CN102385549A - Log processing system, log processing method and log storage sub-system - Google Patents

Log processing system, log processing method and log storage sub-system Download PDF

Info

Publication number
CN102385549A
CN102385549A CN2010102718155A CN201010271815A CN102385549A CN 102385549 A CN102385549 A CN 102385549A CN 2010102718155 A CN2010102718155 A CN 2010102718155A CN 201010271815 A CN201010271815 A CN 201010271815A CN 102385549 A CN102385549 A CN 102385549A
Authority
CN
China
Prior art keywords
log
subsystem
information
log information
analysis
Prior art date
Application number
CN2010102718155A
Other languages
Chinese (zh)
Inventor
崔旭敏
曾舜峰
杨锐
王春晖
王智广
肖保锋
赵鹏山
钟良勇
Original Assignee
北京无限立通通讯技术有限责任公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 北京无限立通通讯技术有限责任公司 filed Critical 北京无限立通通讯技术有限责任公司
Priority to CN2010102718155A priority Critical patent/CN102385549A/en
Publication of CN102385549A publication Critical patent/CN102385549A/en

Links

Abstract

The invention relates to a log processing system, a log processing method and a log storage sub-system. The log processing system comprises an application sub-system, the log storage sub-system and a log analysis sub-system, wherein the application sub-system is used for generating log information and particularly sending the log information to the log storage sub-system, the log storage sub-system is independent to the application sub-system and is used for storing the log information and particularly storing the log information in a message queue mode, and the log analysis sub-system is used for analyzing the log information and particularly reading the log information from the log storage sub-system and analyzing the log information. With the adoption of the embodiment of the invention, storage resources of the application sub-system in the log processing system are not occupied to a great extent during log processing, so that the influence on the application sub-system is reduced.

Description

日志处理系统、日志处理方法和日志存储子系统 Log processing system, processing method, and a log log storage subsystem

技术领域 FIELD

[0001] 本发明涉及数据处理技术,尤其涉及日志处理技术。 [0001] The present invention relates to data processing technology, and particularly relates to a log processing techniques. 背景技术 Background technique

[0002] 现有的一种日志处理系统如图1所示。 [0002] An existing log processing system shown in Fig. 日志处理系统采用分布式设计方式,每个应用子系统中的日志记录模块都在各自所在的应用子系统中记录日志信息,并定时将记录的日志信息发给日志分析子系统。 Log processing system of distributed design approach, each application subsystem logging module logs the information in their respective application subsystem and the timing of recording the log information sent to the log analysis subsystem. 日志分析子系统获得日志信息后,对日志信息进行分析 When the log analysis subsystem obtain the log information, the log information for analysis

等处理。 And other treatment.

[0003] 发明人在仔细研究上述现有技术后发现,应用子系统中的日志记录模块在应用子系统中记录日志信息时,需要将日志信息存储在应用子系统中,这样,日志信息就需要占用应用系统的存储资源。 When [0003] After careful study of the inventors found that the above-described prior art, the application subsystem logging module logs the information in an application subsystem, the log information needs to be stored in the application subsystem, so that, the log information is needed use storage resources applications. 如果日志记录模块记录的日志信息越多,那么应用子系统被占用的存储资源就会越多,这样就会影响应用子系统的工作。 The more logs if logging module records, so the more memory resources will be occupied by the application subsystem, which would affect the application subsystem.

发明内容 SUMMARY

[0004] 本发明提供日志处理系统、日志处理方法和日志存储子系统,用以在日志处理过程中,尽量不占用日志处理系统中的应用子系统的存储资源,从而减少对应用子系统的影响。 [0004] The present invention provides log processing system, processing method, and a log log storage subsystem for processing the log, try not to take up storage subsystem resource utilization log processing system, thereby reducing the impact on the application subsystem .

[0005] 一种日志处理系统,包括: [0005] A log processing system, comprising:

[0006] 生成日志信息的应用子系统; [0006] Applications subsystem generates log information;

[0007] 独立于应用子系统并存储日志信息的日志存储子系统; [0007] independent of the application subsystem and store log information log storage subsystem;

[0008] 分析日志信息的日志分析子系统; [0008] The analysis of the log information log analysis subsystem;

[0009] 应用子系统具体用于将日志信息发给日志存储子系统,日志存储子系统具体用于使用消息队列的形式存储日志信息,日志分析子系统具体用于从日志存储子系统读取日志信息并分析日志信息。 [0009] In particular the application subsystem configured to log information to the log storage subsystem, storage subsystem particular log message queue using the log information stored in the log analysis subsystem configured to read log from the log storage subsystem information and analyze log information.

[0010] 优选地,日志存储子系统中设置有多个消息队列,每个消息队列都对应一种日志信息类型; [0010] Preferably, the log storage subsystem is provided with a plurality of message queues, each message queue corresponding to one kind of log information type;

[0011] 应用子系统发给日志存储子系统的日志信息携带有用于表示日志信息类型的标识; The log information [0011] distributed application subsystem log storage subsystem carries log information for indicating the type of identifier;

[0012] 日志存储子系统具体用于根据所述标识,将日志信息存储在与所述标识所表示的日志信息类型相对应的消息队列中。 [0012] DETAILED log storage subsystem according to the identifier, the type of log information indicated by the identification corresponding to the log information storage message queue.

[0013] 优选地,日志分析子系统具体用于根据所述标识,从日志存储子系统读取需要的日志fn息ο [0013] Preferably, the log analysis subsystem according to the specific identification, o fn log information from the log storage subsystem needs to read

[0014] 优选地,日志分析子系统具体用于定时监控日志存储子系统中的消息队列中是否有日志信息,如果有,则读取日志信息。 [0014] Preferably, the logging subsystem is configured to analyze whether there is log information in the storage subsystem to periodically monitor the log message queue, if any, is read log information.

[0015] 优选地,还包括日志管理子系统,用于设置用于分析日志信息的分析规则; [0015] Preferably, further comprising a log management subsystem is provided for analysis rule for analyzing the log information;

[0016] 日志分析子系统具体用于按照日志管理子系统设置的分析规则对日志信息进行分析。 [0016] DETAILED log analysis subsystem for analyzing the log information in the log management subsystem analysis rule set.

[0017] 一种日志处理方法,应用于上述日志处理系统,所述方法包括: [0017] A method for processing log, log processing is applied to the above-described system, the method comprising:

[0018] 应用子系统生成日志信息; [0018] Applications subsystem generates log information;

[0019] 应用子系统将生成的日志信息发给日志存储子系统存储。 [0019] Applications subsystem generates log information sent to the log storage subsystem storage.

[0020] 一种应用子系统,应用于上述日志处理系统,所述应用子系统包括: [0020] An application subsystem, log processing is applied to the above-described system, the application subsystem comprises:

[0021] 生成单元,用于生成日志信息; [0021] generating unit for generating log information;

[0022] 发送单元,用于将生成单元生成的日志信息发给日志存储子系统存储。 [0022] The sending unit, configured to log information generating unit generates the distributed storage log storage subsystem.

[0023] 一种日志处理方法,应用于上述日志处理系统,所述方法包括: [0023] A method for processing log, log processing is applied to the above-described system, the method comprising:

[0024] 日志存储子系统获得应用子系统发送的日志信息; [0024] log storage subsystem to obtain the log information transmitted application subsystem;

[0025] 日志存储子系统以消息队列的形式存储日志信息; [0025] The storage subsystem log information stored in the log message queue;

[0026] 当日志存储子系统获得日志分析子系统发送的提供日志信息的请求时,日志存储子系统将消息队列中的日志信息发送给日志分析子系统。 [0026] When the log log analysis to obtain the storage subsystem requesting subsystem provides the log information, the log information to the log storage subsystem transmits the message queue to the log analysis subsystem.

[0027] 优选地,日志存储子系统中设置有多个消息队列,每个消息队列都对应一种日志信息类型; [0027] Preferably, the log storage subsystem is provided with a plurality of message queues, each message queue corresponding to one kind of log information type;

[0028] 日志存储子系统获得的应用子系统发送的日志信息携带有用于表示日志信息类型的标识; [0028] Application of the log information acquired log storage subsystem carries subsystem sends log information for indicating the type of identifier;

[0029] 日志存储子系统以消息队列的形式存储日志信息包括:日志存储子系统根据所述标识,将日志信息存储在与所述标识所表示的日志信息类型相对应的消息队列中。 [0029] The storage subsystem log log information stored in the message queue comprising: a storage subsystem according to the identification log, the log information type identification indicated by the log information storage corresponding to the message queue.

[0030] 优选地,日志存储子系统获得的日志分析子系统发送的提供日志信息的请求携带有用于表示需要的日志信息类型的标识; [0030] Preferably, the storage subsystem log log analysis subsystem provides the obtained log information for indicating the request carries the identifier of the type of log information needs;

[0031 ] 日志存储子系统在将消息队列中的日志信息发送给日志分析子系统之前,根据所述用于表示需要的日志信息类型的标识,查找与所述需要的日志信息类型对应的消息队列; [0031] log storage subsystem sends the log information to the message queue before the log analysis subsystem, according to the type of representation required log information identifier, to find the log information corresponding to said desired type of message queue ;

[0032] 如果查找到的消息队列中有日志信息,则将查找到的消息队列中的日志信息提供给日志分析子系统。 [0032] If there is log information found in the message queue, the log information will be found in the message queue to provide log analysis subsystem.

[0033] 一种日志存储子系统,应用于上述日志处理系统,所述日志存储子系统包括: [0033] A log storage subsystem, log processing is applied to the above-described system, the log storage subsystem comprising:

[0034] 日志信息获得单元,用于获得应用子系统发送的日志信息; [0034] The log information obtaining unit for obtaining the log information sent from the application subsystem;

[0035] 存储单元,用于以消息队列的形式存储日志信息; [0035] The storage unit for storing log information in the form of a message queue;

[0036] 请求获得单元,用于获得日志分析子系统发送的提供日志信息的请求; [0036] request obtaining means for obtaining a request log analysis subsystem provides the log information transmitted;

[0037] 发送单元,用于当请求获得单元获得日志分析子系统发送的提供日志信息的请求时,将消息队列中的日志信息发送给日志分析子系统。 [0037] The sending unit, when the request for log analysis unit acquires log information request transmission subsystem is obtained, the send message queue of log information to the log analysis subsystem.

[0038] 优选地,存储单元中设置有多个消息队列,每个消息队列都对应一种日志信息类型; [0038] Preferably, the storage unit is provided with a plurality of message queues, each message queue corresponding to one kind of log information type;

[0039] 日志信息获得单元获得的应用子系统发送的日志信息携带有用于表示日志信息类型的标识; Application of the log information [0039] of the obtained log information obtaining unit carries subsystem sends log information for indicating the type of identifier;

[0040] 存储单元具体用于根据所述标识,将日志信息存储在与所述标识所表示的日志信息类型相对应的消息队列中。 [0040] specifically for the identification storage unit, the type of log information indicated by the identification corresponding to the log information storage according to the message queue.

[0041] 优选地,请求获得单元获得的日志分析子系统发送的提供日志信息的请求携带有用于表示需要的日志信息类型的标识;[0042] 所述日志存储子系统还包括: [0041] Preferably, the request obtaining unit obtains log analysis subsystem provides log information for indicating the request carries the identifier of the type of log information needs; [0042] The log storage subsystem further comprises:

[0043] 查找单元,用于在发送单元将消息队列中的日志信息发送给日志分析子系统之前,根据所述用于表示需要的日志信息类型的标识,查找与所述需要的日志信息类型对应的消息队列; By [0043] searching unit, configured to send the log information to the log message queue of the analysis subsystem in the transmission unit, based on the log information for identifying the type of representation required to find the log information corresponding to the type of the desired message queue;

[0044] 判断单元,用于在查找单元查找到与所述需要的日志信息类型对应的消息队列后,判断查找到的消息队列中是否有日志信息; [0044] determination means configured to, after the search unit found the log information corresponding to the desired type of the message queue, determines whether the log information found in the message queue;

[0045] 发送单元具体用于在判断单元确定查找到的消息队列中有日志信息后,将查找到的消息队列中的日志信息提供给日志分析子系统。 [0045] The sending unit is configured to find the message queue as log information, the log information found in the message queue to provide log analysis subsystem determination unit determines.

[0046] 一种日志处理方法,应用于上述日志处理系统,所述方法包括: [0046] A method for processing log, log processing is applied to the above-described system, the method comprising:

[0047] 日志分析子系统从日志存储子系统中读取日志信息; [0047] Log analysis subsystem reads the log information from the log storage subsystem;

[0048] 日志分析子系统对读取的日志信息进行分析。 [0048] Log analysis subsystem of the read log information is analyzed.

[0049] 优选地,日志存储子系统中设置有多个消息队列,每个消息队列都对应一种日志信息类型; [0049] Preferably, the log storage subsystem is provided with a plurality of message queues, each message queue corresponding to one kind of log information type;

[0050] 日志分析子系统从日志存储子系统中读取日志信息包括:日志分析子系统根据用于表示日志信息类型的标识,从日志存储子系统中的消息队列中读取日志信息。 [0050] Log analysis subsystem reads the log information from the log storage subsystem comprising: a log analysis subsystem log information type identifier, the log information is read from the log storage subsystem according to the message queue of FIG.

[0051 ] 一种日志分析子系统,应用于上述日志处理系统,所述日志分析子系统包括: [0051] A log analysis subsystem, log processing is applied to the above-described system, the log analysis subsystem comprising:

[0052] 读取单元,用于从日志存储子系统中读取日志信息; [0052] The reading unit for reading the log information from the log storage subsystem;

[0053] 分析单元,用于对读取的日志信息进行分析。 [0053] The analyzing unit for analyzing the read log information.

[0054] 优选地,日志存储子系统中设置有多个消息队列,每个消息队列都对应一种日志信息类型; [0054] Preferably, the log storage subsystem is provided with a plurality of message queues, each message queue corresponding to one kind of log information type;

[0055] 读取单元具体用于根据用于表示日志信息类型的标识,从日志存储子系统中的消息队列中读取日志信息。 [0055] DETAILED reading unit for indicating the type of log information according to the identifier, reading the log information from the log storage subsystem message queue.

[0056] 在本发明中,日志处理系统中的应用子系统生成日志信息后,将日志信息发给独立于应用子系统的日志存储子系统,日志分析子系统可以从日志存储子系统中读取日志信息并分析日志信息,这样,在日志处理过程中,就不需要应用子系统暂存日志信息,从而无须占用应用子系统的存储资源,减少了对应用子系统的影响。 After [0056] In the present invention, the application system log processing subsystem generates log information, the log information to the log independent of the application subsystem storage subsystem, the subsystem can read the log analysis from the log storage subsystem log information and analyze log information, so that the log process, you do not need application subsystem staging log information, so no need to take up storage resource application subsystems, reducing the impact on the application subsystem.

[0057] 在现有技术中,应用子系统中设置有日志记录模块,日志记录模块与日志分析子系统之间进行交互,如果日志记录模块进行升级等变更操作,那么就会影响到日志分析子系统的正常工作,所以,在现有技术中,应用子系统与日志分析子系统高度耦合。 [0057] In the prior art, application subsystem logging module is provided, to interact between the logging module logs and analysis subsystem, if the logging module upgrade change operation, it will affect the log analysis sub normal operation of the system, therefore, in the prior art, a log analysis subsystem and the application subsystem highly coupled. 在本发明中,日志存储子系统独立于应用子系统,日志分析子系统从日志存储子系统读取日志信息, 即使应用子系统进行升级等变更操作,也几乎不会影响到日志存储子系统和日志分析子系统的正常工作,所以,日志存储子系统和日志分析子系统与应用子系统之间的耦合度低。 In the present invention, the log storage subsystem is independent of the application subsystem, log analysis subsystem reads the log information from the log storage subsystem, even if the application subsystem upgrade change operation, hardly affects the log storage subsystem and log analysis subsystem normal operation, therefore, the log storage and log analysis subsystem low coupling between the subsystem and the application subsystem.

[0058] 在现有技术中,日志分析子系统获得多个应用子系统发送的日志信息,之后,日志分析子系统还需要对这些日志信息进行整理,如果获得的日志信息的数量和类型越多,那么日志分析子系统对日志信息的整理就会越复杂,工作量就会越大。 [0058] In the prior art, a log analysis subsystem to obtain the log information transmitted from a plurality of sub-applications, after the log analysis subsystem further log information needs to sort, the more the number and type of log information if the obtained then log analysis subsystem sort of log information on the more complex, the greater workload. 在本发明中,日志存储子系统以消息队列的形式存储日志信息,这样,在日志存储子系统中就已将日志信息进行了整理,无须日志分析子系统对日志信息进行整理,减少了日志分析子系统的工作量。 In the present invention, the log storage subsystem log information stored in the form of message queue, so that, already in the log storage subsystem to finish the log information, the log analysis subsystem without sort of log information, the log analysis reduces subsystem workload.

附图说明[0059] 为了更清楚地说明本发明实施例或现有技术中的技术方案,下面将对实施例或现有技术描述中所需要使用的附图作简单地介绍,显而易见地,下面描述中的附图仅仅是本发明的一些实施例,对于本领域普通技术人员来讲,在不付出创造性劳动的前提下,还可以根据这些附图获得其他的附图。 BRIEF DESCRIPTION [0059] In order to more clearly illustrate the technical solutions in the embodiments or the prior art embodiment of the present invention, the accompanying drawings for describing the embodiments or the prior art described in the introduction required simply Apparently, the following the drawings are merely described some embodiments of the present invention, those of ordinary skill in the art is concerned, without creative efforts, we can derive from these drawings other drawings.

[0060] 图1为现有的一种日志处理系统的示意图; [0060] FIG. 1 is a schematic diagram of a conventional log processing system;

[0061] 图2是本发明提供的日志处理系统的示意图; [0061] FIG. 2 is a schematic diagram of the log processing system of the present invention is provided;

[0062] 图3是本发明提供的日志处理方法的示意图; [0062] FIG. 3 is a schematic view of log processing method provided by the invention;

[0063] 图4是本发明提供的应用子系统的示意图; [0063] FIG. 4 is a schematic view of the application subsystem of the present invention provides;

[0064] 图5是本发明提供的另一种日志处理方法的示意图; [0064] FIG. 5 is a schematic diagram of another log processing method provided by the invention;

[0065] 图6是本发明提供的日志存储子系统的示意图; [0065] FIG. 6 is a schematic diagram of the present invention, the log storage subsystem is provided;

[0066] 图7是本发明提供的再一种日志处理方法的示意图; [0066] FIG. 7 is a schematic view of yet another log processing method provided by the invention;

[0067] 图8是本发明提供的日志分析子系统的示意图。 [0067] FIG. 8 is a schematic diagram of the present invention provides a log analysis subsystem.

具体实施方式 Detailed ways

[0068] 下面将结合本发明实施例中的附图,对本发明实施例中的技术方案进行清楚、完整地描述,显然,所描述的实施例仅仅是本发明一部分实施例,而不是全部的实施例。 [0068] below in conjunction with the present invention in the accompanying drawings, technical solutions of embodiments of the present invention are clearly and completely described, obviously, the described embodiments are merely part of embodiments of the present invention, but not all embodiments example. 基于本发明中的实施例,本领域普通技术人员在没有作出创造性劳动前提下所获得的所有其他实施例,都属于本发明保护的范围。 Based on the embodiments of the present invention, those of ordinary skill in the art to make all other embodiments without creative work obtained by, it falls within the scope of the present invention.

[0069] 为便于本领域技术人员更加清楚的理解本发明的技术方案,首先介绍本发明的技术方案所应用的网络环境。 [0069] In order to facilitate those skilled in the art to more clearly understand the technical solution of the present invention, the network environment introduces the technical solution of the present invention is applied.

[0070] 本发明的技术方案可以应用于图2所示的日志处理系统。 [0070] aspect of the present invention may log processing system shown in FIG. 2 is applied. 如图2所示,日志处理系统可以包括应用子系统、日志存储子系统和日志分析子系统。 As shown, the log processing system may include an application subsystem 2, subsystem log storage and log analysis subsystem. 应用子系统可以生成日志信息,并将日志信息发给日志存储子系统。 Application subsystem can generate log information and log information to the log storage subsystem. 日志存储子系统可以使用消息队列的形式存储日志信息。 Log storage subsystem can use message queue stored log information. 日志分析子系统对日志信息进行分析。 Log analysis subsystem log information for analysis.

[0071] 在本发明中,日志存储子系统在物理上独立于应用子系统,也就是说,日志存储子系统不与应用子系统同在一个服务器上,应用子系统可以采用异步的方式将日志信息发给日志存储子系统,这样应用子系统生成日志信息后,就将日志信息发给日志存储子系统,从而日志的存储和应用子系统就可以同时工作,不会在日志的存储处理时阻塞住。 [0071] In the present invention, the log storage subsystem physically independent of the application subsystem, that is, the log storage subsystem and the application subsystem is not the same on a server, the application subsystem may log an asynchronous manner the log information to the storage subsystem, so that the application subsystem generates log information, the log information will be sent to the log storage subsystem to the application subsystem and the log storage can work simultaneously, does not block the log storage process live. 日志存储子系统与日志分析子系统在物理上是否相互独立,可以由本领域技术人员根据实际需要而设计,本发明不做限定。 Log log storage subsystem and the analysis subsystem whether physically independent, may be devised by those skilled in the art according to actual needs, the present invention is not limited thereto.

[0072] 在本发明中,日志处理系统可以采用分布式设计形式,即,日志处理系统可以包括至少一个应用子系统、至少一个日志存储子系统和至少一个日志分析子系统。 [0072] In the present invention, the log processing system may take the form of distributed design, i.e., log processing system may comprise at least one application subsystem, storage subsystem and at least one log at least one log analysis subsystem. 如果日志处理系统包括多个应用子系统和多个日志存储子系统,那么可以为每一个应用子系统都规定对应的日志存储子系统,为每一个日志存储子系统都规定对应的应用子系统,每一个应用子系统可以只对应一个日志存储子系统,也可以对应多个日志存储子系统,每一个日志存储子系统可以只对应一个应用子系统,也可以对应多个应用子系统,具体的分布式结构可以由本领域技术人员根据实际需要而设计,这里不再赘述。 If the log processing system includes a plurality of applications and a plurality of subsystems log storage subsystems, it may have a predetermined corresponding log storage subsystem for each application subsystem for each of the log storage subsystem corresponding to a predetermined application subsystem, each application subsystem may correspond to only one log storage subsystem, may also correspond to a plurality of log storage subsystems, each subsystem may log storage subsystem corresponds to only one application, the application subsystem may correspond to a plurality of specific distribution structure is designed according to actual needs by those skilled in the art, it will not be repeated here.

[0073] 下面对本发明的一种日志处理系统进行说明。 [0073] Next, the processing system of the present invention is a journaling will be described. 如图2所示,日志处理系统包括:生成日志信息的应用子系统;独立于应用子系统并存储日志信息的日志存储子系统;分析日志信息的日志分析子系统。 As shown, the log processing system comprising: an application subsystem generates log information; independent of the application subsystem and store log information log storage subsystem; log analysis log information analysis subsystem. 应用子系统具体用于将日志信息发给日志存储子系统,日志存储子系统具体用于使用消息队列的形式存储日志信息,日志分析子系统具体用于从日志存储子系统读取日志信息并分析日志信息。 Specific application subsystem for the log information to the log storage subsystem, storage subsystem particular log message queue using the log information stored in the log analysis subsystem for reading the specific information from the log and analyze the log storage subsystem log information.

[0074] 应用子系统生成日志信息后,就可以将日志信息发给日志存储子系统,这样,日志信息就不必暂存在应用子系统中。 After [0074] application subsystem generates log information, the log information may be sent to the log storage subsystem, so, do not need to log information temporarily stored in the application subsystem.

[0075] 日志存储子系统中可以设置有多个消息队列,每个消息队列都对应一种日志信息类型,日志信息类型可以由用于表示日志信息类型的标识来表示。 [0075] log storage subsystem may be provided with a plurality of message queues, each message queue corresponding to one kind of type of log information, the log information may indicate the type identified by the type of log information to be represented. 一个消息队列可以只存储对应日志信息类型的日志信息。 A message queue can be stored in the log information corresponding to only the type of log information. 一个消息队列可以对应至少一个用于表示日志信息类型的标识。 A message queue may correspond to the log information representing at least one type of identification. 多个消息队列可以对应同一个用于表示日志信息类型的标识。 A plurality of message queues may correspond to the log information showing a type identifier for the same.

[0076] 应用子系统发给日志存储子系统的日志信息可以携带有用于表示日志信息类型的标识,这样,日志存储子系统可以根据日志信息携带的上述标识,将日志信息存储在与上述标识所表示的日志信息类型相对应的消息队列中。 The log information [0076] The distributed application subsystem log storage subsystem may carry log information for indicating the type of identification, so that, according to the log storage subsystem may carry the identification information of the log, the log information is stored in the marker type indicates the log information corresponding to a message queue. 或者说,日志存储子系统根据上述标识,查找与上述标识对应的消息队列,并将日志信息存储在查找到的消息队列中。 Or, the log storage subsystem based on the identifier, to find the message queue corresponding to the identifier, and stores the log information found in the message queue. 日志分析子系统可以根据用于表示日志信息类型的标识,从日志存储子系统读取需要的日志信息。 Log analysis subsystem may represent the type of log information according to the identifier, reading the log information from the log storage subsystem needs. 具体的,如果日志分析子系统需要分析某种日志信息类型的日志信息,那么日志分析子系统可以向日志存储子系统发送一个请求,这个请求表示需要日志存储子系统提供日志信息,这个请求可以携带有用于表示需要分析的这种日志信息类型的标识。 Specifically, if the log analysis subsystem logs need to analyze some type of log information, the log analysis subsystem may send a request to the log storage subsystem, the request indicates the required log storage subsystem provides the log information, the request may carry there used to represent such a log to be analyzed to identify the type of information. 日志存储子系统获得这个请求后,根据请求中携带的上述标识查找与上述标识对应的消息队列。 After the log storage subsystems receive this request, and to find the message queue corresponding to the identifier according to the identifier carried in the request. 如果查找到的消息队列中有日志信息,那么日志存储子系统将查找到的消息队列中的日志信息发给日志分析子系统。 If you have to find the log information to the message queue, the log storage subsystem to locate the log information to a message sent to the queue log analysis subsystem.

[0077] 在本发明中,日志分析子系统可以定时的监控日志存储子系统中的消息队列中是否有日志信息,如果有,则读取日志信息。 [0077] In the present invention, whether a log analysis log information storage subsystem subsystem may monitor the timing of the log in the message queue, if any, is read log information. 如果消息队列中没有日志信息,那么就继续监控。 If the message queue does not log information, then continue monitoring. 具体的,监控可以采用询问的方式。 Specifically, the monitor can ask the way to adopt. 例如,日志分析子系统可以定时的向日志存储子系统发出一个请求,用于询问消息队列中是否有日志信息,如果日志存储子系统中回复肯定的响应消息,则表示消息队列中有日志信息,如果日志存储子系统中回复否定的响应消息,或者在规定的时间内没有回复消息,则表示消息队列中没有日志信息。 For example, the log analysis subsystem may send a request to the timing of the log storage subsystem, the log information for inquiring whether a message queue, if a positive response in reply to a message log storage subsystem, said message queue as log information, If the log storage subsystem reply message in response to a negative, or no reply message within a predetermined time, it indicates that the message queue is no log information.

[0078] 需要说明的是,在日志分析子系统发给日志存储子系统的提供日志信息的请求中如果没有携带表示日志信息类型的标识,则可以说明日志分析子系统没有指定需要哪种类型的日志信息,这种情况下,日志存储子系统可以将任何一个消息队列中的日志信息发给日志分析子系统,也可以将多个消息队列中的日志信息发给日志分析子系统,还可以将所有的消息队列中的日志信息发给日志分析子系统。 [0078] Incidentally, the analysis log information in the log request sent to the log storage subsystem subsystem if there is no log information that carry identification of the type, it shows that the log analysis subsystem need not specify what type the log information, in this case, the log storage subsystem may log information of any message in the queue sent to the log analysis subsystem, and a plurality of message queues log information may be sent to the log analysis subsystem, may also be log all messages sent to the queue log analysis subsystem.

[0079] 同理,在日志分析子系统发给日志存储子系统的询问消息队列中是否有日志信息的请求中如果没有携带表示日志信息类型的标识,则可以说明日志分析子系统没有指定需要哪种类型的日志信息,这种情况下,如果日志存储子系统确定至少有一个消息队列中有日志信息,那么日志存储子系统可以向日志分析子系统回复肯定的响应消息,如果日志存储子系统确定所有的消息队列中都没有日志信息,那么日志存储子系统可以向日志分析子系统回复否定的响应消息,或者不回复消息。 [0079] Similarly, if there is a request in the log analysis log information in the log information if the type that carry no identification, instructions may be sent to the log storage subsystem subsystem interrogation message queue log analysis subsystem need not specify which types of log information, in this case, if the log storage subsystem determines at least one message queue as log information, the log may be analyzed storage subsystem replies to logging subsystem affirmative response message, the storage subsystem to determine if the log All messages in the queue are not the log information, the log to the log storage subsystem may be analyzed in response reply message subsystem negative, or no reply message.

[0080] 图2所示的日志处理系统还可以包括日志管理子系统,日志管理子系统用于设置用于分析日志信息的分析规则。 Log processing system shown in [0080] FIG 2 further includes a log management subsystem may log management subsystem is provided for analysis rule for analyzing the log information. 日志管理子系统可以将分析规则发给日志分析子系统,日志分析子系统可以按照分析规则对日志信息进行分析。 Log management subsystem can be sent to the log analysis subsystem analysis rules, log analysis subsystem can analyze the log information analysis in accordance with the rules.

[0081] 图2所示的日志处理系统还可以包括分析结果应用子系统,分析结果应用子系统用于应用日志分析子系统对日志信息分析的结果。 Log processing system shown in [0081] FIG. 2 may also include an application subsystem analysis result, the analysis result of the application subsystem to the application subsystem log analysis result of the analysis of the log information. 例如,分析结果应用子系统可以是经营分析子系统、监控子系统等。 For example, the results can be a business application subsystem analysis subsystem, monitoring subsystem and so on.

[0082] 基于上述的日志处理系统,本发明分别从应用子系统、日志存储子系统和日志分析子系统的角度,提供了多种日志处理方法、应用子系统、日志存储子系统和日志分析子系统。 [0082] Based on the above-described log processing system of the present invention, respectively, from the application subsystem, storage subsystem logs and log analysis point subsystem provides a plurality of log processing method, application subsystem, storage subsystem logs and log analysis sub system.

[0083] 首先从应用子系统的角度来介绍一种日志处理方法和应用子系统。 [0083] First, from the perspective of the application subsystem to introduce a method and a log processing application subsystem.

[0084] 如图3所示,一种日志处理方法包括: [0084] As shown in FIG 3 A log processing method comprising:

[0085] S301 :应用子系统生成日志信息; [0085] S301: application subsystem generates log information;

[0086] S302 :应用子系统将生成的日志信息发给日志存储子系统存储。 [0086] S302: The application subsystem generates log information sent to the log storage subsystem storage.

[0087] 应用子系统生成日志信息后,就可以将日志信息发给日志存储子系统,这样,日志信息就不必暂存在应用子系统中。 After [0087] application subsystem generates log information, the log information may be sent to the log storage subsystem, so, do not need to log information temporarily stored in the application subsystem.

[0088] 应用子系统发给日志存储子系统的日志信息可以携带有用于表示日志信息类型的标识,这样,日志存储子系统可以根据日志信息携带的上述标识,将日志信息存储在与上述标识所表示的日志信息类型相对应的消息队列中。 The log information [0088] The distributed application subsystem log storage subsystem may carry log information for indicating the type of identification, so that, according to the log storage subsystem may carry the identification information of the log, the log information is stored in the marker type indicates the log information corresponding to a message queue.

[0089] 如图4所示,一种应用子系统包括:生成单元401,用于生成日志信息;发送单元402,用于将生成单元401生成的日志信息发给日志存储子系统存储。 [0089] As shown in FIG 4, an application subsystem comprising: a generating unit 401 for generating log information; transmitting unit 402 is configured to log information generating unit 401 generates a log of the distributed storage subsystem storage.

[0090] 生成单元401生成日志信息后,发送单元402就可以将日志信息发给日志存储子系统,这样,日志信息就不必暂存在应用子系统中。 After [0090] The generating unit 401 generates log information, the transmission unit 402 can log information to the log storage subsystem, so, do not need to log information temporarily stored in the application subsystem.

[0091] 发送单元402发给日志存储子系统的日志信息可以携带有用于表示日志信息类型的标识,这样,日志存储子系统可以根据日志信息携带的上述标识,将日志信息存储在与上述标识所表示的日志信息类型相对应的消息队列中。 The log information [0091] transmission sent to the log storage unit 402 may carry subsystem log information for indicating the type of identification, so that, according to the log storage subsystem may carry the identification information of the log, the log information is stored in the marker type indicates the log information corresponding to a message queue.

[0092] 下面从日志存储子系统的角度来介绍一种日志处理方法和日志存储子系统。 [0092] Next, from the perspective of the log storage subsystem to introduce a method and a log processing log storage subsystem.

[0093] 如图5所示,一种日志处理方法包括: [0093] As shown in FIG 5 A log processing method comprising:

[0094] S501 :日志存储子系统获得应用子系统发送的日志信息; [0094] S501: log storage subsystem obtain application subsystem sends log information;

[0095] S502 :日志存储子系统以消息队列的形式存储日志信息; [0095] S502: log storage subsystem information is stored as a log message queue;

[0096] S503 :当日志存储子系统获得日志分析子系统发送的提供日志信息的请求时,日志存储子系统将消息队列中的日志信息发送给日志分析子系统。 [0096] S503: When the log log analysis to obtain the storage subsystem requesting subsystem provides the log information, the log information to the log storage subsystem transmits the message queue to the log analysis subsystem.

[0097] 日志存储子系统中可以设置有多个消息队列,每个消息队列都对应一种日志信息类型。 [0097] The log storage subsystem may be provided with a plurality of message queues, each message queue corresponding to one kind of log information type. 日志存储子系统获得的应用子系统发送的日志信息可以携带有用于表示日志信息类型的标识。 Log log storage subsystem transmits the obtained application subsystem may carry log information for indicating the type of identifier. 日志存储子系统可以根据上述标识,将日志信息存储在与上述标识所表示的日志信息类型相对应的消息队列中。 According to the storage subsystem may log identifier, the log in the log information identifying the type represented by the above corresponding information is stored in the message queue.

[0098] 日志存储子系统获得的日志分析子系统发送的提供日志信息的请求可以携带有用于表示需要的日志信息类型的标识。 [0098] log log storage subsystem analysis subsystem provides the obtained log information may carry the request for the log information representing the type required identification. 日志存储子系统在将消息队列中的日志信息发送给日志分析子系统之前,可以根据上述用于表示需要的日志信息类型的标识,查找与上述需要的日志信息类型对应的消息队列。 Log storage subsystem sends the log information to the log message queue before analysis subsystem may log the information for indicating the type described above require the identification of, and to find the log information corresponding to the desired type described above according to the message queue. 如果查找到的消息队列中有日志信息,则将查找到的消息队列中的日志信息提供给日志分析子系统。 If you have to find the log information to the message queue, the log information will be found in the message queue subsystem provides analysis to the log.

[0099] 如图6所示,一种日志存储子系统包括:日志信息获得单元601,用于获得应用子系统发送的日志信息;存储单元602,用于以消息队列的形式存储日志信息;请求获得单元603,用于获得日志分析子系统发送的提供日志信息的请求;发送单元604,用于当请求获得单元603获得日志分析子系统发送的提供日志信息的请求时,将消息队列中的日志信息发送给日志分析子系统。 [0099] FIG. 6 A log storage subsystem comprising: a log information obtaining unit 601 for obtaining the log information transmitted from the application subsystem; storage unit 602, for storing log information in the form of a message queue; requesting obtaining unit 603, a log analysis request for obtaining the log information transmitted subsystem; transmitting unit 604, when the request for obtaining the log analysis unit 603 is requested to obtain the log information transmitted from a subsystem, the log message queue information sent to the log analysis subsystem.

[0100] 存储单元602中可以设置有多个消息队列,每个消息队列都对应一种日志信息类型。 [0100] The storage unit 602 may be provided with a plurality of message queues, each message queue corresponding to one kind of log information type. 日志信息获得单元601获得的应用子系统发送的日志信息可以携带有用于表示日志信息类型的标识。 Log log information of the application information obtaining unit 601 may be obtained by carrying subsystem sends log information for indicating the type of identifier. 存储单元602可以根据上述标识,将日志信息存储在与上述标识所表示的日志信息类型相对应的消息队列中。 The storage unit 602 may be based on the identifier, the log in the log information identifying the type represented by the above corresponding information is stored in the message queue.

[0101] 请求获得单元603获得的日志分析子系统发送的提供日志信息的请求可以携带有用于表示需要的日志信息类型的标识。 Log [0101] request obtaining unit 603 obtained by the analysis subsystem provides log information request may carry information for representing the log type required identification.

[0102] 图6所示的日志存储子系统还可以包括:查找单元605,用于在发送单元604将消息队列中的日志信息发送给日志分析子系统之前,根据上述用于表示需要的日志信息类型的标识,查找与上述需要的日志信息类型对应的消息队列;判断单元606,用于在查找单元605查找到与上述需要的日志信息类型对应的消息队列后,判断查找到的消息队列中是否有日志信息;发送单元604在判断单元606确定查找到的消息队列中有日志信息后,将查找到的消息队列中的日志信息提供给日志分析子系统。 Log storage subsystem shown in [0102] FIG. 6 may further include: a searching unit 605, a transmitting unit 604 transmits the log information to the log message queue before analysis subsystem, the log information according to the above for indicating desired type identifier, to find the log information corresponding to the type described above require message queue; determining unit 606, for the above-described need to find the log information corresponding to the type of message queue search unit 605 determines to find whether the message queue as log information; after transmitting unit 604 has a log information determination unit 606 determines the message queue to find the log information found in the message queue to provide log analysis subsystem.

[0103] 上述的日志处理方法和日志存储子系统的具体描述可以参见上述的日志处理系统实施例中的相关描述,这里不再赘述。 [0103] Log processing method, and detailed description of the log storage subsystem can be found in the above-described log processing system in the related embodiment described will not be repeated here.

[0104] 下面从日志分析子系统的角度来介绍一种日志处理方法和日志分析子系统。 [0104] The following log analysis from the perspective of the subsystem processing method introduces a log and log analysis subsystem.

[0105] 如图7所示,一种日志处理方法包括: [0105] As shown in FIG 7 A log processing method comprising:

[0106] S701 :日志分析子系统从日志存储子系统中读取日志信息; [0106] S701: Log analysis subsystem reads the log information from the log storage subsystem;

[0107] S702 :日志分析子系统对读取的日志信息进行分析。 [0107] S702: log analysis subsystem of the read log information is analyzed.

[0108] 日志存储子系统中可以设置有多个消息队列,每个消息队列都对应一种日志信息类型。 [0108] log storage subsystem may be provided with a plurality of message queues, each message queue corresponding to one kind of log information type. 日志分析子系统可以根据用于表示日志信息类型的标识,从日志存储子系统中的消息队列中读取日志信息。 Log analysis subsystem may represent the type of log information according to the identifier, reading the log information from the log storage subsystem message queue.

[0109] 日志分析子系统可以定时的监控日志存储子系统中的消息队列中是否有日志信息,如果有,则读取日志信息。 [0109] whether a log analysis log information storage subsystem subsystem may monitor the timing of the log in the message queue, if any, is read log information. 如果消息队列中没有日志信息,那么就继续监控。 If the message queue does not log information, then continue monitoring.

[0110] 如图8所示,一种日志分析子系统包括:读取单元801,用于从日志存储子系统中读取日志信息;分析单元802,用于对读取的日志信息进行分析。 [0110] As shown in FIG An 8 log analysis subsystem comprising: a reading unit 801 for reading the log information from the log storage subsystem; analysis unit 802, the read log information for analysis.

[0111] 日志存储子系统中可以设置有多个消息队列,每个消息队列都对应一种日志信息类型。 [0111] log storage subsystem may be provided with a plurality of message queues, each message queue corresponding to one kind of log information type. 读取单元801可以根据用于表示日志信息类型的标识,从日志存储子系统中的消息队列中读取日志信息。 The reading unit 801 may represent a type of identification information of the log, the log information is read from the log storage subsystem according to the message queue.

[0112] 上述的日志处理方法和日志分析子系统的具体描述可以参见上述的日志处理系统实施例中的相关描述,这里不再赘述。 [0112] detailed description of the above-described processing method and log log analysis subsystem can be found in the above-described log processing system in the related embodiment described will not be repeated here.

[0113] 在本发明中,日志处理系统中的应用子系统生成日志信息后,将日志信息发给独立于应用子系统的日志存储子系统,日志分析子系统可以从日志存储子系统中读取日志信息并分析日志信息,这样,在日志处理过程中,就不需要应用子系统暂存日志信息,从而无须占用应用子系统的存储资源,减少了对应用子系统的影响。 After [0113] In the present invention, the application system log processing subsystem generates log information, the log information to the log independent of the application subsystem storage subsystem, the subsystem can read the log analysis from the log storage subsystem log information and analyze log information, so that the log process, you do not need application subsystem staging log information, so no need to take up storage resource application subsystems, reducing the impact on the application subsystem.

[0114] 在现有技术中,应用子系统中设置有日志记录模块,日志记录模块与日志分析子系统之间进行交互,如果日志记录模块进行升级等变更操作,那么就会影响到日志分析子系统的正常工作,所以,在现有技术中,应用子系统与日志分析子系统高度耦合。 [0114] In the prior art, application subsystem logging module is provided, to interact between the logging module logs and analysis subsystem, if the logging module upgrade change operation, it will affect the log analysis sub normal operation of the system, therefore, in the prior art, a log analysis subsystem and the application subsystem highly coupled. 在本发明中,日志存储子系统独立于应用子系统,日志分析子系统从日志存储子系统读取日志信息, 即使应用子系统进行升级等变更操作,也几乎不会影响到日志存储子系统和日志分析子系统的正常工作,所以,日志存储子系统和日志分析子系统与应用子系统之间的耦合度低。 In the present invention, the log storage subsystem is independent of the application subsystem, log analysis subsystem reads the log information from the log storage subsystem, even if the application subsystem upgrade change operation, hardly affects the log storage subsystem and log analysis subsystem normal operation, therefore, the log storage and log analysis subsystem low coupling between the subsystem and the application subsystem.

[0115] 在现有技术中,日志分析子系统获得多个应用子系统发送的日志信息,之后,日志分析子系统还需要对这些日志信息进行整理,如果获得的日志信息的数量和类型越多,那么日志分析子系统对日志信息的整理就会越复杂,工作量就会越大。 [0115] In the prior art, a log analysis subsystem to obtain the log information transmitted from a plurality of sub-applications, after the log analysis subsystem further log information needs to sort, the more the number and type of log information if the obtained then log analysis subsystem sort of log information on the more complex, the greater workload. 在本发明中,日志存储子系统以消息队列的形式存储日志信息,这样,在日志存储子系统中就已将日志信息进行了整理,无须日志分析子系统对日志信息进行整理,减少了日志分析子系统的工作量。 In the present invention, the log storage subsystem log information stored in the form of message queue, so that, already in the log storage subsystem to finish the log information, the log analysis subsystem without sort of log information, the log analysis reduces subsystem workload.

[0116] 本领域普通技术人员可以理解实现上述实施例方法中的全部或部分流程,是可以通过计算机程序来指令相关的硬件来完成,所述的程序可存储于一计算机可读取存储介质中,该程序在执行时,可包括如上述各方法的实施例的流程。 [0116] Those of ordinary skill in the art may understand that the above-described method embodiments all or part of the processes may be related hardware instructed by a computer program, the program may be stored in a computer readable storage medium. when the program is executed, the processes of the foregoing method embodiments. 其中,所述的存储介质可为磁碟、光盘、只读存储记忆体(Read-Only Memory, ROM)或随机存储记忆体(Random Access Memory, RAM)等。 Wherein the storage medium may be a magnetic disk, an optical disk, read-only memory (Read-Only Memory, ROM) or a random access memory (Random Access Memory, RAM) and the like.

[0117] 以上所述仅是本发明的优选实施方式,应当指出,对于本技术领域的普通技术人员来说,在不脱离本发明原理的前提下,还可以作出若干改进和润饰,这些改进和润饰也应视为本发明的保护范围。 [0117] The above are only preferred embodiments of the present invention, it should be noted that those of ordinary skill in the art who, without departing from the principles of the present invention, further improvements and modifications may be made, such modifications and modifications should be the scope of the present invention.

Claims (17)

1. 一种日志处理系统,其特征在于,包括:生成日志信息的应用子系统;独立于应用子系统并存储日志信息的日志存储子系统;分析日志信息的日志分析子系统;应用子系统具体用于将日志信息发给日志存储子系统,日志存储子系统具体用于使用消息队列的形式存储日志信息,日志分析子系统具体用于从日志存储子系统读取日志信息并分析日志信息。 A log processing system comprising: an application subsystem generates log information; independent of the application subsystem and store log information log storage subsystem; log analysis log information analysis subsystem; specific application subsystem send the log to log information for the storage subsystem, storage subsystem particular log message queue using the log information stored in the log analysis subsystem for reading the specific information from the log and the log storage subsystem analyzes the log information.
2.如权利要求1所述的系统,其特征在于,日志存储子系统中设置有多个消息队列,每个消息队列都对应一种日志信息类型;应用子系统发给日志存储子系统的日志信息携带有用于表示日志信息类型的标识;日志存储子系统具体用于根据所述标识,将日志信息存储在与所述标识所表示的日志信息类型相对应的消息队列中。 2. The system according to claim 1, wherein the log storage subsystem is provided with a plurality of message queues, each message queue corresponding to one kind of log information type; distributed application subsystem log log storage subsystem carries information for indicating the type of log information identifier; log storage subsystem according to the specific identifier, the type of log information indicated by the identification corresponding to the log information storage message queue.
3.如权利要求2所述的系统,其特征在于,日志分析子系统具体用于根据所述标识,从日志存储子系统读取需要的日志信息。 3. The system according to claim 2, characterized in that, particularly for log analysis subsystem according to the identifier, the storage subsystem needs to read from the log log information.
4.如权利要求1所述的系统,其特征在于,日志分析子系统具体用于定时监控日志存储子系统中的消息队列中是否有日志信息,如果有,则读取日志信息。 4. The system according to claim 1, wherein the specific log analysis subsystem for determining whether there is log information in the storage subsystem to periodically monitor the log message queue, if any, is read log information.
5.如权利要求1所述的系统,其特征在于,还包括日志管理子系统,用于设置用于分析日志信息的分析规则;日志分析子系统具体用于按照日志管理子系统设置的分析规则对日志信息进行分析。 5. The system according to claim 1, characterized by further comprising a log management subsystem is provided for analysis rule for analyzing the log information; log analysis subsystems for analysis rule set in accordance with the specific subsystem log management log information for analysis.
6. 一种日志处理方法,其特征在于,应用于权利要求1-5任意一项所述的日志处理系统,所述方法包括:应用子系统生成日志信息;应用子系统将生成的日志信息发给日志存储子系统存储。 A method for processing a log, wherein the log processing system is applied to any one of claims 1-5, said method comprising: an application subsystem generates log information; application subsystem generates log information sent to the log storage subsystem storage.
7. 一种应用子系统,其特征在于,应用于权利要求1-5任意一项所述的日志处理系统, 所述应用子系统包括:生成单元,用于生成日志信息;发送单元,用于将生成单元生成的日志信息发给日志存储子系统存储。 An application subsystem, wherein the log processing system of any one of claims 1-5 is applied, the application subsystem comprises: generating means for generating log information; transmitting means for the log information generating unit generates a log of the distributed storage subsystem storage.
8. 一种日志处理方法,其特征在于,应用于权利要求1-5任意一项所述的日志处理系统,所述方法包括:日志存储子系统获得应用子系统发送的日志信息;日志存储子系统以消息队列的形式存储日志信息;当日志存储子系统获得日志分析子系统发送的提供日志信息的请求时,日志存储子系统将消息队列中的日志信息发送给日志分析子系统。 A method for processing a log, wherein the log processing system is applied to any one of claims 1-5, said method comprising: log storage subsystem to obtain the log information transmitted from the application subsystem; log storage subsystem the system log information stored in the message queue; obtained when the log storage subsystem request log analysis subsystem provides the log information, the log storage subsystem transmits log information in the message queue to the log analysis subsystem.
9.如权利要求8所述的方法,其特征在于,日志存储子系统中设置有多个消息队列,每个消息队列都对应一种日志信息类型;日志存储子系统获得的应用子系统发送的日志信息携带有用于表示日志信息类型的标识;日志存储子系统以消息队列的形式存储日志信息包括:日志存储子系统根据所述标识,将日志信息存储在与所述标识所表示的日志信息类型相对应的消息队列中。 9. The method according to claim 8, wherein the log storage subsystem is provided with a plurality of message queues, each message queue corresponding to one kind of log information type; Storage Subsystem Application Log obtained transmission subsystem log log information carries information for indicating the type of identifier; log stored in the log storage subsystem message queue information includes: a storage subsystem according to the identification log, the log information stored in the log information type identification indicated corresponding to the message queue.
10.如权利要求9所述的方法,其特征在于,日志存储子系统获得的日志分析子系统发送的提供日志信息的请求携带有用于表示需要的日志信息类型的标识;日志存储子系统在将消息队列中的日志信息发送给日志分析子系统之前,根据所述用于表示需要的日志信息类型的标识,查找与所述需要的日志信息类型对应的消息队列;如果查找到的消息队列中有日志信息,则将查找到的消息队列中的日志信息提供给日志分析子系统。 10. The method according to claim 9, wherein the log storage subsystem log analysis subsystem provides the obtained log information for indicating the request carries the identifier of the type of log information needs; the log storage subsystem before sending the log information to the log message queue analysis subsystem, according to the type of representation required log information identifier, to find the log information corresponding to the type of the message queues required; if the found message queue has log information log information, then find the message queue is provided to the log analysis subsystem.
11. 一种日志存储子系统,其特征在于,应用于权利要求1-5任意一项所述的日志处理系统,所述日志存储子系统包括:日志信息获得单元,用于获得应用子系统发送的日志信息;存储单元,用于以消息队列的形式存储日志信息;请求获得单元,用于获得日志分析子系统发送的提供日志信息的请求;发送单元,用于当请求获得单元获得日志分析子系统发送的提供日志信息的请求时, 将消息队列中的日志信息发送给日志分析子系统。 A log storage subsystem, wherein the log processing system of any one of claims 1-5 is applied to the log storage subsystem comprising: a log information obtaining unit for obtaining transmission application subsystem log information; a storage unit for storing log information in the form of a message queue; request obtaining unit, for obtaining the requested log analysis subsystem sends the log information; transmitting means for, when a request obtaining unit obtains log analysis sub when the system log information provision request transmitted, the log information is transmitted in the message queue to the log analysis subsystem.
12.如权利要求11所述的日志存储子系统,其特征在于,存储单元中设置有多个消息队列,每个消息队列都对应一种日志信息类型;日志信息获得单元获得的应用子系统发送的日志信息携带有用于表示日志信息类型的标识;存储单元具体用于根据所述标识,将日志信息存储在与所述标识所表示的日志信息类型相对应的消息队列中。 12. The log storage subsystem as claimed in claim 11, wherein the storage unit is provided with a plurality of message queues, each message queue corresponding to one kind of log information type; application obtaining unit to obtain the log information transmission subsystem log log information carries information for indicating the type of identifier; specifically for the storage unit according to the identifier, the type of log information indicated by the identification corresponding to the log information storage message queue.
13.如权利要求12所述的日志存储子系统,其特征在于,请求获得单元获得的日志分析子系统发送的提供日志信息的请求携带有用于表示需要的日志信息类型的标识;所述日志存储子系统还包括:查找单元,用于在发送单元将消息队列中的日志信息发送给日志分析子系统之前,根据所述用于表示需要的日志信息类型的标识,查找与所述需要的日志信息类型对应的消息队列;判断单元,用于在查找单元查找到与所述需要的日志信息类型对应的消息队列后,判断查找到的消息队列中是否有日志信息;发送单元具体用于在判断单元确定查找到的消息队列中有日志信息后,将查找到的消息队列中的日志信息提供给日志分析子系统。 13. The log storage subsystem according to claim 12, wherein the log analysis unit obtains log information request to request transmission subsystem for carrying information identifying the type of log representing required; the log storage subsystem further comprising: a searching unit, the transmitting unit for transmitting the log information to the log message queue before analysis subsystem, according to the type of representation required log information identifier, to find the log information required corresponding to the type of message queue; determining unit, configured to find the means to find the desired type of log information corresponding to the message queue, determines whether the log information found in the message queue; determining unit transmits the unit is configured to after determining the found message queue as log information, the log information found in the message queue to provide log analysis subsystem.
14. 一种日志处理方法,其特征在于,应用于权利要求1-5任意一项所述的日志处理系统,所述方法包括:日志分析子系统从日志存储子系统中读取日志信息;日志分析子系统对读取的日志信息进行分析。 14. A method for processing a log, wherein the log processing system is applied to any one of claims 1-5, said method comprising: a log analysis subsystem reads the log information from the log storage subsystem; log analysis subsystem reads the log information for analysis.
15.如权利要求14所述的方法,其特征在于,日志存储子系统中设置有多个消息队列, 每个消息队列都对应一种日志信息类型;日志分析子系统从日志存储子系统中读取日志信息包括:日志分析子系统根据用于表示日志信息类型的标识,从日志存储子系统中的消息队列中读取日志信息。 15. The method according to claim 14, wherein the log storage subsystem is provided with a plurality of message queues, each message queue corresponding to one kind of log information type; log analysis subsystem is read from the log storage subsystem take the log information includes: a log analysis subsystem represents the type of log information according to the identifier, reading the log information from the log storage subsystem message queue.
16. 一种日志分析子系统,其特征在于,应用于权利要求1-5任意一项所述的日志处理系统,所述日志分析子系统包括:读取单元,用于从日志存储子系统中读取日志信息; 分析单元,用于对读取的日志信息进行分析。 16. A log analysis subsystem, wherein the log processing system is applied to any one of claims 1-5, the log analysis subsystem comprising: a reading unit for the storage subsystem from the log reading the log information; analyzing means for analyzing the read log information.
17.如权利要求16所述的日志分析子系统,其特征在于,日志存储子系统中设置有多个消息队列,每个消息队列都对应一种日志信息类型;读取单元具体用于根据用于表示日志信息类型的标识,从日志存储子系统中的消息队列中读取日志信息。 17. The log analysis subsystem according to claim 16, wherein the log storage subsystem is provided with a plurality of message queues, each message queue corresponding to one kind of log information type; accordance with the reading unit specifically for representing the type of the log information identifier, reads the log information from the log storage subsystem message queue.
CN2010102718155A 2010-09-02 2010-09-02 Log processing system, log processing method and log storage sub-system CN102385549A (en)

Priority Applications (1)

Application Number Priority Date Filing Date Title
CN2010102718155A CN102385549A (en) 2010-09-02 2010-09-02 Log processing system, log processing method and log storage sub-system

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
CN2010102718155A CN102385549A (en) 2010-09-02 2010-09-02 Log processing system, log processing method and log storage sub-system

Publications (1)

Publication Number Publication Date
CN102385549A true CN102385549A (en) 2012-03-21

Family

ID=45824979

Family Applications (1)

Application Number Title Priority Date Filing Date
CN2010102718155A CN102385549A (en) 2010-09-02 2010-09-02 Log processing system, log processing method and log storage sub-system

Country Status (1)

Country Link
CN (1) CN102385549A (en)

Cited By (7)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103838624A (en) * 2013-12-16 2014-06-04 浪潮电子信息产业股份有限公司 Log processing method based on Linux message queue
CN104253835A (en) * 2013-06-27 2014-12-31 阿里巴巴集团控股有限公司 User behavior data acquisition method and system
CN104937886A (en) * 2013-01-30 2015-09-23 日本电信电话株式会社 Log analysis device, information processing method and program
CN106027595A (en) * 2016-04-25 2016-10-12 乐视控股(北京)有限公司 Access log processing method and system for CDN node
CN106105112A (en) * 2014-03-19 2016-11-09 日本电信电话株式会社 Analysis rule adjustment device, analysis rule adjustment system, analysis rule adjustment method, and analysis rule adjustment program
CN106169959A (en) * 2016-07-21 2016-11-30 柳州龙辉科技有限公司 Log processing device
CN103729380B (en) * 2012-10-16 2018-11-20 阿里巴巴集团控股有限公司 A data processing method, system and apparatus

Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1642104A (en) * 2004-01-05 2005-07-20 华为技术有限公司 Method and device for realizing system journal
CN1677931A (en) * 2004-04-02 2005-10-05 鸿富锦精密工业(深圳)有限公司 Network daily-record data management system and method
CN101267338A (en) * 2008-04-23 2008-09-17 杭州思福迪信息技术有限公司 High-performance log and behavior auditing system
CN101594252A (en) * 2009-06-01 2009-12-02 中兴通讯股份有限公司 Mass log storage and management system and mass log storage and management method

Patent Citations (4)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN1642104A (en) * 2004-01-05 2005-07-20 华为技术有限公司 Method and device for realizing system journal
CN1677931A (en) * 2004-04-02 2005-10-05 鸿富锦精密工业(深圳)有限公司 Network daily-record data management system and method
CN101267338A (en) * 2008-04-23 2008-09-17 杭州思福迪信息技术有限公司 High-performance log and behavior auditing system
CN101594252A (en) * 2009-06-01 2009-12-02 中兴通讯股份有限公司 Mass log storage and management system and mass log storage and management method

Cited By (10)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
CN103729380B (en) * 2012-10-16 2018-11-20 阿里巴巴集团控股有限公司 A data processing method, system and apparatus
CN104937886B (en) * 2013-01-30 2017-10-24 日本电信电话株式会社 Log analysis apparatus, an information processing method
US9860278B2 (en) 2013-01-30 2018-01-02 Nippon Telegraph And Telephone Corporation Log analyzing device, information processing method, and program
CN104937886A (en) * 2013-01-30 2015-09-23 日本电信电话株式会社 Log analysis device, information processing method and program
CN104253835A (en) * 2013-06-27 2014-12-31 阿里巴巴集团控股有限公司 User behavior data acquisition method and system
CN104253835B (en) * 2013-06-27 2018-11-16 阿里巴巴集团控股有限公司 User behavior data acquisition method and system
CN103838624A (en) * 2013-12-16 2014-06-04 浪潮电子信息产业股份有限公司 Log processing method based on Linux message queue
CN106105112A (en) * 2014-03-19 2016-11-09 日本电信电话株式会社 Analysis rule adjustment device, analysis rule adjustment system, analysis rule adjustment method, and analysis rule adjustment program
CN106027595A (en) * 2016-04-25 2016-10-12 乐视控股(北京)有限公司 Access log processing method and system for CDN node
CN106169959A (en) * 2016-07-21 2016-11-30 柳州龙辉科技有限公司 Log processing device

Similar Documents

Publication Publication Date Title
US7483959B2 (en) Method and system for extensible data gathering
JP4647234B2 (en) Method and apparatus for a network device to discovery
EP1565823B1 (en) Heartbeat mechanism for cluster systems
JP4668567B2 (en) System and method for client-based web crawling
EP1349065A2 (en) Symmetrical multiprocessing in multiprocessor systems
CN100514306C (en) Method and device of autonomic failover in the context of distributed WEB services
CN101142561B (en) Method and system for storing data in content addressed storage
US20080181245A1 (en) System and Method for Multicore Communication Processing
US20140195657A1 (en) Implementation on baseboard management controller of single out-of-band communication access to multiple managed computer nodes
KR100943012B1 (en) Merging multi-line log entries
US20100211694A1 (en) Routing users to receive online services based on online behavior
CN101044463B (en) Method and system for monitoring performance of a client-server architecture
US20060235664A1 (en) Model-based capacity planning
KR20050106590A (en) Grid service scheduling of related services using heuristics
JPH07225726A (en) Method and system for monitoring performance and status of computer network
Humphrey et al. State and events for web services: a comparison of five WS-resource framework and WS-notification implementations
CN1929472B (en) Method and system for managing a transfer of data in a data network
CN101957863B (en) Data parallel processing method, device and system
KR20120106978A (en) Methods and apparatuses for reducing power consumption in a pattern recognition processor
JP5132770B2 (en) Dynamic configuration of the router to find the best dhcp server
JP4001297B2 (en) An information processing system and the management server
EP2215773B1 (en) Method and system for handling a failover in a distributed environment that uses session affinity
US8156503B2 (en) System, method and computer program product for accessing a memory space allocated to a virtual machine
CN101663651B (en) Distributed storage system
JP2006260355A (en) Storage system and storage control method

Legal Events

Date Code Title Description
C06 Publication
C10 Entry into substantive examination
C12 Rejection of a patent application after its publication