CN104516970A - Method and device both for log analysis - Google Patents
Method and device both for log analysis Download PDFInfo
- Publication number
- CN104516970A CN104516970A CN201410822371.8A CN201410822371A CN104516970A CN 104516970 A CN104516970 A CN 104516970A CN 201410822371 A CN201410822371 A CN 201410822371A CN 104516970 A CN104516970 A CN 104516970A
- Authority
- CN
- China
- Prior art keywords
- journal file
- log
- analysis
- data volume
- file
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/10—File systems; File servers
- G06F16/14—Details of searching files based on file metadata
Abstract
The invention discloses a method and a device both for log analysis and belongs to the technical field of computers. The method comprises the following steps: obtaining current data quantity of a first log file to be analyzed and obtaining analyzed data quantity of the first log file, wherein the analyzed data quantity is the data quantity of log content subjected to the log analysis in the log file; carrying out data quantity comparison on the current data quantity of the first log file and the analyzed data quantity of the first log file; and if the current data quantity of the first log file is different from the analyzed data quantity of the first log file, obtaining log content which is not subjected to the log analysis in the first log file according to the analyzed data quantity of the first log file, and carrying out the log analysis. With the adoption of the method, the timeliness of reading the log file can be improved.
Description
Technical field
The present invention relates to field of computer technology, particularly a kind of method and apparatus carrying out log analysis.
Background technology
Along with the development of computer technology, computer application is more and more extensive, in computing machine, multiple application program can be installed, in order to effectively grasp the operation conditions of application program, the background server of application program can in certain journal file, as file is called in the journal file of a.log, the service condition of application programs carries out record, when reaching certain time length upon recording, the content of record is shifted out, generate new journal file, and this journal file is named, as 2014-12-09.log, then be called at file in the journal file of a.log and continue record, by that analogy.
Application program usually can to there being multiple stage background server, and background server can read the local journal file stored, to analyze journal file.By the filename of journal file, these background servers, when reading journal file, usually can judge whether this journal file reads, and then read the journal file do not read.
Realizing in process of the present invention, inventor finds that prior art at least exists following problem:
For the journal file recorded, as file is called the journal file of a.log, background server cannot determine whether the log content of this journal file reads, therefore, background server is when reading journal file, general is read the journal file (namely file is called the journal file of 2014-12-09.log) generated, cannot read the content in the journal file recorded, thus the promptness reading journal file can be caused poor.
Summary of the invention
In order to solve the problem of prior art, embodiments provide a kind of method of carrying out log analysis.Described technical scheme is as follows:
First aspect, provide a kind of method of carrying out log analysis, described method comprises:
Obtain the current data amount of the first journal file to be analyzed, and obtain the analysis data volume of described first journal file, wherein, describedly analyze the data volume that data volume is the log content of carrying out log analysis in journal file;
The current data amount of described first journal file is carried out data volume with the analysis data volume of described first journal file compare;
If the current data amount of described first journal file is not identical with the analysis data volume of described first journal file, then obtain the log content of not carrying out log analysis in described first journal file according to the data volume of analyzing of described first journal file, carry out log analysis.
Second aspect, provide a kind of device carrying out log analysis, described device comprises:
Acquisition module, for obtaining the current data amount of the first journal file to be analyzed, and obtains the analysis data volume of described first journal file, wherein, has describedly analyzed the data volume that data volume is the log content of carrying out log analysis in journal file;
Comparison module, compares for the current data amount of described first journal file is carried out data volume with the analysis data volume of described first journal file;
Analysis module, if not identical with the analysis data volume of described first journal file for the current data amount of described first journal file, then obtain the log content of not carrying out log analysis in described first journal file according to the data volume of analyzing of described first journal file, carry out log analysis.
The beneficial effect that the technical scheme that the embodiment of the present invention provides is brought is:
In the embodiment of the present invention, obtain the current data amount of the first journal file to be analyzed, and obtain the analysis data volume of the first journal file, wherein, analyze the data volume that data volume is the log content of carrying out log analysis in journal file, the current data amount of the first journal file is carried out data volume with the analysis data volume of the first journal file compare, if the current data amount of the first journal file is not identical with the analysis data volume of the first journal file, then obtain the log content of not carrying out log analysis in the first journal file according to the data volume of analyzing of the first journal file, carry out log analysis, like this, can according to the analysis data volume of journal file, obtain the log content of not carrying out log analysis in journal file, therefore can the log content in the journal file recorded be analyzed, thus the promptness reading journal file can be improved.
Accompanying drawing explanation
In order to be illustrated more clearly in the technical scheme in the embodiment of the present invention, below the accompanying drawing used required in describing embodiment is briefly described, apparently, accompanying drawing in the following describes is only some embodiments of the present invention, for those of ordinary skill in the art, under the prerequisite not paying creative work, other accompanying drawing can also be obtained according to these accompanying drawings.
Fig. 1 is a kind of method flow diagram carrying out log analysis that the embodiment of the present invention provides;
Fig. 2 is a kind of apparatus structure schematic diagram carrying out log analysis that the embodiment of the present invention provides;
Fig. 3 is the structural representation of a kind of server that the embodiment of the present invention provides.
Embodiment
For making the object, technical solutions and advantages of the present invention clearly, below in conjunction with accompanying drawing, embodiment of the present invention is described further in detail.
Embodiment one
Embodiments provide a kind of method of carrying out log analysis, as shown in Figure 1, the treatment scheme of the method can comprise following step:
Step 101, obtains the current data amount of the first journal file to be analyzed, and obtains the analysis data volume of the first journal file.
Step 102, carries out data volume by the current data amount of the first journal file with the analysis data volume of the first journal file and compares.
Step 103, if the current data amount of the first journal file is not identical with the analysis data volume of the first journal file, then obtain the log content of not carrying out log analysis in the first journal file according to the data volume of analyzing of the first journal file, carry out log analysis.
The beneficial effect that the technical scheme that the embodiment of the present invention provides is brought is:
In the embodiment of the present invention, obtain the current data amount of the first journal file to be analyzed, and obtain the analysis data volume of the first journal file, wherein, analyze the data volume that data volume is the log content of carrying out log analysis in journal file, the current data amount of the first journal file is carried out data volume with the analysis data volume of the first journal file compare, if the current data amount of the first journal file is not identical with the analysis data volume of the first journal file, then obtain the log content of not carrying out log analysis in the first journal file according to the data volume of analyzing of the first journal file, carry out log analysis, like this, can according to the analysis data volume of journal file, obtain the log content of not carrying out log analysis in journal file, therefore can the log content in the journal file recorded be analyzed, thus the promptness reading journal file can be improved.
Embodiment two
Embodiments provide a kind of method of carrying out log analysis, the executive agent of the method is background server.Wherein, server can be the server of certain application program.
Below in conjunction with embodiment, be described in detail the treatment scheme shown in Fig. 1, content can be as follows:
Step 101, obtains the current data amount of the first journal file to be analyzed, and obtains the analysis data volume of the first journal file.
Wherein, the data volume that data volume is the log content of carrying out log analysis in journal file has been analyzed.
In force, user can install the application program with certain business function in terminal, and as the application program of certain game, user, in the process using this application program, can carry out various operation, as setting operation and operation etc.Application program can by the ruuning situation of self and the operational order received real-time send to its server, server then can carry out record to these information, generates should the journal file of application program.When server needs to analyze journal file, server can in the journal file recorded, obtain certain journal file (i.e. the first journal file) as journal file to be analyzed, then the current data volume of the first journal file can be obtained, and in the analytic record of the journal file that can store in this locality, obtain the analysis data volume of the first journal file.
Such as, user installs the application program for watching video in terminal, after user opens this application program, click setting options, terminal then can show and arranges interface, user is arranging unlatching inspection renewal and PUSH message function in interface, this application program then can arrange what receive the server that instruction sends to its correspondence in real time, user carries out in the process of video playback, the ruuning situation of self can also be sent to server by application program, if this application program is when 12:10:03, occur that mistake sudden strain of a muscle occurs and moves back, then this application program can will dodge the time of moving back, the information such as error reason and playing duration sends to server, server then can receive the information that application program sends, then record is carried out to these information, to generate should the journal file of application program.
Optionally, the file identification of journal file and the corresponding relation analyzing data volume can be set up, to obtain and to analyze data volume, corresponding processing procedure can be as follows: the file identification obtaining the first journal file, according to file identification and the corresponding relation analyzing data volume of the journal file prestored, determine the analysis data volume that the file identification of the first journal file is corresponding.
In force, after certain journal file being analyzed in server, the file identification of this journal file can be stored, and the analysis data volume of this journal file of storage that can be corresponding, set up the file identification of journal file and the corresponding relation analyzing data volume.When server needs to analyze the first journal file, server can obtain the file identification of the first journal file, then can inquire about whether to store this journal file and identify in the file identification of the journal file prestored with the corresponding relation having analyzed data volume.If store the file identification of the first journal file in this corresponding relation, then can determine the analysis data volume that the file identification of the first journal file is corresponding.In addition, if the file identification of journal file and to have analyzed data volume corresponding relation in do not store the file identification of the first journal file, the not analyzed mistake of first journal file is then described, server can add the file identification of the first journal file in the file identification of journal file with the corresponding relation having analyzed data volume, and after analyzing and processing is carried out to the first journal file, the data volume of analyzing of the first journal file is carried out corresponding storage.
Optionally, file identification can be the eigenwert of journal file, corresponding processing procedure can be as follows: the Article 1 log recording obtaining the first journal file, according to the eigenwert algorithm preset, determine the eigenwert of the Article 1 log recording of the first journal file, as the file identification of the first journal file.
In force, when server needs to analyze the first journal file, server can obtain the Article 1 log recording of the first journal file, then can by the eigenwert algorithm (as hash value algorithms) preset, determine the eigenwert of the Article 1 log recording of the first journal file, using the file identification of this eigenwert as the first journal file, and then above-mentioned query processing can be carried out.In addition, server also can determine the file identification of the first journal file by additive method.Such as, for journal file being done to the system split in advance, the filename of journal file can not carry out rename, and the filename of journal file can uniquely represent this journal file, then filename can be used as eigenwert; Or, update time that Article 1 log recording is corresponding can be used as eigenwert, major part log system can increase update time when exporting in the content of log recording, then can according to being the feature increased update time, as long as the dividing frequency of journal file is lower than the lowest accuracy of update time, just can think that update time of the first row of each journal file is unique, therefore can using update time corresponding for Article 1 log recording as eigenwert.
Optionally, can first filter out journal file to be analyzed, corresponding processing procedure can be as follows: receive the log analysis request carrying target journaling type; In the journal file that this locality stores, obtain the journal file of target journaling type, as journal file to be analyzed.
In force, in server, multiple journal file can be stored, such as, the journal file of server this locality and journal file corresponding to certain application program; The error log file of certain application program and running log file etc.Target journaling type can divide from multiple dimension, and target journaling type can be journal file corresponding to certain application program, also can be the error log file of certain application program.When needs carry out log analysis, maintainer can send log analysis request by other device-to-servers, target journaling type is carried in this log analysis request, server then can receive this log analysis request, this log analysis request is resolved, then obtains target journaling type wherein, and in the journal file of this locality storage, the journal file that inquiry log type is identical with target journaling type, as journal file to be analyzed.
Such as, server is simultaneously for app1 and app2 provides service, then the journal file of app1 and app2 can be recorded in server this locality, the filename of the journal file of app1 can be designated as app1-2014-12-09.log, app1-2014-12-10.log and app1-2014-12-11.log etc., and the filename of the journal file of app2 can be designated as app2-2014-12-09.log, app2-2014-12-10.log and app2-2014-12-11.log etc.If need to analyze the journal file of app1, can Offered target Log Types be then the journal file comprising app1 in the filename of journal file, after server receives log analysis request, inquire about in the journal file that can store in this locality according to target journaling type, obtain the journal files such as app1-2014-12-09.log, app1-2014-12-10.log and app1-2014-12-11.log, as journal file to be analyzed.
Step 102, carries out data volume by the current data amount of the first journal file with the analysis data volume of the first journal file and compares.
In force, server obtain the first journal file current data amount and after analyzing data volume, the two can be compared, determine the magnitude relationship of the two.
Optionally, the current update time of the first journal file can be compared with the update time analyzing data corresponding of the first journal file.
In force, the filename of journal file can be prestored in server, after server is analyzed certain journal file, the update time analyzing data of this journal file can be obtained, namely the update time of the last item record in data has been analyzed, then the filename of this journal file can be carried out corresponding storage with the update time analyzing data, the corresponding relation of the filename setting up journal file and the update time having analyzed data.When server needs to analyze the first journal file, the update time analyzing data that the filename of the first journal file is corresponding can be inquired about in above-mentioned corresponding relation, then the current update time of the first journal file and the update time inquired can be contrasted, if the two is identical, then illustrate that the first journal file is not updated, then the first journal file is not processed, obtain next journal file as journal file to be analyzed, if the two is not identical, then illustrate that the first journal file upgrades, the analysis data volume of the first journal file then can be determined by above-mentioned processing procedure, to analyze journal file.
Such as, prestoring the update time analyzing data corresponding to journal file app1-2014-12-09.log in server is 2014-12-09, and the update time analyzing data that journal file app1-2014-12-10.log is corresponding is 2014-12-10.Server obtains journal file app1-2014-12-09.log as after journal file to be analyzed, the update time analyzing data corresponding to this journal file can be inquired about in above-mentioned corresponding relation, i.e. 2014-12-09, and the current update time of this journal file can be obtained, as 2014-12-09, then server can judge that this journal file is not updated, this journal file is not processed, server can determine that journal file app1-2014-12-10.log is as journal file to be analyzed, the update time analyzing data corresponding to this journal file can be inquired about in above-mentioned corresponding relation, i.e. 2014-12-10, and the current update time of this journal file can be obtained, as 2014-12-11, then server can judge that this journal file is updated.
Step 103, if the current data amount of the first journal file is not identical with the analysis data volume of the first journal file, then obtain the log content of not carrying out log analysis in the first journal file according to the data volume of analyzing of the first journal file, carry out log analysis.
In force, server is after relatively, if determine that the current data amount of the first journal file is not identical with the analysis data volume of the first journal file, then can according to analyzing data volume, in the first journal file, obtain the log content of not carrying out log analysis, and log analysis is carried out to this log content.In addition, if server determines that the current data amount of the first journal file is identical with the analysis data volume of the first journal file, then the first journal file is not processed, in the logfile directory of this locality, obtain next journal file, as journal file to be analyzed.
Optionally, if the current data amount of the first journal file is not identical with the analysis data volume of the first journal file, then obtains in the first journal file the log content upgraded after having carried out the log content of log analysis, carry out log analysis.
In force, the content of the first journal file can arrange according to the time sequencing of record, and after namely having carried out the log content of log analysis in the first journal file, log content is the log content upgraded.If server is after relatively, determine that the current data amount of the first journal file is not identical with the analysis data volume of the first journal file, then can obtain the log content after the log content of carrying out log analysis in the first journal file, carry out log analysis.
In the embodiment of the present invention, obtain the current data amount of the first journal file to be analyzed, and obtain the analysis data volume of the first journal file, wherein, analyze the data volume that data volume is the log content of carrying out log analysis in journal file, the current data amount of the first journal file is carried out data volume with the analysis data volume of the first journal file compare, if the current data amount of the first journal file is not identical with the analysis data volume of the first journal file, then obtain the log content of not carrying out log analysis in the first journal file according to the data volume of analyzing of the first journal file, carry out log analysis, like this, can according to the analysis data volume of journal file, obtain the log content of not carrying out log analysis in journal file, therefore can the log content in the journal file recorded be analyzed, thus the promptness reading journal file can be improved.
Embodiment three
Based on identical technical conceive, the embodiment of the present invention additionally provides a kind of device carrying out log analysis, and as shown in Figure 2, this device comprises:
Acquisition module 210, for obtaining the current data amount of the first journal file to be analyzed, and obtains the analysis data volume of described first journal file, wherein, has describedly analyzed the data volume that data volume is the log content of carrying out log analysis in journal file;
Comparison module 220, compares for the current data amount of described first journal file is carried out data volume with the analysis data volume of described first journal file;
Analysis module 230, if not identical with the analysis data volume of described first journal file for the current data amount of described first journal file, then obtain the log content of not carrying out log analysis in described first journal file according to the data volume of analyzing of described first journal file, carry out log analysis.
Optionally, described analysis module 230, for:
If the current data amount of described first journal file is not identical with the analysis data volume of described first journal file, then obtains in described first journal file the log content upgraded after having carried out the log content of log analysis, carry out log analysis.
Optionally, it is characterized in that, described acquisition module 210, for:
Obtain the file identification of described first journal file;
According to file identification and the corresponding relation analyzing data volume of the journal file prestored, determine the analysis data volume that the file identification of described first journal file is corresponding.
Optionally, described file identification is the eigenwert of journal file;
Described acquisition module 210, for:
Obtain the Article 1 log recording of described first journal file, according to the eigenwert algorithm preset, determine the eigenwert of the Article 1 log recording of described first journal file, as the file identification of described first journal file.
Optionally, described acquisition module 210, also for:
Receive the log analysis request carrying target journaling type;
In the journal file that this locality stores, obtain the journal file of described target journaling type, as journal file to be analyzed.
In the embodiment of the present invention, obtain the current data amount of the first journal file to be analyzed, and obtain the analysis data volume of the first journal file, wherein, analyze the data volume that data volume is the log content of carrying out log analysis in journal file, the current data amount of the first journal file is carried out data volume with the analysis data volume of the first journal file compare, if the current data amount of the first journal file is not identical with the analysis data volume of the first journal file, then obtain the log content of not carrying out log analysis in the first journal file according to the data volume of analyzing of the first journal file, carry out log analysis, like this, can according to the analysis data volume of journal file, obtain the log content of not carrying out log analysis in journal file, therefore can the log content in the journal file recorded be analyzed, thus the promptness reading journal file can be improved.
It should be noted that: the device carrying out log analysis that above-described embodiment provides is when carrying out log analysis, only be illustrated with the division of above-mentioned each functional module, in practical application, can distribute as required and by above-mentioned functions and be completed by different functional modules, inner structure by equipment is divided into different functional modules, to complete all or part of function described above.In addition, the device carrying out log analysis that above-described embodiment provides belongs to same design with the embodiment of the method for carrying out log analysis, and its specific implementation process refers to embodiment of the method, repeats no more here.
Embodiment four
Fig. 3 is the structural representation of the server that the embodiment of the present invention provides.This server 1900 can produce larger difference because of configuration or performance difference, one or more central processing units (centralprocessing units can be comprised, CPU) 1922 (such as, one or more processors) and storer 1932, one or more store the storage medium 1930 (such as one or more mass memory units) of application program 1942 or data 1944.Wherein, storer 1932 and storage medium 1930 can be of short duration storages or store lastingly.The program being stored in storage medium 1930 can comprise one or more modules (diagram does not mark), and each module can comprise a series of command operatings in server.Further, central processing unit 1922 can be set to communicate with storage medium 1930, and server 1900 performs a series of command operatings in storage medium 1930.
Server 1900 can also comprise one or more power supplys 1926, one or more wired or wireless network interfaces 1950, one or more IO interface 1958, one or more keyboards 1956, and/or, one or more operating systems 1941, such as Windows ServerTM, Mac OSXTM, UnixTM, LinuxTM, FreeBSDTM etc.
Server 1900 can include storer, and one or more than one program, one of them or more than one program are stored in storer, and are configured to perform described more than one or one routine package containing the instruction for carrying out following operation by more than one or one processor:
Obtain the current data amount of the first journal file to be analyzed, and obtain the analysis data volume of described first journal file, wherein, describedly analyze the data volume that data volume is the log content of carrying out log analysis in journal file;
The current data amount of described first journal file is carried out data volume with the analysis data volume of described first journal file compare;
If the current data amount of described first journal file is not identical with the analysis data volume of described first journal file, then obtain the log content of not carrying out log analysis in described first journal file according to the data volume of analyzing of described first journal file, carry out log analysis.
Optionally, if the current data amount of described first journal file is not identical with the analysis data volume of described first journal file, then obtain the log content of not carrying out log analysis in described first journal file according to the data volume of analyzing of described first journal file, carry out log analysis, comprising:
If the current data amount of described first journal file is not identical with the analysis data volume of described first journal file, then obtains in described first journal file the log content upgraded after having carried out the log content of log analysis, carry out log analysis.
Optionally, the analysis data volume of described first journal file of described acquisition, comprising:
Obtain the file identification of described first journal file;
According to file identification and the corresponding relation analyzing data volume of the journal file prestored, determine the analysis data volume that the file identification of described first journal file is corresponding.
Optionally, described file identification is the eigenwert of journal file;
The file identification of described first journal file of described acquisition, comprising:
Obtain the Article 1 log recording of described first journal file, according to the eigenwert algorithm preset, determine the eigenwert of the Article 1 log recording of described first journal file, as the file identification of described first journal file.
Optionally, the current data amount of the first journal file that described acquisition is to be analyzed, and before obtaining the analysis data volume of described first journal file, described method also comprises:
Receive the log analysis request carrying target journaling type;
In the journal file that this locality stores, obtain the journal file of described target journaling type, as journal file to be analyzed.
In the embodiment of the present invention, obtain the current data amount of the first journal file to be analyzed, and obtain the analysis data volume of the first journal file, wherein, analyze the data volume that data volume is the log content of carrying out log analysis in journal file, the current data amount of the first journal file is carried out data volume with the analysis data volume of the first journal file compare, if the current data amount of the first journal file is not identical with the analysis data volume of the first journal file, then obtain the log content of not carrying out log analysis in the first journal file according to the data volume of analyzing of the first journal file, carry out log analysis, like this, can according to the analysis data volume of journal file, obtain the log content of not carrying out log analysis in journal file, therefore can the log content in the journal file recorded be analyzed, thus the promptness reading journal file can be improved.
One of ordinary skill in the art will appreciate that all or part of step realizing above-described embodiment can have been come by hardware, the hardware that also can carry out instruction relevant by program completes, described program can be stored in a kind of computer-readable recording medium, the above-mentioned storage medium mentioned can be ROM (read-only memory), disk or CD etc.
The foregoing is only preferred embodiment of the present invention, not in order to limit the present invention, within the spirit and principles in the present invention all, any amendment done, equivalent replacement, improvement etc., all should be included within protection scope of the present invention.
Claims (10)
1. carry out a method for log analysis, it is characterized in that, described method comprises:
Obtain the current data amount of the first journal file to be analyzed, and obtain the analysis data volume of described first journal file, wherein, describedly analyze the data volume that data volume is the log content of carrying out log analysis in journal file;
The current data amount of described first journal file is carried out data volume with the analysis data volume of described first journal file compare;
If the current data amount of described first journal file is not identical with the analysis data volume of described first journal file, then obtain the log content of not carrying out log analysis in described first journal file according to the data volume of analyzing of described first journal file, carry out log analysis.
2. method according to claim 1, it is characterized in that, if the current data amount of described first journal file is not identical with the analysis data volume of described first journal file, then obtain the log content of not carrying out log analysis in described first journal file according to the data volume of analyzing of described first journal file, carry out log analysis, comprising:
If the current data amount of described first journal file is not identical with the analysis data volume of described first journal file, then obtains in described first journal file the log content upgraded after having carried out the log content of log analysis, carry out log analysis.
3. method according to claim 1, is characterized in that, the analysis data volume of described first journal file of described acquisition, comprising:
Obtain the file identification of described first journal file;
According to file identification and the corresponding relation analyzing data volume of the journal file prestored, determine the analysis data volume that the file identification of described first journal file is corresponding.
4. method according to claim 3, is characterized in that, described file identification is the eigenwert of journal file;
The file identification of described first journal file of described acquisition, comprising:
Obtain the Article 1 log recording of described first journal file, according to the eigenwert algorithm preset, determine the eigenwert of the Article 1 log recording of described first journal file, as the file identification of described first journal file.
5. method according to claim 1, is characterized in that, the current data amount of the first journal file that described acquisition is to be analyzed, and before obtaining the analysis data volume of described first journal file, described method also comprises:
Receive the log analysis request carrying target journaling type;
In the journal file that this locality stores, obtain the journal file of described target journaling type, as journal file to be analyzed.
6. carry out a device for log analysis, it is characterized in that, described device comprises:
Acquisition module, for obtaining the current data amount of the first journal file to be analyzed, and obtains the analysis data volume of described first journal file, wherein, has describedly analyzed the data volume that data volume is the log content of carrying out log analysis in journal file;
Comparison module, compares for the current data amount of described first journal file is carried out data volume with the analysis data volume of described first journal file;
Analysis module, if not identical with the analysis data volume of described first journal file for the current data amount of described first journal file, then obtain the log content of not carrying out log analysis in described first journal file according to the data volume of analyzing of described first journal file, carry out log analysis.
7. device according to claim 6, is characterized in that, described analysis module, for:
If the current data amount of described first journal file is not identical with the analysis data volume of described first journal file, then obtains in described first journal file the log content upgraded after having carried out the log content of log analysis, carry out log analysis.
8. device according to claim 6, is characterized in that, described acquisition module, for:
Obtain the file identification of described first journal file;
According to file identification and the corresponding relation analyzing data volume of the journal file prestored, determine the analysis data volume that the file identification of described first journal file is corresponding.
9. device according to claim 8, is characterized in that, described file identification is the eigenwert of journal file;
Described acquisition module, for:
Obtain the Article 1 log recording of described first journal file, according to the eigenwert algorithm preset, determine the eigenwert of the Article 1 log recording of described first journal file, as the file identification of described first journal file.
10. device according to claim 6, is characterized in that, described acquisition module, also for:
Receive the log analysis request carrying target journaling type;
In the journal file that this locality stores, obtain the journal file of described target journaling type, as journal file to be analyzed.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410822371.8A CN104516970B (en) | 2014-12-23 | 2014-12-23 | A kind of method and apparatus for carrying out log analysis |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201410822371.8A CN104516970B (en) | 2014-12-23 | 2014-12-23 | A kind of method and apparatus for carrying out log analysis |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN104516970A true CN104516970A (en) | 2015-04-15 |
| CN104516970B CN104516970B (en) | 2018-06-22 |
Family
ID=52792269
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201410822371.8A Active CN104516970B (en) | 2014-12-23 | 2014-12-23 | A kind of method and apparatus for carrying out log analysis |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN104516970B (en) |
Cited By (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106528566A (en) * | 2015-09-11 | 2017-03-22 | 北京国双科技有限公司 | Log file output method, server and client |
| CN108062323A (en) * | 2016-11-08 | 2018-05-22 | 北京国双科技有限公司 | A kind of log read method and device |
| CN111208363A (en) * | 2019-12-13 | 2020-05-29 | 深圳市元征科技股份有限公司 | Test method and electronic device |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2005032129A (en) * | 2003-07-10 | 2005-02-03 | Toshiba Corp | Device, system, method, and program for document history analysis |
| CN1645336A (en) * | 2005-01-20 | 2005-07-27 | 上海复旦光华信息科技股份有限公司 | Automatic extraction and analysis for formwork based on heterogenerous logbook |
| CN103838867A (en) * | 2014-03-20 | 2014-06-04 | 网宿科技股份有限公司 | Log processing method and device |
-
2014
- 2014-12-23 CN CN201410822371.8A patent/CN104516970B/en active Active
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2005032129A (en) * | 2003-07-10 | 2005-02-03 | Toshiba Corp | Device, system, method, and program for document history analysis |
| CN1645336A (en) * | 2005-01-20 | 2005-07-27 | 上海复旦光华信息科技股份有限公司 | Automatic extraction and analysis for formwork based on heterogenerous logbook |
| CN103838867A (en) * | 2014-03-20 | 2014-06-04 | 网宿科技股份有限公司 | Log processing method and device |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN106528566A (en) * | 2015-09-11 | 2017-03-22 | 北京国双科技有限公司 | Log file output method, server and client |
| CN108062323A (en) * | 2016-11-08 | 2018-05-22 | 北京国双科技有限公司 | A kind of log read method and device |
| CN108062323B (en) * | 2016-11-08 | 2021-10-15 | 北京国双科技有限公司 | Log reading method and device |
| CN111208363A (en) * | 2019-12-13 | 2020-05-29 | 深圳市元征科技股份有限公司 | Test method and electronic device |
| CN111208363B (en) * | 2019-12-13 | 2022-06-17 | 深圳市元征科技股份有限公司 | Test method and electronic device |
Also Published As
| Publication number | Publication date |
|---|---|
| CN104516970B (en) | 2018-06-22 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US9552249B1 (en) | Systems and methods for troubleshooting errors within computing tasks using models of log files | |
| US9590880B2 (en) | Dynamic collection analysis and reporting of telemetry data | |
| US20160253229A1 (en) | Event log analysis | |
| US8521865B2 (en) | Method and apparatus for populating a software catalog with automated use signature generation | |
| CN109543462B (en) | Equipment identification determination method, device, server and storage medium | |
| US20130283259A1 (en) | Application installation | |
| CN106648994B (en) | Method, equipment and system for backing up operation log | |
| CN111416821A (en) | Internet of things equipment information acquisition method, system and device | |
| Syer et al. | Continuous validation of performance test workloads | |
| US20160098390A1 (en) | Command history analysis apparatus and command history analysis method | |
| CN102902558A (en) | Project script file updating system and method as well as script file merging method and device | |
| US10769175B1 (en) | Real-time hosted system analytics | |
| CN104317618A (en) | Firmware partitioning method and device | |
| US20190220439A1 (en) | Software Discovery with Variable Scan Frequency | |
| CN112068852B (en) | Method, system, equipment and medium for installing open-source software based on domestic server | |
| CN105049290A (en) | Method and device for monitoring page access | |
| JP6457777B2 (en) | Automated generation and dynamic update of rules | |
| CN111460394A (en) | Copyright file verification method and device and computer readable storage medium | |
| CN104516970A (en) | Method and device both for log analysis | |
| US10341164B2 (en) | Modifying computer configuration to improve performance | |
| CN108228197B (en) | Method and device for installing software in cluster | |
| EP3011454A1 (en) | Generating a fingerprint representing a response of an application to a simulation of a fault of an external service | |
| CN112714022A (en) | Control processing method and device for multiple clusters and computer equipment | |
| US10140187B1 (en) | Techniques for system backup | |
| US10810089B1 (en) | Automatically adjusting backup set rules based on anomalous backup activity |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| C06 | Publication | ||
| PB01 | Publication | ||
| C10 | Entry into substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| CB02 | Change of applicant information |
Address after: 510660 Guangzhou City, Guangzhou, Guangdong, Whampoa Avenue, No. 315, self - made 1-17 Applicant after: Guangzhou KuGou Networks Co., Ltd. Address before: 510000 B1, building, No. 16, rhyme Road, Guangzhou, Guangdong, China 13F Applicant before: Guangzhou KuGou Networks Co., Ltd. |
|
| CB02 | Change of applicant information | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |