RAG-Based Generative AI Incident Remediation From Logs
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing IT service systems face challenges in efficiently identifying the causes of incidents and deriving remedial actions due to increased system complexity and vendor diversity, leading to prolonged operational costs and reduced reliability.
Innovation Solution
A processor-implemented method using retrieval-augmented generation (RAG) with large language models (LLM) to analyze system logs, generate responses, and provide remedial actions, with secondary inquiries to enhance accuracy and handle private information through obfuscation.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Loss of time
If operators manually analyze system logs to identify incident causes and derive remedial actions, then accuracy in incident response can be maintained, but the time required and operational costs increase significantly
Solution Approach 1:
The system enables self-service incident response by automatically analyzing system logs and generating remedial actions through LLMs without requiring manual operator intervention. The automated incident response system processes logs, identifies causes, and derives solutions independently, reducing both time consumption and operational costs while maintaining response reliability.
Solution Approach 2:
The patent replaces the mechanical manual analysis process with an automated AI-based system. Instead of operators manually reviewing logs and deriving actions, the system uses LLMs to automatically process log data, identify incident causes, and generate remedial actions, thereby eliminating the time-consuming manual mechanism.
2Measurement precision
If multiple LLMs are used to enhance response accuracy, then the quality of incident analysis improves, but the system complexity increases
Solution Approach 1:
The system segments the incident response task across multiple specialized LLMs, where each model handles specific aspects of analysis. This segmentation allows each LLM to focus on particular functions (e.g., log analysis, cause identification, remedial action generation), improving overall accuracy while maintaining manageable complexity through functional division.
Solution Approach 2:
The patent implements a multi-functional LLM architecture where different language models can be selectively deployed based on incident type and complexity. The system provides universal capability to handle various incident scenarios while maintaining flexibility to simplify the system by using only necessary models for each specific case, avoiding unnecessary complexity.
3Adaptability or versatility
If private information is included in log analysis, then comprehensive incident analysis can be performed, but security risks increase
Solution Approach 1:
The system introduces an intermediary processing layer that sits between the raw log data and the LLM analysis. This intermediary component filters, anonymizes, and sanitizes private information before it reaches the LLMs, allowing comprehensive analysis to proceed while preventing sensitive data from being processed or leaked by the AI models.
Solution Approach 2:
The patent extracts and removes private information from the log data before it is input to the LLMs for analysis. By separating sensitive data from the analysis process, the system maintains the ability to perform comprehensive incident analysis on the remaining data while eliminating security risks associated with processing private information through the AI models.
Data Source
AI summary
A processor implemented method including monitoring an event in a system, analyzing a log of the event to determine whether the event is a system incident, searching, responsive to the event being determined to be a system incident event, an internal knowledge base for causes of the system incident event and remedial actions for the system incident event, based on retrieval-augmented generation, prompting a first inquiry, the first inquiry including the log and a search result from the searching to a first LLM, and generating a first response including remedial actions for the system incident event by the first LLM, based on the first inquiry and the search result.