CN114595135A

CN114595135A - Log data processing method, device, equipment, storage medium and program product

Info

Publication number: CN114595135A
Application number: CN202210246829.4A
Authority: CN
Inventors: 章琬苓
Original assignee: Guangdong Oppo Mobile Telecommunications Corp Ltd
Current assignee: Guangdong Oppo Mobile Telecommunications Corp Ltd
Priority date: 2022-03-14
Filing date: 2022-03-14
Publication date: 2022-06-07

Abstract

The application discloses a log data processing method, a device, equipment, a storage medium and a program product, and belongs to the technical field of computers. The method comprises the steps of acquiring second log data corresponding to each time period from first log data of target equipment based on a plurality of time periods; determining a first operation state parameter corresponding to the target equipment in each time period based on the second log data corresponding to each time period; determining a target time period from a plurality of time periods based on the first operating state parameter corresponding to each time period; and determining an application program with an exception in the plurality of application programs based on the second log data corresponding to the target time period. The method comprises the steps of firstly carrying out coarse-grained processing on the log data in each time period, finding out the time period possibly with abnormality, and then carrying out fine-grained processing on the log data in the time period, finding out the application program with abnormality, so that the processing amount of log data processing is reduced, and the processing efficiency of the log data is improved.

Description

Log data processing method, device, equipment, storage medium and program product

Technical Field

The present application relates to the field of computer technologies, and in particular, to a method, an apparatus, a device, a storage medium, and a program product for processing log data.

Background

With the continuous development of computer technology, more and more applications can be installed in the electronic device, and in order to effectively grasp the operating status of each application, a buried point can be set in the system of the electronic device, and the operating status of each application can be acquired through the buried point, and corresponding log data can be generated.

In the related art, each piece of generated log data is analyzed, so that each application program can be diagnosed to determine whether the application program is normally operated or abnormally operated.

Because the daily log data of the electronic device is huge, the above scheme also needs huge amount of log data to be analyzed, thereby resulting in slower analysis processing speed and lower analysis processing efficiency.

Disclosure of Invention

The embodiment of the application provides a log data processing method, a log data processing device, log data processing equipment, a log data storage medium and a log data processing program product, and the log data processing efficiency can be improved. The technical scheme is as follows:

in one aspect, a log data processing method is provided, where the method includes:

acquiring second log data corresponding to each time period from first log data of a target device on the basis of a plurality of time periods, wherein the first log data is used for recording the running states of a plurality of application programs installed on the target device;

determining a first operation state parameter corresponding to the target equipment in each time period based on the second log data corresponding to each time period, wherein the first operation state parameter is used for representing the overall operation state of the target equipment;

determining a target time period from the plurality of time periods based on the first operation state parameter corresponding to each time period, wherein the state represented by the first operation state parameter corresponding to the target time period is inferior to the state represented by the first operation state parameter corresponding to the time periods except for the target time period;

and determining an abnormal application program in the plurality of application programs based on the second log data corresponding to the target time period.

In another aspect, there is provided a log data processing apparatus, the apparatus including:

the system comprises a first acquisition module, a second acquisition module and a first display module, wherein the first acquisition module is used for acquiring second log data corresponding to each time period from first log data of a target device based on a plurality of time periods, and the first log data is used for recording the running states of a plurality of application programs installed on the target device;

a first determining module, configured to determine, based on the second log data corresponding to each time period, a first operating state parameter corresponding to the target device in each time period, where the first operating state parameter is used to represent an overall operating state of the target device;

a second determining module, configured to determine a target time period from the multiple time periods based on the first operating state parameter corresponding to each time period, where a state represented by the first operating state parameter corresponding to the target time period is inferior to a state represented by the first operating state parameter corresponding to a time period other than the target time period in the multiple time periods;

and a third determining module, configured to determine, based on second log data corresponding to the target time period, an application program with an exception in the plurality of application programs.

In another aspect, an electronic device is provided, where the electronic device includes a processor and a memory, and the memory stores at least one program code, and the at least one program code is loaded and executed by the processor to implement the log data processing method.

In another aspect, a computer-readable storage medium is provided, in which at least one program code is stored, and the at least one program code is loaded and executed by a processor to implement the log data processing method described above.

In another aspect, a computer program product is provided, where at least one program code is stored, and the at least one program code is loaded and executed by a processor to implement the log data processing method described above.

The technical scheme provided by the embodiment of the application has the following beneficial effects:

the embodiment of the application provides a log data processing method, which is characterized in that log data of target equipment is divided into a plurality of time periods, the time period possibly with abnormity is found by performing coarse-grained processing on the log data of each time period, fine-grained processing is performed on the log data in the time period, the application programs with abnormity in the plurality of application programs are determined, fine-grained processing on the log data of each time period is not needed, the processing amount of log data processing is reduced, and the processing efficiency of the log data is improved.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.

Drawings

FIG. 1 is a schematic diagram of an implementation environment of log data processing according to an embodiment of the present disclosure;

fig. 2 is a flowchart of a log data processing method according to an embodiment of the present application;

fig. 3 is a flowchart of a log data processing method according to an embodiment of the present application;

FIG. 4 is a schematic illustration of a processing result provided by an embodiment of the present application;

fig. 5 is a flowchart of an abnormal application program determining method provided in an embodiment of the present application;

fig. 6 is a schematic structural diagram of a log data processing apparatus according to an embodiment of the present application;

fig. 7 is a schematic structural diagram of another log data processing apparatus according to an embodiment of the present application;

fig. 8 is a block diagram of a terminal according to an embodiment of the present disclosure;

fig. 9 is a block diagram of a server according to an embodiment of the present disclosure.

Detailed Description

In order to make the technical solutions and advantages of the present application more clear, the following describes the embodiments of the present application in further detail.

The terms "first," "second," "third," and "fourth," etc. in the description and claims of this application and in the accompanying drawings are used for distinguishing between different objects and not for describing a particular order. Furthermore, the terms "include" and "have," as well as any variations thereof, are intended to cover a non-exclusive inclusion. For example, a process, method, system, article, or apparatus that comprises a list of steps or elements is not limited to only those steps or elements listed, but may alternatively include other steps or elements not listed, or inherent to such process, method, article, or apparatus.

It should be noted that information (including but not limited to user equipment information, user personal information, etc.), data (including but not limited to data for analysis, stored data, presented data, etc.), and signals referred to in this application are authorized by the user or sufficiently authorized by various parties, and the collection, use, and processing of the relevant data is required to comply with relevant laws and regulations and standards in relevant countries and regions. For example, log data and the like referred to in the present application are acquired with sufficient authority.

Fig. 1 is a schematic diagram of an implementation environment of a log data processing method provided in an embodiment of the present application, and referring to fig. 1, the implementation environment includes: the electronic device may be provided as the terminal 101, may be provided as the server 102, or may be provided as the terminal 101 and the server 102, which is not particularly limited.

If the electronic device is provided as the terminal 101, the terminal 101 records the log data of the terminal, and the recorded log data is processed to determine an abnormal application program in the plurality of locally installed application programs. Subsequently, the terminal 101 may present the application identification of the abnormal application to the user so that the user is informed of the abnormal application. The terminal 101 may also report the abnormal information to the application server of the abnormal application program, so that the abnormal application program is improved. The terminal 101 may also repair the abnormal application to reduce the effect of the abnormal application on the operating state of the terminal 101.

If the electronic device is provided as the server 102, the server 102 processes the collected log data of each terminal 101, and determines an application program having an abnormality among the plurality of application programs installed in each terminal 101. Subsequently, the server 102 may send the application identifier of the abnormal application to the terminal 101, so that the terminal 101 is informed of the abnormal application. The server 102 may also record information such as the number of times that the application program is abnormal on each terminal 101, so as to provide reference for a technician to update the application program.

If the electronic devices are provided as the terminal 101 and the server 102, the terminal 101 and the server 102 are connected through a wireless or wired network. The terminal 101 may generate log data and report the generated log data to the server 102, where the server receives the log data reported by the terminal 101, analyzes and processes the log data to determine an abnormal application program existing in the terminal 101, and returns an application identifier of the abnormal application program to the terminal 101, so that the terminal 101 displays the application identifier.

The terminal 101 is at least one of a mobile phone, a tablet computer, and a pc (personal computer) device. The server 102 may be at least one of a server, a server cluster composed of a plurality of servers, a cloud server, a cloud computing platform, and a virtualization center.

Fig. 2 is a flowchart of a log data processing method provided in an embodiment of the present application, and referring to fig. 2, the method includes:

step 201: second log data corresponding to each time period is acquired from first log data of the target device based on the time periods, the first log data being used for recording the operating states of a plurality of application programs installed on the target device.

Step 202: and determining a first operation state parameter corresponding to the target equipment in each time period based on the second log data corresponding to each time period, wherein the first operation state parameter is used for representing the overall operation state of the target equipment.

Step 203: and determining a target time period from the plurality of time periods based on the first operation state parameter corresponding to each time period, wherein the state represented by the first operation state parameter corresponding to the target time period is inferior to the state represented by the first operation state parameter corresponding to the time periods except the target time period.

Step 204: and determining an application program with an exception in the plurality of application programs based on the second log data corresponding to the target time period.

In one possible implementation manner, determining, based on second log data corresponding to a target time period, an application program with an exception in a plurality of application programs includes:

determining a second running state parameter of each application program based on second log data corresponding to the target time period, wherein the second running state parameter of each application program is used for representing the running state of each application program;

and determining the application programs with the exception in the plurality of application programs based on the second running state parameter of each application program.

In another possible implementation manner, the second operation state parameter of the application program is used for representing the degree of influence of the application program on the operation state of the target device; determining an application program with an exception in the plurality of application programs based on the second operating state parameter of each application program, comprising:

and determining the target application program which has the largest influence on the running state of the target device in the plurality of application programs as the abnormal application program based on the second running state parameter of each application program.

In another possible implementation manner, determining, based on the second operation state parameter of each application program, an application program with an exception in the plurality of application programs includes:

and determining the abnormal application programs in the plurality of application programs based on the second running state parameter of each application program and the second running state parameter corresponding to each application program in the plurality of reference devices.

determining a target application program which has the largest influence on the running state of the target device from the plurality of application programs based on the second running state parameter of each application program;

and determining an analysis result of the target application program based on the second operation state parameter corresponding to the target application program and the second operation state parameter corresponding to the target application program in the plurality of reference devices, wherein the analysis result is used for indicating whether the target application program is an abnormal application program.

In another possible implementation form of the method,

determining an analysis result of the target application program based on the second operation state parameter corresponding to the target application program and the second operation state parameter corresponding to the target application program in the plurality of reference devices, wherein the analysis result comprises any one of the following items:

determining an average running state parameter based on a second running state parameter corresponding to a target application program in a plurality of reference devices; determining an analysis result based on the average running state parameter and a second running state parameter corresponding to a target application program in the target equipment;

sequencing second running state parameters corresponding to target application programs in the plurality of reference devices, and determining the second running state parameters positioned at the target arrangement order as the reference running state parameters; determining an analysis result based on the reference operation state parameter and a second operation state parameter corresponding to a target application program in the target equipment;

sequencing second running state parameters corresponding to the target application programs in the multiple reference devices and second running state parameters corresponding to the target application programs in the target devices; and determining an analysis result based on the arrangement order of the second running state parameters corresponding to the target application program in the target equipment.

In another possible implementation manner, the first log data is further used for recording the running states of a plurality of hardware modules in the target device; the method further comprises the following steps:

after the abnormal application program is determined, third log data corresponding to the abnormal application program are obtained from the second log data, and the third log data are used for representing the running state of the plurality of hardware modules when the plurality of hardware modules provide service for the abnormal application program or the influence of the service on the running state of the plurality of hardware modules;

and determining an abnormal reason of the abnormal application program based on the third log data.

In another possible implementation manner, determining an exception cause of the exception application based on the third log data includes:

determining a hardware module with an exception in the plurality of hardware modules based on the third log data;

determining an abnormal reason of the abnormal hardware module based on fourth log data corresponding to the abnormal hardware module in the third log data;

and determining the abnormal reason as the abnormal reason of the abnormal application program.

In another possible implementation manner, the first operation state parameter is an index value corresponding to a comprehensive index represented by the first index; determining a first operating state parameter corresponding to the target device in each time period based on the second log data corresponding to each time period, wherein the determining comprises the following steps:

determining an index value corresponding to the first index in each time period based on the second log data corresponding to each time period and the first index, wherein the first index is used for representing a comprehensive index of a plurality of application programs;

and determining a first operation state parameter corresponding to the target equipment in each time period based on the index value corresponding to the first index in each time period.

In another possible implementation manner, the determining the target time period from a plurality of time periods based on the first operating state parameter corresponding to each time period includes any one of the following:

determining a target operation state parameter with the worst represented state from the first operation state parameters corresponding to each time period, and determining the time period corresponding to the target operation state parameter as a target time period;

and on the basis of the operation state parameter threshold, determining a target operation state parameter of which the represented state is inferior to the state represented by the operation state parameter threshold from the first operation state parameters corresponding to each time period, and determining the time period corresponding to the target operation state parameter as the target time period.

In another possible implementation manner, after determining, based on the second log data corresponding to the target time period, an application program having an exception in the plurality of application programs, the method further includes:

displaying at least one of:

a first operating state parameter corresponding to each time period;

an application identification of the abnormal application program;

the second running state parameter of each application program corresponds to each time period, and the second running state parameter of each application program is used for representing the running state of each application program;

the reason for the exception of the application.

Fig. 3 is a flowchart of a log data processing method provided in an embodiment of the present application, which is executed by an electronic device, and referring to fig. 3, the method includes:

step 301: the electronic device collects first log data for recording operating states of a plurality of applications installed on the target device and operating states of a plurality of hardware modules in the target device.

The electronic device and the target device may be the same device or different devices, which is not limited in this application.

The target device has a plurality of applications installed thereon, where the plurality of applications may be any application, for example, an electronic commerce application, an instant messaging application, a short video application, and the like, and the application installed on the target device is not limited in this embodiment of the present application. The first log data for recording the operation states of the plurality of applications installed on the target device means: the first log data is used to record usage information of each application at a certain point in time, for example, an application being used at the current point in time, a current of the application, and the like.

The target device further has a plurality of hardware modules, for example, a Central Processing Unit (CPU), a Modem (Modem) module, a screen, and the like of the target device. The first log data is used for recording the running states of a plurality of hardware modules in the target device, and the first log data is used for recording the running states of the hardware modules in the target device, and comprises the following steps: the first log data is used to record status information of each hardware module at a certain time point, for example, a load of a CPU, traffic data of a Modem module, a frame dropping rate of a screen, and the like.

Illustratively, the first log data further comprises at least one of: (1) a device identification; (2) time identification; (3) and (5) application identification.

The device identifier is an identifier of a device to which the first log data belongs, and the device identifier is used to identify a unique device, for example, the device identifier may be an IMEI (International Mobile Equipment Identity), a MAC (Media Access Control Address), and the like. In some embodiments, after the target device generates the first log data, the first log data is reported to the server side, the server side performs analysis processing on the first log data reported by the multiple devices, and in order to enable the server side to distinguish the first log data reported by different devices, the first log data carries a device identifier for distinguishing different devices or users. In view of protection of user privacy, the first log data may be encrypted or the device identifier may be encrypted when uploading the first log data.

The time stamp is used to indicate the generation time of the first log data and also the occurrence time of the event described by the first log data, and the time stamp can be obtained based on the time displayed on the target device.

The application identifier is used to distinguish different application programs, and the application identifier is used to indicate a unique application program, for example, the application identifier is an application name, an application number, and the like. In some embodiments, the application identifier also carries a version number of the application program, which is used to distinguish different versions of the application program.

It should be noted that, in the embodiment of the present application, the acquisition of the first log data is fully authorized by the user, that is, the electronic device acquires the first log data only after being fully authorized and allowed by the user. For example, before the electronic device collects the first log data, a first popup for confirming to the user whether the electronic device is allowed to collect the first log data and analyzing the first log data is displayed, and after a confirmation operation of the user is detected based on the first popup, the electronic device performs the step of collecting the first log data.

In some embodiments, a plurality of buried points are provided on the target device, and the first log data is generated by receiving the buried point data uploaded by the buried points.

In some embodiments, the first log data is stored using a form of database, with data organized, stored, and managed according to a data structure of the database. The database may be any form of database, such as an SQL (Structured Query Language) database. The embodiment of the present application does not limit the database.

Optionally, after the server receives the first log data reported by the device, the first log data may be stored in the corresponding date partition according to the reported time, so as to facilitate subsequent processing. For example, if the log data 1 is received at the 03-08-th day 2022, the log data 1 is stored in a partition corresponding to the 03-08-th day 2022, the partition being used for storing the log data generated at the 03-08-th day 2022; when the log data 2 is received at 09/03/2022, the log data 2 is stored in the partition corresponding to 09/03/2022.

Step 302: the electronic device acquires second log data corresponding to each time period from the first log data of the target device based on a plurality of time periods.

In some embodiments, the plurality of time periods are time periods of equal duration, e.g., time period 1 is 9 am to 10 am, time period 2 is 10 am to 11 am, and time period 3 is 11 am to 12 am. Wherein, the time period 1, the time period 2 and the time period 3 are all time periods with the duration of 1 hour.

In other embodiments, the plurality of time periods are time periods of different durations, for example, time period 1 is 3 am to 9 am, time period 2 is 9 am to 10 am, and time period 3 is 10 am to 11 am. Where time period 1 is a time period of 6 hours in duration, and time periods 2 and 3 are time periods of 1 hour in duration.

In some embodiments, the plurality of time periods are set by a user. For example, the start time and the end time of the first log data are input by the user, and the duration of the time period is also input by the user. And determining a plurality of time periods according to the starting time, the ending time and the duration input by the user, and summarizing and acquiring second log data corresponding to each time period from the first log data of the target equipment.

For example, the start time input by the user is 2022 year 03 month 01 day 8 am, the end time input by the user is 2022 year 03 month 01 day 4 pm, and the duration of the time period input by the user is 2 hours, then based on the start time, the end time and the duration input by the user, 4 time periods can be determined, which are respectively time period 1 from 8 am to 10 am; time period 2, from 10 am to 12 am; time period 3, from 12 pm to 2 pm; time period 4, from 2 pm to 4 pm. And respectively acquiring second log data generated from 8 am to 10 am, second log data generated from 10 am to 12 am, second log data generated from 12 pm to 2 pm, and second log data generated from 2 pm to 4 pm.

In other embodiments, the plurality of time periods are set by default by the device, for example, the device analyzes the first log data of the day by default, and the duration of the time period defaults to 1 hour.

It should be noted that, in the embodiment of the present application, in some cases, when the device is in a shutdown state, a hibernation state, or the like, log data is not generated, and therefore, log data corresponding to some time periods is empty. In some embodiments, when the second log data corresponding to each time period is acquired from the first log data, if the second log data corresponding to a certain time period is empty, the time period may be extended until the second log data corresponding to the time period is not empty.

In this embodiment, when the second log data corresponding to each time period is acquired from the first log data of the target device based on a plurality of time periods, the plurality of time periods may be determined, and then the second log data corresponding to each time period may be acquired from the first log data of the target device; or determining a time period, obtaining the second log data corresponding to the time period from the first log data of the target device, then determining the next time period, obtaining the second log data corresponding to the next time period from the first log data of the target device, and so on.

In some embodiments, the first log data for different dates is stored in different databases. For example, one database is for the first log data of a day. In some cases, the first log data of multiple days needs to be analyzed, and at this time, the databases corresponding to the multiple days can be merged. When the databases corresponding to multiple days are merged, different contents need to be merged in a one-to-one correspondence manner. For example, the databases corresponding to each day include the current of the application a, the current of the application B, the load of the CPU, and the like, and then the current of the application a in each database is merged, the current of the application B in each database is merged, and the load of the CPU in each database is merged. After the databases are merged, second log data corresponding to each time period are obtained from the merged databases.

Step 303: the electronic equipment determines a first operation state parameter corresponding to the target equipment in each time period based on the second log data corresponding to each time period, wherein the first operation state parameter is used for representing the overall operation state of the target equipment.

In some embodiments, the first operational state parameter may be raw information in the second log data. For example, the second log data includes information describing different objects, e.g., the second log data includes information describing each application, information describing each hardware module, and the like. The electronic equipment determines a first operating state parameter corresponding to the target equipment in each time period based on the second log data corresponding to each time period, and the method comprises the following steps: and acquiring data for representing the overall operation state of the target equipment from the second log data corresponding to each time period to obtain a first operation state parameter. For example, the temperature value of the target device, the power consumption amount of the target device, the frame loss rate of the target device, and the like are acquired from the second log data.

In some embodiments, the first operation state parameter may also be information obtained by performing aggregation processing on the second log data. For example, the second log data corresponding to each time period includes power consumptions of a plurality of target devices, the power consumptions are uploaded in the corresponding time periods, and each power consumption is a power consumption newly increased from the last reporting. And adding the plurality of power consumptions to obtain the total power consumption of the target equipment in the corresponding time period, wherein the total power consumption can be determined as the first operation state parameter. For another example, the second log data corresponding to each time period includes currents of a plurality of target devices, and an average value of the currents is determined as the first operating state parameter. The embodiment of the present application does not limit the expression form of the second log data.

In one possible implementation, the second log data is aggregated based on the first index. Optionally, the first operating state parameter is an index value corresponding to a comprehensive index represented by the first index; the electronic equipment determines a first operating state parameter corresponding to the target equipment in each time period based on the second log data corresponding to each time period, and the method comprises the following steps: determining an index value corresponding to the first index in each time period based on the second log data corresponding to each time period and the first index, wherein the first index is used for representing a comprehensive index of a plurality of application programs; and determining a first operation state parameter corresponding to the target equipment in each time period based on the index value corresponding to the first index in each time period.

The first index is used for representing a comprehensive index of a plurality of application programs, and the comprehensive index is as follows: the first index does not distinguish between applications. For example, the first index is a total power consumption amount in each period, an average current in a bright state, an average current in a dead state, an average temperature in each period, a maximum temperature in each period, and the like.

For another example, the first index is the total power consumption amount of each time period, and the index values of the first index in each time period are 800mAh (milliampere hour), 120mAh (milliampere hour), and 750mAh (milliampere hour).

In some embodiments, the electronic device analyzes the application for the different aspects of the anomaly under different conditions, and the first index for analyzing the different aspects of the anomaly is different. For example, in some cases, the electronic device needs to analyze an abnormality in power consumption of the application program, and at this time, the first index may be an average current in a screen-on state, an average current in a screen-off state, or the like. In some cases, the electronic device needs to analyze the abnormality of the application program in terms of temperature rise, and in this case, the first index may be a temperature value of the CPU or the like. In some cases, the electronic device needs to analyze the performance abnormality of the Application, and at this time, the first index may be a frame loss rate (frp) of the target device, an ANR (Application Not Response), or the like.

In some embodiments, the first indicator indicates one indicator. The electronic equipment determines a first operation state parameter corresponding to the target equipment in each time period based on the index value corresponding to the first index in each time period, and the method comprises the following steps: the electronic equipment determines an index value corresponding to the first index in each time period as a first operation state parameter corresponding to the target equipment in each time period.

In some embodiments, the first metric is indicative of a plurality of metrics. The electronic equipment determines a first operation state parameter corresponding to the target equipment in each time period based on the index value corresponding to the first index in each time period, and the method comprises the following steps: and for each time period, the electronic equipment fuses a plurality of index values corresponding to the time period to obtain an index fusion value corresponding to the time period, and determines the index fusion value corresponding to the time period as a first operation state parameter corresponding to the time period.

For example, the plurality of indexes are respectively a bright screen current and a screen-off current, and a bright screen current value and a screen-off current value corresponding to the time period 1 are fused to obtain a first operation state parameter corresponding to the time period 1.

Optionally, the different indicators differ in their degree of importance. For example, the plurality of indexes are bright screen current and off screen current, wherein the bright screen current is more important for abnormality evaluation, and therefore different weights can be given to the bright screen current value and the off screen current value, and then the bright screen current value and the off screen current value are fused.

For example, for each time period, the electronic device fuses a plurality of index values corresponding to the time period to obtain an index fusion value corresponding to the time period, including: and for each time period, the electronic equipment performs weighted fusion on a plurality of index values corresponding to the time period based on the weight of each first index to obtain an index fusion value corresponding to the time period.

It should be noted that, the numerical ranges of the index values corresponding to different indexes are different, and in order to more accurately determine the first operating state parameter capable of representing the overall state of the target device, normalization processing may be performed on each index value, and then weighted fusion is performed on the normalized index values.

Step 304: the electronic equipment determines a target time period from a plurality of time periods based on the first operation state parameter corresponding to each time period, wherein the state represented by the first operation state parameter corresponding to the target time period is inferior to the state represented by the first operation state parameter corresponding to the time periods except the target time period.

In this application embodiment, the target time period may be one time period or a plurality of time periods, which is not limited in this application embodiment.

In one possible implementation manner, the determining, by the electronic device, a target time period from a plurality of time periods based on the first operating state parameter corresponding to each time period includes: and determining a target operation state parameter with the worst represented state from the first operation state parameters corresponding to each time period, and determining the time period corresponding to the target operation state parameter as the target time period.

Optionally, the first operation state parameters corresponding to each time period are sorted according to the merits of the states represented. And under the condition that the first operation state parameters are arranged according to the sequence from the excellent state to the inferior state of the expressed state, determining the time periods corresponding to the first operation state parameters of the rear target number as target time periods. And under the condition that the first operation state parameters are arranged according to the sequence of the expressed states from inferior to superior, determining the time periods corresponding to the first operation state parameters with the previous target number as target time periods.

The number of targets may be 1, or may be multiple, for example, 2, 3, or the like.

It should be noted that the rank of the first operating state parameter may indicate an exception level of the time period, and the higher the exception level is, the higher the probability of the exception occurring in the time period is.

In another possible implementation manner, the determining, by the electronic device, a target time period from a plurality of time periods based on the first operating state parameter corresponding to each time period includes: and on the basis of the operation state parameter threshold, determining a target operation state parameter of which the represented state is inferior to the state represented by the operation state parameter threshold from the first operation state parameters corresponding to each time period, and determining the time period corresponding to the target operation state parameter as the target time period.

The operation state parameter threshold may be regarded as a standard for measuring whether the operation state of the target device is abnormal, and the operation state parameter threshold may be any value, for example, the operation state parameter threshold is an inspection value, may also be a threshold set by a technician, and may also be a threshold set by a user, and the operation state parameter threshold is not limited in the embodiment of the present application.

In another possible implementation manner, the determining, by the electronic device, a target time period from a plurality of time periods based on the first operating state parameter corresponding to each time period includes: determining a first target operation state parameter from the first operation state parameters corresponding to each time period based on the operation state parameter threshold, wherein the indicated state is inferior to the state indicated by the operation state parameter threshold; and determining a second target operation state parameter with the worst represented state from the first target operation state parameters, and determining a time period corresponding to the second target operation state parameter as a target time period.

It should be noted that the operating condition parameter threshold value may or may not be identical to the first operating condition parameter in its representation. For example, the first operation state parameter includes power consumption of a corresponding time period and a current fusion value of on-off screen, and the operation state parameter threshold includes a power consumption threshold and a current fusion value threshold of on-off screen.

For another example, the first operating state parameter includes power consumption of the corresponding time period and a current fusion value of turning on and off the screen. The operating condition parameter threshold is a power consumption amount threshold. For example, the power consumption threshold is 100mAh, if the power consumption in the first operation state parameter exceeds 100mAh, the first operation state parameter is determined as a first target operation state parameter, and then the first target operation state parameter is sorted based on the current fusion value of on-off screen in the first target operation state parameter, and a second target operation state parameter is determined.

Step 305: the electronic equipment determines an abnormal application program in the plurality of application programs based on the second log data corresponding to the target time period.

As is clear from the description of step 304, the target time zone may be one or a plurality of time zones. In the case where the target time period is plural, the electronic apparatus performs the above-described step 305 for each target time period.

In one possible implementation, the second log data includes data describing different objects, and the electronic device may determine whether an exception exists for each application based on the data describing the application. Optionally, the determining, by the electronic device, an application program with an exception in the plurality of application programs based on the second log data corresponding to the target time period includes: determining a second operation state parameter of each application program based on second log data corresponding to the target time period, wherein the second operation state parameter of the application program is used for representing the operation state of the application program; and determining the application programs with the exception in the plurality of application programs based on the second running state parameter of each application program.

It should be noted that, reference may be made to the embodiment shown in fig. 5 for implementation of the step 305, and details of the embodiment of the present application are not repeated herein.

Step 306: and the electronic equipment acquires third log data corresponding to the abnormal application program from the second log data, wherein the third log data is used for representing the running state of the plurality of hardware modules when the plurality of hardware modules provide service for the abnormal application program or the influence of the service on the running state of the plurality of hardware modules.

The third log data is data for describing a plurality of hardware modules in the target device. The hardware module may include at least one of a CPU, a screen, and a Modem module. The third log data is used for representing the running state of the plurality of hardware modules when the plurality of hardware modules provide services for the abnormal application program, and means that: when the abnormal application program runs in the foreground, the state of the hardware module, the state of the thread corresponding to the application program in the hardware module and the like. The third log data is used for representing the influence of the service on the running state of the hardware module when the plurality of hardware modules provide the service for the abnormal application program. For example, the load ratio of the thread of the abnormal application in the CPU, the frequency point scheduling distribution, and the like.

It should be noted that, the electronic device includes a plurality of hardware modules, and if the electronic device focuses on analyzing any abnormality of the application program in terms of power consumption, temperature, performance, and the like, it is usually not necessary to analyze each hardware module, but determines the third index based on the abnormality type, and acquires the third log data corresponding to the third index from the second log data based on the third index.

Wherein the third metric is indicative of at least one metric of the at least one hardware module. For example, the third index is used to indicate: the type of flow used by the Modem module and the service time of each flow; frequency point scheduling distribution of a CPU and load conditions of threads of abnormal application programs; the screen displays the brightness, frame rate, frame loss condition, etc. of the abnormal application program.

It should be noted that, in the embodiment of the present application, only the third log data corresponding to the abnormal application program is obtained, and the abnormal cause of the abnormal application program is determined based on the third log data. In another embodiment, third log data corresponding to other application programs may be further acquired from the second log data, and the abnormal reason of the abnormal application program may be determined by referring to the third log data corresponding to other application programs.

Step 307: the electronic equipment determines the abnormal reason of the abnormal application program based on the third log data.

In one possible implementation manner, the electronic device determines an exception cause of the exception application based on the third log data, including: the electronic equipment determines a hardware module with an exception in the plurality of hardware modules based on the third log data; and determining the abnormal reason of the abnormal hardware module based on fourth log data corresponding to the abnormal hardware module in the third log data, and determining the abnormal reason as the abnormal reason of the abnormal application program.

Optionally, the determining, by the electronic device, a hardware module having an exception in the plurality of hardware modules based on the third log data includes: the electronic equipment determines an index value corresponding to each third index based on the third indexes and the third log data; and determining the hardware module with the abnormality based on the index value corresponding to each third index.

It should be noted that, in the embodiment of the present application, the step of "determining the hardware module with the abnormality based on the index value corresponding to the third index" is similar to the step of "determining the application with the abnormality based on the index value corresponding to the second index", and details thereof are not repeated here.

Optionally, the determining, by the electronic device, an abnormality cause of the abnormal hardware module based on fourth log data corresponding to the abnormal hardware module in the third log data includes: and determining the abnormal reason of the abnormal hardware module according to the index value related to the abnormal hardware module in the index values corresponding to the third index of the electronic equipment.

For example, the abnormal hardware module is a Modem module, and the index values related to the Modem module are shown in table 1.

TABLE 1

According to the index value related to the Modem module, the power consumption of the Modem module is too high, most of the power consumption of the Modem module is caused by using 5G, part of the power consumption is caused by weak signal strength of 5G, and part of the power consumption is caused by high power consumption due to high transmitting and receiving capacity of 5G. Therefore, the abnormal cause of the abnormal module is obtained, namely, the signal strength of 5G is weak and the receiving and transmitting quantity of 5G is high.

It should be noted that, after the log data is processed, the processing result may also be presented to the user in the embodiment of the present application. In a possible implementation manner, after the electronic device determines, based on the second log data corresponding to the target time period, that an abnormal application program exists in the plurality of application programs, the method further includes: displaying at least one of: (1) a first operating state parameter corresponding to each time period; (2) an application identification of the abnormal application program; (3) a second running state parameter corresponding to each application program in each time period, wherein the second running state parameter of the application program is used for representing the running state of the application program; (4) the reason for the exception of the application.

Taking an analysis in terms of power consumption as an example, the processing results presented to the user may be as shown in fig. 4.

In addition, according to the merging method, the database is used as a carrier, namely the databases are merged, so that the log data in the databases can be quickly analyzed, and when the specific time of the occurrence of the abnormality needs to be detected, the merging operation can quickly position the time point, and the analysis efficiency is improved.

In addition, the embodiment of the application supports the processing of log data in any time range in the database, and a user can select any time period to analyze. If the user knows the time when the abnormity occurs, the time can be directly selected as the time range of processing, and the data processing amount is reduced.

In addition, according to the method and the device, the abnormal application program can be determined, and the abnormal reason of the abnormal application program can be determined, so that a user can adjust the target device according to the abnormal reason, and the application program is prevented from being abnormal continuously.

Fig. 5 is a flowchart of an abnormal application program determining method provided in an embodiment of the present application, which is executed by an electronic device, and referring to fig. 5, the method includes:

step 501: and the electronic equipment determines a second running state parameter of each application western whisker based on second log data corresponding to the target time period, wherein the second running state parameter of the application program is used for representing the running state of the application program.

In some embodiments, the second operating condition parameter is raw data in the second log data. The electronic equipment determines a second operation state parameter of each application program based on second log data corresponding to the target time period, and the method comprises the following steps: and for each application program, the electronic equipment acquires log data describing the application program from second log data corresponding to the target time period to obtain a second running state parameter of the application program.

In other embodiments, the second operating state parameter is obtained by aggregating log data describing the same application in the second log data. The electronic equipment determines a second operation state parameter of each application program based on second log data corresponding to the target time period, and the method comprises the following steps: and for each application program, the electronic equipment acquires log data describing the application program from second log data corresponding to the target time period, and performs aggregation processing on the acquired log data to obtain a second running state parameter of the application program.

In some embodiments, the second log data includes a plurality of pieces of data describing each application program, and in order to reduce the amount of processed data, the second log data may be processed based on a second index to obtain a second operating state parameter of each application program. Optionally, determining a second operating state parameter of each application program based on second log data corresponding to the target time period includes: determining an index value corresponding to the second index of each application program based on the second log data and the second index corresponding to the target time period; and determining a second operation state parameter of each application program based on the index value corresponding to the second index of each application program.

The second index is an index indicating the running state of the application. Alternatively, the second index is power consumption of turning on and off the screen of each application, power consumption ratio of each application, current value of turning on and off the screen of each application, and the like, as shown in table 2.

TABLE 2

Determining a second operation state parameter of each application program based on the index value corresponding to the second index of each application program, wherein the determining comprises the following steps: under the condition that the second index is one index, determining an index value corresponding to the second index of each application program as a second operation state parameter of the application program; under the condition that the second indexes are multiple indexes, for each application program, fusing the index values corresponding to each second index to obtain a second running state parameter of the application program; or, in the case that the second index is a plurality of indexes, for each application program, determining the index value corresponding to each second index as the second operation state parameter of the application program.

Step 502: the electronic device determines an application program with an exception in the plurality of application programs based on the second operation state parameter of each application program.

In a first possible implementation manner, the second operation state parameter of the application program is used to indicate a degree of influence of the application program on the operation state of the target device. The electronic equipment determines the application programs with the exception in the plurality of application programs based on the second operation state parameter of each application program, and the method comprises the following steps: and determining the target application program which has the largest influence on the running state of the target device in the plurality of application programs as the abnormal application program based on the second running state parameter of each application program.

For example, the second operation state parameter of the application includes a power consumption duty ratio of the application, and the higher the power consumption duty ratio of the application, the stronger the user perceives the effect of the application on the target device, the higher the severity of the application if an abnormality occurs, and the higher the possibility that the user perceives that the target device consumes too much power. Therefore, the target application program which has the greatest influence on the running state of the target device in the plurality of application programs can be determined as the abnormal application program, so that the application program can be processed in time in the following process, and the serious result caused by the abnormal application program can be avoided.

In view of the reasons that some applications interact with a background server in the using process or need to acquire new multimedia data continuously, the power consumption ratio of the applications is high, but this is a normal situation, and in order to avoid processing the applications unnecessarily, the embodiment of the present application also provides another method for determining abnormal applications. In a second possible implementation manner, the determining, by the electronic device, an application having an exception in the plurality of applications based on the second operating state parameter of each application includes: and determining the abnormal application programs in the plurality of application programs based on the second operation state parameter of each application program and the second operation state parameter corresponding to each application program in the plurality of reference devices.

The multiple reference devices are other electronic devices, multiple applications are installed in the multiple reference devices, and the multiple applications installed in the multiple reference devices may or may not be completely the same. In the embodiment of the present application, for each application, multiple reference devices may be referred to, and for each application, the multiple reference devices referred to may be the same or different, which is not limited in the embodiment of the present application. For example, the determining, by the electronic device, an application having an exception in the plurality of applications based on the second operating state parameter of each application and the second operating state parameter corresponding to each application in the plurality of reference devices includes: for each application program, determining whether the application program is an abnormal application program based on the second operation state parameter of the application program and the second operation state parameter corresponding to the application program in the plurality of reference devices.

It should be noted that, in the step "based on the second operation state parameter of the application program and the second operation state parameter corresponding to the application program in the multiple reference devices, it is determined whether the application program is an abnormal application program," similar to the step "the electronic device determines the analysis result of the target application program based on the second operation state parameter corresponding to the target application program and the second operation state parameter corresponding to the target application program in the multiple reference devices," and an explanation of the analysis result of the target application program "may be determined by referring to the step" based on the second operation state parameter corresponding to the target application program and the second operation state parameter corresponding to the target application program in the multiple reference devices, which is not described herein one by one.

In consideration of the fact that the data volume of the second operation state parameters of the multiple reference devices is large, the embodiment of the application further provides another method for determining the abnormal application program. In a third possible implementation manner, the determining, by the electronic device, an application program with an exception in the plurality of application programs based on the second operation state parameter of each application program includes: and determining the application program corresponding to the second running state parameter with the represented state inferior to the state represented by the reference running state parameter as the abnormal application program based on the second running state parameter of each application program and the reference running state parameter.

The reference operating state parameter may be an empirical value, a laboratory measured value, a threshold value determined based on big data, and the like, and the reference operating state parameter is not limited in the embodiment of the present application.

Considering that although some applications consume resources on other devices relative to the resources consumed by the applications, the total resources consumed by the applications are not much, and do not have a great influence on the whole target device, and are not easily perceived by the user. Therefore, the embodiment of the application also combines the influence of the application program on the target device and the running condition of the application program on other devices to determine whether the application program has an exception.

In a fourth possible implementation manner, the determining, by the electronic device, an application program with an exception in the plurality of application programs based on the second operation state parameter of each application program includes: determining a target application program which has the largest influence on the running state of the target device from the plurality of application programs based on the second running state parameter of each application program; and determining an analysis result of the target application program based on the second operation state parameter corresponding to the target application program and the second operation state parameter corresponding to the target application program in the plurality of reference devices, wherein the analysis result is used for indicating whether the target application program is an abnormal application program.

The target application program may be one application program or a plurality of application programs, and the number of the target application programs is not limited in the embodiment of the present application. And under the condition that the target application programs are multiple, the electronic equipment executes a step of determining an analysis result of each target application program on the basis of the second operation state parameters corresponding to the target application program and the second operation state parameters corresponding to the target application programs in the multiple reference equipment.

In some embodiments, the electronic device determines an analysis result of the target application based on the second operation state parameter corresponding to the target application and the second operation state parameter corresponding to the target application in the multiple reference devices, including any one of the following steps:

(1) determining an average running state parameter based on a second running state parameter corresponding to a target application program in a plurality of reference devices; and determining an analysis result based on the average running state parameter and a second running state parameter corresponding to the target application program in the target equipment.

For example, in the case that the state represented by the second operation state parameter of the application program of the target device is inferior to the state represented by the average operation state parameter, the application program is determined to be an abnormal application program; and determining that the application program is not an abnormal application program in the case that the state represented by the second running state parameter of the application program of the target device is better than the state represented by the average running state parameter.

(2) Sequencing second running state parameters corresponding to target application programs in the plurality of reference devices, and determining the second running state parameters positioned at the target arrangement order as the reference running state parameters; and determining an analysis result based on the reference operation state parameter and a second operation state parameter corresponding to the target application program in the target equipment.

The target permutation order may be any permutation order, such as 20 th bit, 30 th bit, 80 th bit, and the like.

Determining the application program as an abnormal application program under the condition that the state represented by the second operation state parameter of the application program of the target equipment is inferior to the state represented by the reference operation state parameter; in the case where the state indicated by the second operation state parameter of the application program of the target device is better than the state indicated by the reference operation state parameter, it is determined that the application program is not an abnormal application program.

(3) Sequencing second operation state parameters corresponding to the target application program in the multiple reference devices and second operation state parameters corresponding to the target application program in the target device; and determining an analysis result based on the arrangement order of the second running state parameters corresponding to the target application program in the target equipment.

Under the condition that the second operation state parameters are arranged according to the sequence from good to bad of the represented states, if the second operation state parameter corresponding to the target application program in the target device is behind the target arrangement order (for example, at the rear 20%), the target application program is determined to be an abnormal application program, and if the second operation state parameter corresponding to the target application program in the target device is before the target arrangement order, the target application program is determined not to be the abnormal application program.

Under the condition that the second operation state parameters are arranged according to the sequence from inferior to superior of the represented state, if the second operation state parameter corresponding to the target application program in the target device is before the target arrangement order (for example, at the top 20%), the target application program is determined to be an abnormal application program, and if the second operation state parameter corresponding to the target application program in the target device is after the target arrangement order, the target application program is determined not to be the abnormal application program.

The abnormal application program determining method provided by the embodiment of the application can determine the application program which has a large influence on the overall running state of the target device, so that a user can know which application program influences the poor overall running state of the target device, and then the user is prompted how to process the application program to improve the overall running state of the target device.

In addition, the embodiment of the application only analyzes the application program with a large influence on the overall running state of the target device, reduces the processing amount of log data and improves the processing efficiency under the condition of ensuring the overall running state of the target device to be good.

Fig. 6 is a schematic structural diagram of a log data processing apparatus according to an embodiment of the present application, and referring to fig. 6, the apparatus includes:

a first obtaining module 601, configured to obtain, based on a plurality of time periods, second log data corresponding to each time period from first log data of a target device, where the first log data is used to record operating states of a plurality of applications installed on the target device; a first determining module 602, configured to determine, based on the second log data corresponding to each time period, a first operating state parameter corresponding to each time period for the target device, where the first operating state parameter is used to indicate an overall operating state of the target device; a second determining module 603, configured to determine a target time period from the multiple time periods based on the first operating state parameter corresponding to each time period, where a state represented by the first operating state parameter corresponding to the target time period is inferior to a state represented by the first operating state parameter corresponding to a time period other than the target time period in the multiple time periods; a third determining module 604, configured to determine, based on the second log data corresponding to the target time period, an application program with an exception in the multiple application programs.

As shown in fig. 7, in one possible implementation manner, the third determining module 604 includes: a state determining unit 6041 configured to determine a second operation state parameter of each application program based on the second log data corresponding to the target time period, the second operation state parameter of the application program being used to represent an operation state of the application program; an abnormal application determination unit 6042 configured to determine an application program having an abnormality from among the plurality of application programs, based on the second operation state parameter of each application program.

In another possible implementation manner, the second operation state parameter of the application program is used for representing the degree of influence of the application program on the operation state of the target device; an abnormal application determination unit 6042 configured to determine, as an abnormal application, a target application having the greatest influence on the operating state of the target device among the plurality of applications, based on the second operating state parameter of each application.

In another possible implementation manner, the abnormal application determining unit 6042 is configured to determine an application program with an abnormality in the multiple application programs based on the second operation state parameter of each application program and the second operation state parameter corresponding to each application program in the multiple reference devices.

In another possible implementation, the abnormal application determining unit 6042 is configured to determine, based on the second operation state parameter of each application, a target application that has the greatest influence on the operation state of the target device from among the plurality of applications; and determining an analysis result of the target application program based on the second operation state parameter corresponding to the target application program and the second operation state parameter corresponding to the target application program in the plurality of reference devices, wherein the analysis result is used for indicating whether the target application program is an abnormal application program.

In another possible implementation, the exception application determining unit 6042 is configured to perform at least one of:

In another possible implementation manner, the first log data is further used for recording the running states of a plurality of hardware modules in the target device; the device still includes: a second obtaining module 605, configured to obtain third log data corresponding to the abnormal application program from the second log data after the abnormal application program is determined, where the third log data is used to indicate an operating state when the plurality of hardware modules provide services for the abnormal application program or an influence of the services on the operating states of the plurality of hardware modules; a fourth determining module 606, configured to determine an exception reason of the exception application based on the third log data.

In another possible implementation manner, the fourth determining module 606 includes: an abnormal hardware determination unit 6061 configured to determine an abnormal cause of the abnormal hardware module based on fourth log data corresponding to the abnormal hardware module in the third log data; an abnormality cause determination unit 6062 for determining the abnormality cause as the abnormality cause of the abnormal application.

In another possible implementation manner, the first operating state parameter is an index value corresponding to a comprehensive index represented by the first index; a first determining module 602, configured to determine an index value corresponding to a first index in each time period based on the second log data corresponding to each time period and the first index, where the first index is used to represent a comprehensive index of the plurality of application programs; and determining a first operation state parameter corresponding to the target equipment in each time period based on the index value corresponding to the first index in each time period.

In another possible implementation manner, the second determining module 603 is configured to perform at least one of the following:

In another possible implementation manner, the apparatus further includes: a display module 607 for displaying at least one of: a first operating state parameter corresponding to each time period; an application identification of the abnormal application program; the second running state parameter of each application program corresponds to each time period, and the second running state parameter of each application program is used for representing the running state of each application program; the reason for the exception of the application.

The embodiment of the application provides a log data processing device, which divides log data of target equipment into a plurality of time periods, finds a time period possibly with abnormality by performing coarse-grained processing on the log data of each time period, performs fine-grained processing on the log data in the time period, determines application programs with abnormality in the plurality of application programs, does not need to perform fine-grained processing on the log data of each time period, reduces the processing amount of log data processing, and improves the processing efficiency of the log data.

If the electronic device is provided as a terminal, please refer to fig. 8, which illustrates a block diagram of a terminal 800 according to an exemplary embodiment of the present application. The terminal 800 may be a smart phone, a tablet computer, or other devices having a function of controlling other devices. The terminal 800 in the present application may include one or more of the following components: a processor 810, a memory 820.

Processor 810 may include one or more processing cores. The processor 810 connects various parts within the entire terminal 800 using various interfaces and lines, performs various functions of the terminal 800 and processes data by operating or executing a program code, a program, a code set, or a program code set stored in the memory 820, and calling data stored in the memory 820. Alternatively, the processor 810 may be implemented in hardware using at least one of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), and Programmable Logic Array (PLA). The processor 810 may integrate one or more of a Central Processing Unit (CPU), a Graphics Processing Unit (GPU), a Neural-Network Processing Unit (NPU), a modem, and the like. Wherein, the CPU mainly processes an operating system, a user interface, an application program and the like; the GPU is used for rendering and drawing the content required to be displayed by the display screen; the NPU is used for realizing an Artificial Intelligence (AI) function; the modem is used to handle wireless communications. It is understood that the modem may not be integrated into the processor 810, but may be implemented by a single chip.

The Memory 820 may include a Random Access Memory (RAM) or a Read-Only Memory (ROM). Optionally, the memory 820 includes a non-transitory computer-readable medium. The memory 820 may be used to store program code, programs, code sets, or program code sets. The memory 820 may include a storage program area and a storage data area, wherein the storage program area may store program codes for implementing an operating system, program codes for at least one function (such as a touch function, a sound playing function, an image playing function, etc.), program codes for implementing the above-described respective method embodiments, and the like; the storage data area may store data (such as audio data, a phonebook) created according to the use of the terminal 800, and the like.

In addition, those skilled in the art will appreciate that the configuration of terminal 800 illustrated in the above-described figures is not meant to be limiting with respect to terminal 800, and that terminal 800 may include more or less components than those illustrated, or some components may be combined, or a different arrangement of components. For example, the terminal 800 further includes a microphone, a speaker, a radio frequency circuit, an input unit, a sensor, an audio circuit, a Wireless Fidelity (Wi-Fi) module, a power supply, a bluetooth module, and other components, which are not described herein again.

If the electronic device is provided as a server, referring to fig. 9, fig. 9 is a schematic structural diagram of a server provided in this embodiment, and the server 900 may generate a relatively large difference due to different configurations or performances, and may include a processor (CPU) 901 and a memory 902, where at least one program code is stored in the memory 602, and the at least one program code is loaded and executed by the processor 901 to implement the methods provided in the foregoing method embodiments. Certainly, the server 900 may also have components such as a wired or wireless network interface, a keyboard, and an input/output interface, so as to perform input and output, and the server 900 may also include other components for implementing device functions, which are not described herein again.

In an exemplary embodiment, there is also provided a computer readable medium storing at least one program code, which is loaded and executed by a processor, to implement the log data processing method in the above-described embodiments.

In an exemplary embodiment, there is also provided a computer program product storing at least one program code, which is loaded and executed by a processor to implement the log data processing method in the above-described embodiments.

In some embodiments, the computer program according to the embodiments of the present application may be deployed to be executed on one computer device or on multiple computer devices located at one site, or may be executed on multiple computer devices distributed at multiple sites and interconnected by a communication network, and the multiple computer devices distributed at the multiple sites and interconnected by the communication network may constitute a block chain system.

It will be understood by those skilled in the art that all or part of the steps for implementing the above embodiments may be implemented by hardware, or may be implemented by hardware related to instructions of a program, and the program may be stored in a computer readable storage medium, where the above mentioned storage medium may be a read-only memory, a magnetic disk or an optical disk.

The above description is only for facilitating the understanding of the technical solutions of the present application by those skilled in the art, and is not intended to limit the present application. Any modification, equivalent replacement, improvement and the like made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A method of processing log data, the method comprising:

determining a first operation state parameter corresponding to the target device in each time period based on the second log data corresponding to each time period, wherein the first operation state parameter is used for representing the overall operation state of the target device;

2. The method of claim 1, wherein determining the application program with the exception in the plurality of application programs based on the second log data corresponding to the target time period comprises:

determining a second running state parameter of each application program based on second log data corresponding to the target time period, wherein the second running state parameter of each application program is used for representing the running state of the application program;

and determining the abnormal application programs in the plurality of application programs based on the second running state parameter of each application program.

3. The method according to claim 2, wherein the second operating state parameter of the application program is used to indicate a degree of influence of the application program on the operating state of the target device; the determining, based on the second operating state parameter of each application program, an application program with an exception in the plurality of application programs includes:

and determining the target application program which has the largest influence on the running state of the target device in the plurality of application programs as an abnormal application program based on the second running state parameter of each application program.

4. The method of claim 2, wherein determining the application of the plurality of applications that has the exception based on the second operating state parameter of each application comprises:

and determining the abnormal application programs in the plurality of application programs based on the second running state parameter of each application program and the second running state parameter corresponding to each application program in a plurality of reference devices.

5. The method of claim 2, wherein determining the application of the plurality of applications that has the exception based on the second operating state parameter of each application comprises:

and determining an analysis result of the target application program based on the second operation state parameter corresponding to the target application program and the second operation state parameter corresponding to the target application program in the multiple reference devices, wherein the analysis result is used for indicating whether the target application program is an abnormal application program.

6. The method according to claim 5, wherein the determining the analysis result of the target application based on the second operation state parameter corresponding to the target application and the second operation state parameters corresponding to the target application in multiple reference devices comprises any one of:

determining an average operating state parameter based on a second operating state parameter corresponding to the target application program in the plurality of reference devices; determining the analysis result based on the average running state parameter and a second running state parameter corresponding to the target application program in the target device;

sequencing second running state parameters corresponding to the target application programs in the plurality of reference devices, and determining the second running state parameters at the target arrangement order as reference running state parameters; determining the analysis result based on the reference operation state parameter and a second operation state parameter corresponding to the target application program in the target device;

sorting second operation state parameters corresponding to the target application program in the multiple reference devices and second operation state parameters corresponding to the target application program in the target device; and determining the analysis result based on the arrangement order of the second operation state parameters corresponding to the target application program in the target equipment.

7. The method of claim 1, wherein the first log data is further used to record the operating status of a plurality of hardware modules in the target device; the method further comprises the following steps:

after determining an abnormal application program, obtaining third log data corresponding to the abnormal application program from the second log data, wherein the third log data is used for representing the running state of the plurality of hardware modules when the plurality of hardware modules provide service for the abnormal application program or the influence of the service on the running state of the plurality of hardware modules;

8. The method of claim 7, wherein determining the cause of the exception for the anomalous application based on the third log data comprises:

determining a hardware module having an exception among the plurality of hardware modules based on the third log data;

9. The method of claim 1, wherein the first operating state parameter is an index value corresponding to a composite index represented by a first index; the determining, based on the second log data corresponding to each time period, a first operating state parameter corresponding to the target device in each time period includes:

determining an index value corresponding to a first index in each time period based on the second log data corresponding to each time period and the first index, wherein the first index is used for representing a comprehensive index of the plurality of application programs;

10. The method of claim 1, wherein determining a target time period from the plurality of time periods based on the first operating state parameter corresponding to each time period comprises any one of:

and on the basis of the operation state parameter threshold, determining a target operation state parameter of which the represented state is inferior to the state represented by the operation state parameter threshold from the first operation state parameters corresponding to each time period, and determining the time period corresponding to the target operation state parameter as a target time period.

11. The method according to claim 1, wherein after determining that there is an abnormal application program in the plurality of application programs based on the second log data corresponding to the target time period, the method further comprises:

displaying at least one of:

a first operating state parameter corresponding to each time period;

an application identification of the abnormal application program;

a second running state parameter corresponding to each application program in each time period, wherein the second running state parameter of each application program is used for representing the running state of the application program;

an exception cause for the exception application.

12. An apparatus for processing log data, the apparatus comprising:

13. An electronic device, characterized in that the electronic device comprises a processor and a memory, wherein at least one program code is stored in the memory, and the at least one program code is loaded and executed by the processor to implement the log data processing method according to any one of claims 1 to 11.

14. A computer-readable storage medium having at least one program code stored therein, the at least one program code being loaded and executed by a processor to implement the log data processing method according to any one of claims 1 to 11.

15. A computer program product having at least one program code stored therein, the at least one program code being loaded into and executed by a processor to implement the log data processing method according to any one of claims 1 to 11.