alarm scene root cause positioning method based on deep learning, the method comprises the following steps:

[0053] Step one, collect the alarm time series curve of the cloud platform as the training set, and perform cluster analysis (such as K-means clustering algorithm) on the training set to find common information in the training data, thereby reducing the influence of outliers and noise on data analysis.

[0054] Collect the time series curve of the cloud platform as the training set, and the curve data is composed of alarm data at the alarm occurrence time point and alarm data at the n time points before the alarm occurrence, so the time series curve contains n+1 time points;

[0055] Uniformly format the alarm data, and increase the information of the resources, and the formatted data model is simple as follows:

[0056] Perform cluster analysis (the present application adopts K-means algorithm) on the training set data, analyze the common information in the training data, and automatically classify;

[0057] While analyzing the common information, filter out noise and irrelevant samples, thereby improving the data analysis effect and reducing the algorithm running time;

[0058] According to the clustering result, process the analysis result of each cluster to find the regularity information of alarm occurrence, so as to determine the alarm scene and perform persistence.

[0059] Step two, pre-process the historical logs of the alarm related resources of different alarm scenes;

[0060] Real-time collection of logs is through a log collection agent, and there are two ways to configure log collection on the agent, one is to configure the path (such as the syslog of the system and the log path of the service), and the other is to configure the log listening port; Corresponding to the two ways of active collection and passive reception, the original log content of the resources is obtained, and these logs are divided into system logs, service logs, platform logs, etc. according to different sources; Finally saved in the log index; The log agent used in the present application is fluentd;

[0061] For the persisted alarm scene, the alarm list is traversed to analyze the alarm related resources, the related system logs, service logs, platform logs, etc. of each alarm resource in the alarm statistical time end are obtained, and the metadata information of the resources such as resource name, resource host, ip, etc. is added, forming the pre-analysis original log;

[0062] The original log is effectively segmented by using a segmentation technology, and the Chinese log is effectively segmented by using open source segmentation software; the segmentation software of the application is jieba segmentation;

[0063] The log after the segmentation processing is converted by using a word vector, and the log event is converted into a digital vector representation; the application uses a word2vec algorithm;

[0064] The log event after the digital vector representation is clustered by using a single-pass algorithm, and the operation is as follows:

[0065] The first sample does not need to calculate the similarity, and is directly taken as the first cluster;

[0066] The second sample needs to calculate the similarity with a cluster, if the similarity with the first sample is calculated, the second sample is classified into the same cluster, otherwise, the second sample forms a cluster; the cosine similarity is selected for the similarity calculation;

[0067] The third sample needs to calculate the similarity with each cluster, if the similarity with a cluster is calculated, the calculation is stopped, and the third sample is classified into the cluster, otherwise, the third sample forms a cluster; and the operation is continued in this way;

[0068] Each cluster calculated can be regarded as a classification, and after the clustering, a plurality of classifications can be obtained, and can also be regarded as a plurality of log events.

[0069] The LSTM-CNN is used to learn each sample after the clustering, and the alarm correlation information is formed; the log event encoded by using the number is input into the neural network model based on the LSTM-CNN for evaluation and optimization, the results of the clustering are used as an initial knowledge base, new logs are continuously added for learning, and the knowledge base is continuously adjusted. The knowledge base is associated with the alarm scene;

[0070] The trained neural network model is used to evaluate whether the log in the next time sequence is an abnormal log, the alarm is traced according to the abnormal log, the fault point (such as the host and IP information in the alarm log source log record, and the log content is traced to the corresponding platform virtual machine, and the specific component is determined according to the fault information) and the key alarm are determined;

[0071] Step three, after the above two steps, a preliminary alarm scene and a knowledge base model are formed, each alarm scene includes a series of alarms, key alarms, root cause descriptions of the key alarms, related alarm resources and knowledge bases and the like;

[0072] Step four, the above model is trained and optimized by using historical data;

[0073] Step five, the system is connected to a cloud platform, and the alarm of the cloud platform is positioned in a scene and a root cause in real time.

[0074] Embodiment Two

[0075] On the basis of Embodiment One, a system of a method for cloud platform alarm scene root cause positioning based on deep learning, the system is composed of an information acquisition module, a data clustering module, a data preprocessing module, and an alarm module;

[0076] The information acquisition module acquires cloud platform alarm information, alarm resource information, resource log information, and alarm processing history information, and uniformly formats the above alarm-related information;

[0077] The data clustering module clusters the processed data using the k-means method, and divides the clustering results into different scenes; the alarm time series curve of the cloud platform is collected as a training set, and clustering analysis is performed on the training set to find common information in the training data, thereby reducing the influence of outliers and noise on data analysis;

[0078] The time series curve of the cloud platform is collected as a training set, and the curve data is composed of alarm data at the alarm occurrence time point and alarm data at the n time points before the alarm occurrence, so the time series curve contains n+1 time points;

[0079] The alarm data is uniformly formatted, and the information of the resource is added;

[0080] The training set data is clustered and analyzed to analyze the common information in the training data and automatically classify;

[0081] While analyzing the common information, noise and irrelevant samples are filtered out, thereby improving the data analysis effect and reducing the algorithm running time;

[0082] According to the clustering results, the analysis results of each cluster are processed to find the regularity information of alarm occurrence, thereby determining the alarm scene and persisting.

[0083] The data preprocessing module extracts and preprocesses the alarm-related resources and log data of each alarm scene, performs word-to-vector processing, and converts them into digital representations; real-time log collection is performed through a log collection agent, and there are two ways to configure log collection on the agent, one is to configure the path, and the other is to configure the log listening port; the original log content of the resources is obtained in two ways of active collection and passive reception, and these logs are divided into system logs, service logs, platform logs, etc. according to different sources; finally saved in the log index; the log agent used is fluentd;

[0084] For the alarm scene after persistence, the alarm list is traversed to analyze the alarm related resources, the relevant system logs, service logs and platform logs of each alarm resource in the alarm statistics time end are respectively acquired, and the metadata information of the resources such as resource name, resource host and IP information is added to form the pre-analysis original logs;

[0085] The original logs are effectively segmented by using a segmentation technology, the Chinese logs are effectively segmented by using an open source segmentation software, and the segmentation software of the application is jieba segmentation;

[0086] The segmented logs are converted into word vectors, the log events are converted into digital vectors, and a word2vec algorithm is used;

[0087] The log events represented by the digital vectors are clustered by using a single-pass algorithm;

[0088] Each sample after clustering is learned by using an LSTM-CNN, alarm correlation information is formed, the log events encoded by using numbers are input into a neural network model based on LSTM-CNN for evaluation and optimization, the clustering results are used as an initial knowledge base, new logs are continuously added for learning, the knowledge base is continuously adjusted, and the knowledge base is associated with the alarm scene;

[0089] Whether the logs in the next time sequence are abnormal logs is evaluated by using the trained neural network model, the alarm is traced according to the abnormal logs, the fault point and the key alarm are judged.

[0090] An alarm module uses an LSTM-CNN deep neural network model to learn and analyze the processed vector data, obtains abnormal descriptions and root causes under each alarm scene, and recommends key alarms of the scene according to the corresponding resources of the abnormality, forms a preliminary alarm scene and a knowledge base model, each alarm scene includes a series of alarms, key alarms, root cause descriptions of the key alarms, related alarm resources and knowledge base contents, the model is trained and optimized through historical data, and the system is connected to a cloud platform to perform scene root cause positioning on the alarms of the cloud platform in real time.

[0091] Although the embodiments of the application have been shown and described, it can be understood by those of ordinary skill in the art that various changes, modifications, replacements and variations can be made to the embodiments without departing from the principles and spirits of the application, and the scope of the application is defined by the appended claims and their equivalents.

Claims

1. A method for cloud platform alarm scene root cause positioning based on deep learning, characterized in that: The method comprises the following steps: Obtain cloud platform alarm information, alarm resource information, resource log information, and historical information of alarm processing, and uniformly format the above alarm-related information; Cluster the processed data using the k-means method, and divide the clustering results into different scenes; Extract and preprocess the features of the alarm-related resources and log data of each alarm scene, perform word-to-vector processing, and convert them into digital representations; Use the LSTM-CNN deep neural network model to analyze the processed vector data, obtain the abnormal description and root cause under each alarm scene, and recommend the key alarms of the scene according to the corresponding resources.

2. The method of claim 1, wherein the method is based on a deep learning cloud platform alarm scene root cause positioning. The specific operation of clustering the processed data using the k-means method comprises: Collect the alarm time series curve of the cloud platform as the training set, and perform clustering analysis on the training set to find the common information in the training data, thereby reducing the influence of outliers and noise on data analysis; Collect the time series curve of the cloud platform as the training set, and the curve data is composed of alarm data at the alarm occurrence time point and alarm data at the n time points before the alarm occurrence, so the time series curve contains n+1 time points; Format the alarm data uniformly and add the resource information; Perform clustering analysis on the training set data, analyze the common information in the training data, and automatically classify them; While analyzing the common information, filter out noise and irrelevant samples, thereby improving the data analysis effect and reducing the algorithm running time; According to the clustering results, process the analysis results of each cluster to find the regularity information of alarm occurrence, thereby determining the alarm scene and performing persistence.

3. The method of claim 1, wherein the method is based on a deep learning cloud platform alarm scene root cause positioning. The specific operation of extracting and preprocessing the features of the alarm-related resources and log data of each alarm scene comprises: Real-time log collection is performed through a log collection agent, and there are two ways to configure log collection on the agent, one is to configure the path, and the other is to configure the log listening port; the original log content of the resource is obtained in active collection and passive reception modes, and the logs are divided into system logs, service logs, platform logs, etc. according to different sources; finally, they are saved in a log index; the log agent used is fluentd; For the persistent alarm scene, the alarm list is traversed to analyze the alarm-related resources, the relevant system logs, service logs, and platform logs of each alarm resource within the alarm statistical time period are obtained, and the metadata information of the resource, such as the resource name, the host where the resource is located, and the IP information, is added to form the pre-analyzed original logs; Use the word segmentation technology to effectively segment the above original logs, use the open source word segmentation software to effectively segment the Chinese logs, and the word segmentation software used in the application is jieba; Perform word-to-vector conversion on the logs processed by word segmentation, convert the log events into digital vector representations, and use the word2vec algorithm; Perform clustering operation on the log events represented by digital vectors using the single-pass algorithm; Using LSTM-CNN to learn each sample after clustering, forming alarm association information, using digitally encoded log events to input into the LSTM-CNN-based neural network model for evaluation and optimization, using the above clustering results as the initial knowledge base, constantly adding new logs for learning, constantly adjusting the knowledge base, and associating the knowledge base to the alarm scene; Using the trained neural network model to evaluate whether the logs in the next time sequence are abnormal logs, and tracing the alarm according to the abnormal logs to determine the fault point and key alarm.

4. The method of claim 1, wherein the method is based on a deep learning cloud platform alarm scene root cause positioning. Also includes: Forming a preliminary alarm scene and knowledge base model, each alarm scene containing a series of alarms, key alarms, root cause descriptions of key alarms, and related alarm resources and knowledge base content; training and optimizing the above model through historical data; connecting the system to the cloud platform to real-time scene root cause positioning of the cloud platform alarms.

5. The system of cloud platform alarm scene root cause positioning based on deep learning according to any one of claims 1-4, characterized in that: The system is composed of an information acquisition module, a data clustering module, a data preprocessing module, and an alarm module; The information acquisition module acquires cloud platform alarm information, alarm resource information, resource log information, and historical information of alarm processing, and formats the above alarm-related information uniformly; The data clustering module clusters the processed data using the k-means method and divides the clustering results into different scenes; The data preprocessing module extracts and preprocesses the alarm associated resources and log data of each alarm scene, performs word-to-vector processing, and converts it into a digital representation; The alarm module uses the LSTM-CNN deep neural network model to analyze the processed vector data, obtains the abnormal description and root cause of each alarm scene, and recommends the key alarms of the scene according to the corresponding resources. 6.The system for cloud platform alarm scenario root cause localization based on deep learning according to claim 5, characterized in that: The data clustering module collects the alarm time series curve of the cloud platform as the training set, and performs clustering analysis on the training set to find common information in the training data, thereby reducing the influence of outliers and noise on data analysis; Collecting the time series curve of the cloud platform as the training set, the curve data is composed of alarm data at the alarm occurrence time point and alarm data at the previous n time points, so the time series curve contains n+1 time points; Uniformly format the alarm data and add resource information; Cluster analysis of training set data, analyze common information in training data and automatically classify; While analyzing common information, filter out noise and irrelevant samples to improve data analysis effect and reduce algorithm running time; According to the clustering results, process each cluster analysis result to find the regularity information of alarm occurrence, thereby determining the alarm scene and persisting it.

7. The system for cloud platform alarm scene root cause positioning based on deep learning according to claim 5, characterized in that: The data preprocessing module, real-time log collection is through log collection agent, there are two kinds of log collection methods on the agent, one is to configure the path, the other is to configure the log listening port; The original log contents are acquired in correspondence with the active collection and passive reception of resources, and the logs are divided into system logs, service logs, platform logs and the like according to different sources; the logs are finally saved in a log index; and a log agent used is fluentd; For the alarm scene after the persistence, the alarm list is traversed to analyze the alarm-related resources, the relevant system logs, service logs and platform logs of each alarm resource in the time end of the alarm statistics are acquired, and the metadata information of the resources, such as the resource name, the host where the resource is located and the IP information, is added to form the pre-analyzed original logs; The above original logs are effectively segmented by using a segmentation technology, the Chinese logs are effectively segmented by using an open source segmentation software, and the segmentation software of the application is jieba segmentation; The logs after the segmentation processing are converted by using a word vector, the log events are converted into digital vector representations, and a word2vec algorithm is used; The log events after the digital vector representation are operated by using a single-pass algorithm for clustering; Each sample after the clustering is learned by using an LSTM-CNN to form alarm correlation information, the log events encoded by using numbers are input into a neural network model based on the LSTM-CNN for evaluation and optimization, the results of the above clustering are used as an initial knowledge base, new logs are continuously added for learning, the knowledge base is continuously adjusted, and the knowledge base is related to the alarm scene; The trained neural network model is used to evaluate whether the logs in the next time sequence are abnormal logs, the alarm is traced according to the abnormal logs, the fault point and the key alarm are judged, and the alarm module forms a preliminary alarm scene and a knowledge base model. 8.The system for cloud platform alarm scenario root cause localization based on deep learning of claim 5, wherein: The alarm module forms a preliminary alarm scene and a knowledge base model, each alarm scene contains a series of alarms, key alarms, root cause descriptions of the key alarms, related alarm resources and knowledge base contents, the above model is trained and optimized through historical data, and the system is connected to a cloud platform to perform scene root cause positioning on the alarms of the cloud platform in real time.

Images