CN110457183A - A kind of log processing method and device - Google Patents
A kind of log processing method and device Download PDFInfo
- Publication number
- CN110457183A CN110457183A CN201810427172.5A CN201810427172A CN110457183A CN 110457183 A CN110457183 A CN 110457183A CN 201810427172 A CN201810427172 A CN 201810427172A CN 110457183 A CN110457183 A CN 110457183A
- Authority
- CN
- China
- Prior art keywords
- log
- equipment
- fault
- processing
- verification tool
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000003672 processing method Methods 0.000 title claims abstract description 21
- 238000012545 processing Methods 0.000 claims abstract description 120
- 238000012795 verification Methods 0.000 claims abstract description 115
- 238000000034 method Methods 0.000 claims description 28
- 230000005055 memory storage Effects 0.000 claims description 2
- 230000000694 effects Effects 0.000 description 11
- 238000012423 maintenance Methods 0.000 description 7
- 230000001052 transient effect Effects 0.000 description 7
- 238000007726 management method Methods 0.000 description 5
- 238000010586 diagram Methods 0.000 description 4
- 238000005516 engineering process Methods 0.000 description 3
- 238000011835 investigation Methods 0.000 description 3
- 238000004458 analytical method Methods 0.000 description 2
- 230000004888 barrier function Effects 0.000 description 2
- 239000003550 marker Substances 0.000 description 2
- 238000012216 screening Methods 0.000 description 2
- 238000012550 audit Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000011161 development Methods 0.000 description 1
- 235000013399 edible fruits Nutrition 0.000 description 1
- 238000011084 recovery Methods 0.000 description 1
- 238000000926 separation method Methods 0.000 description 1
- 238000012360 testing method Methods 0.000 description 1
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
- G06F11/3072—Monitoring arrangements determined by the means or processing involved in reporting the monitored data where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/32—Monitoring with visual or acoustical indication of the functioning of the machine
- G06F11/324—Display of status information
- G06F11/327—Alarm or error message display
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Quality & Reliability (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Debugging And Monitoring (AREA)
Abstract
The embodiment of the present invention provides a kind of log processing method and device, to big, the technical problem for causing electronic equipment O&M difficulty big that solves the log amount that electronic equipment generates in the prior art.Wherein, which comprises obtaining the generation of the first equipment is default other first log of journal stage, and presetting log rank indicates that the information of the first log recording includes fault message；According to fault message, determine that the first log is to indicate the log of Fisrt fault classification；Indicate the first verification tool of the first equipment operation and Fisrt fault categorical match, the first verification tool is for verifying whether that there are the failures of Fisrt fault classification；It obtains the first equipment and runs the verification result that the first verification tool is verified, and determined whether to carry out alarming processing to the first log according to verification result.
Description
Technical field
The present invention relates to field field of computer technology more particularly to a kind of log processing methods and device.
Background technique
With the promotion of rapid growth and electronic equipment the operation complexity of number of electronic devices, the day that electronic equipment generates
Will increasing number, especially in big data platform, every machine can all generate the log of magnanimity, to the maintenance work of operation maintenance personnel
Bring immense pressure.
It is currently, there are as log division log rank, the technical side that only log of failure (Error) rank is alerted
Case.With this solution, operation maintenance personnel can be concerned only with Error log of high importance, and can reduce to a certain extent needs
The log amount for wanting operation maintenance personnel to handle.However, the quantity of Error log is still huge, and electronics is set under the log radix of magnanimity
Standby O&M difficulty is still larger.
As it can be seen that the log amount that electronic equipment generation exists in the prior art is big, the skill for causing electronic equipment O&M difficulty big
Art problem.
Summary of the invention
The embodiment of the present invention provides a kind of log processing method and device, to solve electronic equipment generation in the prior art
Log amount it is big, the technical problem for causing electronic equipment O&M difficulty big.
In a first aspect, a kind of log processing method is provided, this method comprises: obtaining the generation of the first equipment is default log
First log of rank, the default log rank indicate that the information of first log recording includes fault message；According to the failure
Information determines that first log is to indicate the log of Fisrt fault classification；Indicate first equipment operation and the Fisrt fault class
Not matched first verification tool, first verification tool is for verifying whether that there are the failures of the Fisrt fault classification；It obtains
First equipment runs the verification result that first verification tool is verified, and according to the verification result determine whether to this
One log carries out alarming processing.
The log processing method provided according to embodiments of the present invention whether there is the first equipment by the first verification tool
Fisrt fault classification failure is verified, and after obtaining verification result, is determined whether according to the difference of verification result to first day
Will carries out alarming processing, if verification result shows not needing to alert, so that it may determine and cancel to the first log progress alarming processing.
By having achieved the effect that the log quantity for reducing alarm, having reduced to the further screening for the log for including fault message, investigation
Electronic equipment O&M difficulty.
In one possible implementation, indicate that first equipment operation is tested with the first of the Fisrt fault categorical match
Card tool, comprising: indicate that first equipment is verified by first verification tool, and reaching default verifying number or really
When there is the failure of the Fisrt fault classification surely, the verification result is generated；Determined whether according to the verification result to this first day
Will carries out alarming processing, comprising: if the verification result shows that first equipment is not deposited in the verifying of the default verifying number
In the failure of the Fisrt fault classification, then cancels and alarming processing is carried out to first log, and adjust the log of first log
Rank is to preset the other other log ranks of journal stage different from this；Otherwise, it determines carrying out alarming processing to first log.
The log processing method provided according to embodiments of the present invention, by setting the verifying of default verifying number, Neng Gougeng
Add and accurately determines out in the first equipment with the presence or absence of other failures outside transient fault.
In one possible implementation, first equipment operation and the first of the Fisrt fault categorical match is being indicated
Before verification tool, this method further include: determine first verification tool, the day whether are stored in preset log processing library
Will handles library for storing file relevant to log processing；If so, first verification tool is sent to first equipment；
Otherwise, it determines carrying out alarming processing to first log.
The log processing method provided according to embodiments of the present invention, by determining in log processing library whether be stored with first
Verification tool, and the first verification tool is sent to the first equipment when being stored with determining, it can guarantee subsequent verifying step
It is normal to execute, also, have the case where the first verification tool for not stored, directly the first log is alerted, can be avoided
Miss important log information.
In one possible implementation, when determining to first log progress alarming processing, this method further include:
Determine the fault solution information whether being stored in preset log processing library with the Fisrt fault categorical match, the log
Library is handled for storing file relevant to log processing；If so, the fault solution information is shown to user, with prompt
The user according to the fault solution information solve first equipment existing for failure.
The log processing method provided according to embodiments of the present invention can also be searched when determination needs to alert there are failure
For solving the fault solution information of such failure, prompts user to solve this according to the fault solution information and first set
Standby existing failure, in order to which user quickly and efficiently solves failure.
In one possible implementation, which further includes for indicating first equipment locating for itself
The topology information of position in network topology structure according to the fault message, is determining first log for expression Fisrt fault
Before the log of classification, this method further include: according to the topology information, determine whether first equipment is located at the network topology knot
Insignificant position in structure, wherein the insignificant position indicates that first equipment is the node in cluster, or indicates that this first sets
The standby cluster to be in end in the network topology structure；If so, determining that first log is according to the fault message
Indicate the log of Fisrt fault classification；Otherwise, it is determined that alarming processing is carried out to first log.
The log processing method provided according to embodiments of the present invention determines the first equipment in network topology according to topology information
Position in structure, and judge according to topological relation the coverage of failure, the equipment of the critical positions big to coverage
Log is preferentially alerted, and is conducive to the fault condition that operation maintenance personnel finds critical positions in time, is avoided the event of critical positions
Barrier causes excessive loss.
Second aspect provides a kind of log processing device, which includes:
Log obtains module, is default other first log of journal stage for obtaining the generation of the first equipment, the default day
Will rank indicates that the information of first log recording includes fault message；
Fault category determining module indicates Fisrt fault classification for according to the fault message, determining first log
Log；
Authentication module is used to indicate the first verification tool of first equipment operation and the Fisrt fault categorical match, should
First verification tool is for verifying whether that there are the failures of the Fisrt fault classification；
Judgment module is alerted, runs the verification result that first verification tool is verified for obtaining first equipment,
And determined whether to carry out alarming processing to first log according to the verification result.
In one possible implementation, which is used for: indicating that first equipment passes through the first verifying work
Tool is verified, and is being reached default verifying number or determined there are when the failure of the Fisrt fault classification, and the verifying knot is generated
Fruit；
The alarm judgment module is used for: if the verification result shows first equipment in the verifying of the default verifying number
The failure of the Fisrt fault classification is not present, then cancels and alarming processing is carried out to first log, and adjust first log
Log rank be different from this to preset the other other log ranks of journal stage；Otherwise, it determines being alerted to first log
Processing.
In one possible implementation, which further includes verification tool determining module, is used for:
Before indicating the first verification tool of first equipment operation and the Fisrt fault categorical match, determine preset
Whether first verification tool is stored in log processing library, and the log processing library is for storing text relevant to log processing
Part；
If so, first verification tool is sent to first equipment；
Otherwise, it determines carrying out alarming processing to first log.
In one possible implementation, device further include: solution determining module is used for:
When determining to first log progress alarming processing, determine whether be stored with and be somebody's turn to do in preset log processing library
The fault solution information of Fisrt fault categorical match, the log processing library is for storing file relevant to log processing；
If so, the fault solution information is shown to user, to prompt the user to believe according to the fault solution
Breath solves failure existing for first equipment.
In one possible implementation, which further includes for indicating first equipment locating for itself
The topology information of position in network topology structure, the device further include topology information determining module, are used for:
Before according to the fault message, determining the log that first log is expression Fisrt fault classification, opened up according to this
Information is flutterred, determines whether first equipment is located at the insignificant position in the network topology structure, wherein the insignificant position table
Show that first equipment is the node in cluster, or indicates that first equipment is the cluster for being in end in the network topology structure；
If so, determining that first log is to indicate the log of Fisrt fault classification according to the fault message；
Otherwise, it is determined that alarming processing is carried out to first log.
The technical effect of log processing device provided in an embodiment of the present invention may refer to above-mentioned first aspect or first party
The technical effect of the various implementations in face, details are not described herein again.
The third aspect provides a kind of computer equipment, which includes:
At least one processor, and
The memory being connect at least one described processor；
Wherein, the memory is stored with the instruction that can be executed by least one described processor, described at least one
The instruction that device is stored by executing the memory is managed, method as described in relation to the first aspect is executed.
The technical effect of computer equipment provided in an embodiment of the present invention may refer to above-mentioned first aspect or first aspect
The technical effect of various implementations, details are not described herein again.
Fourth aspect provides a kind of computer readable storage medium, comprising:
The computer-readable recording medium storage has computer instruction, when the computer instruction is run on computers
When, so that computer executes method described in first aspect.
The technical effect of computer readable storage medium provided in an embodiment of the present invention may refer to above-mentioned first aspect or
The technical effect of the various implementations of first aspect, details are not described herein again.
Detailed description of the invention
In order to more clearly explain the embodiment of the invention or the technical proposal in the existing technology, to embodiment or will show below
There is attached drawing needed in technical description to be briefly described, it should be apparent that, the accompanying drawings in the following description is only this
Inventive embodiments for those of ordinary skill in the art without creative efforts, can also be according to mentioning
The attached drawing of confession obtains other attached drawings.
Fig. 1 is a kind of application scenarios schematic diagram of log processing method in the embodiment of the present invention；
Fig. 2 is a kind of flow diagram of log processing method in the embodiment of the present invention；
Fig. 3 is the flow diagram of another log processing method in the embodiment of the present invention；
Fig. 4 is a kind of structural block diagram of log processing device in the embodiment of the present invention.
Specific embodiment
In order to make the object, technical scheme and advantages of the embodiment of the invention clearer, below in conjunction with the embodiment of the present invention
In attached drawing, technical scheme in the embodiment of the invention is clearly and completely described, it is clear that described embodiment is
A part of the embodiment of the present invention, instead of all the embodiments.Based on the embodiments of the present invention, those of ordinary skill in the art
Every other embodiment obtained without creative efforts, shall fall within the protection scope of the present invention.
In addition, the terms "and/or", only a kind of incidence relation for describing affiliated partner, indicates may exist
Three kinds of relationships, for example, A and/or B, can indicate: individualism A exists simultaneously A and B, these three situations of individualism B.Separately
Outside, character "/" herein typicallys represent the relationship that forward-backward correlation object is a kind of "or" in the case where not illustrating.
In addition, it is necessary to understand, in the description of the embodiment of the present invention, the vocabulary such as " first ", " second " are only used for distinguishing description
Purpose is not understood to indicate or imply relative importance, can not be interpreted as indication or suggestion sequence.
Embodiment one
The embodiment of the present invention provides a kind of log processing method, and this method can be applied to log processing device, the log
Processing unit can be handled log based on this method.Log processing device can be server, cluster, PC,
Fictitious host computer, mobile phone etc. have the electronic equipment of computing capability.
Specifically, log handled by log processing device can be log processing device itself generation, can also be with
It is to be generated by other electronic equipments.For example, referring to Figure 1, Fig. 1 is that log processing method one kind in the embodiment of the present invention can
The application scenarios of energy, wherein log processing device and multiple host communicate to connect, and the log that this multiple host generates can be sent
To log processing device, and these logs are carried out with unified processing by log processing device.
Journal format concentrator marker can be installed for application scenarios shown in FIG. 1, on every host and log sends and inserts
Part.Journal format concentrator marker is used to generate the log of default journal format, and log sends the log hair that plug-in unit is used to generate
It send to log processing device.
For example, default journal format may include following content: [host name] [host number] [cluster number]
[time] [log mark] [field 1 undetermined] [field 2 undetermined] [log rank] [log details].
Wherein, the meaning for presetting each section in journal format is as follows:
(1) host name: the IP address or host name of host；
(2) host is numbered: the number of host in the cluster；
(3) cluster number: the number of the cluster where host；
(4) time: the time that log generates；
(5) log identifies: indicating this log whether processing is over；
(6) field 1 undetermined, field undetermined 2: reserved field；
(7) log rank: the log rank of log is indicated；
(8) log details: the content of log；
The log installed on each host sends plug-in unit and can be based on the progress of the log components such as existing log4j, logback
Secondary development, which sends plug-in unit and provides o controller Appender, and the effect which sends plug-in unit is by host
The log of upper generation is sent to log processing device.
In the embodiment of the present invention, can according to content that log includes, equipment, importance of log for generating log etc. because
The log rank of plain division log.For example, information (INFO), debugging (DEBUG), warning (WARN), event can be marked off
Hinder (ERROR) this four log ranks, wherein ERROR log includes fault message；In another example 1,2,3,4,5 can be marked off
This five log ranks, and the log of wherein 1,2 ranks is set for recording fault message.For log in the embodiment of the present invention
Specifically which kind of log rank division mode is used with no restrictions in processing method.
Log processing device can first store these logs, confession is subsequent after receiving or generating log
Analysis uses., can be different according to the equipment/cluster for generating log first during carrying out log storage, log is sent out
Send the message queue different into log buffer area, in turn, parse to log, the log level information for including based on log
It determines the log rank of each log, then, is handled for the other log of different journal stages using different processing modes.
Fig. 2 is referred to, is described as follows for the process flow of the other log of default journal stage.
Step 201: obtaining the generation of the first equipment be default other first log of journal stage, presets log rank expression the
The information of one log recording includes fault message.
Wherein, it presets log rank and is specifically as follows a kind of or multiple log ranks.Due to presetting the other log of journal stage
Including fault message, thus such log is usually more important, priority is higher.It is with default journal format above-mentioned
Example, the fault message that such log includes can recorde the log DETAILS SECTION in log, and fault message specifically can be failure
The contents such as position, failure number, fault time occur.
Step 202: according to fault message, determining that the first log is to indicate the log of Fisrt fault classification.
After obtaining the first log, the fault message of the first log recording can be analyzed, with to the first log into
Row classification.For example, the operation such as keyword retrieval, regular expression matching can be carried out to the content that fault message includes,
The fault category indicated with determining first log.
In the embodiment of the present invention, the fault category for the first log determined is referred to as Fisrt fault classification.
Step 203: the first verification tool of instruction the first equipment operation and Fisrt fault categorical match, the first verification tool
For verifying whether that there are the failures of Fisrt fault classification.
In the electronic device, due to hardware or network the problems such as, it may appear that many transient faults, these transient faults are big
Part is all that electronic equipment (such as cluster) can will not even make the operation of electronic equipment with self-recovery, some transient faults
At influence.But the log of these transient faults can interfere operation maintenance personnel orientation problem, bring unnecessary work to operation maintenance personnel
It measures, influences O&M efficiency.
In the embodiment of the present invention, the first verification tool can be verified the failure of Fisrt fault classification.It sets when first
After the standby failure for reporting Fisrt fault classification by the first log, log processing device can indicate that the first equipment operation first is tested
Card tool, to verify the failure that whether there is Fisrt fault classification in the first equipment.Cause the first equipment if it is transient fault
It reports, then the failure will not continue to exist, when the first verification tool is verified, would not be verified in the first equipment
The failure of Fisrt fault classification.
Wherein, the first verification tool for example can be test script program.Also, the first verification tool can be stored in
In first equipment, it is also possible to when needing to run the first verification tool, the first equipment is from log processing device or other deposits
Storage space sets reception/acquisition.
Step 204: obtaining the first equipment and run the verification result that the first verification tool is verified, and according to verification result
Determine whether to carry out alarming processing to the first log.
Since the first verification tool is for verifying whether there are the failure of Fisrt fault classification, thus the first verification tool
Verification result at least may include that both are possible there are failure and there is no failure, moreover, being tested according to the difference of proof rule
It can also include other possible for demonstrate,proving result.
In the embodiment of the present invention, after obtaining verification result, determined whether according to the difference of verification result to the first log
Alarming processing is carried out, if verification result shows not needing to alert, so that it may determine that cancellation carries out alarming processing to the first log, with
Achieve the effect that the log quantity for reducing alarm.By reaching to the further screening for the log for including fault message, investigation
The effect for reducing the log quantity of alarm, reduces electronic equipment O&M difficulty.
In a kind of possible embodiment, the specific proof rule that the first equipment of instruction runs the first verification tool can be with
Be: the first equipment of instruction is verified by the first verification tool, and the first equipment is enabled to deposit reaching default verifying number or determine
In the failure of Fisrt fault classification, verification result is generated.It is separated by preset time between the verifying twice of front and back wherein it is possible to set
Interval.Wherein, the first equipment of instruction is verified by the first verification tool, be can be the first equipment of instruction and is passed through the first verifying
Tool is verified repeatedly.
By setting the verifying of default verifying number, can more accurately determine in the first equipment with the presence or absence of instantaneous
Other failures outside failure.
Correspondingly, being determined whether during carrying out alarming processing to the first log according to verification result, if verification result
Show that the failure of Fisrt fault classification is not present in the verifying of default verifying number the first equipment, then cancels to the first log
Carry out alarming processing, and adjust the first log log rank be different from preset the other other log ranks of journal stage, otherwise,
It determines and alarming processing is carried out to the first log.
That is, in the case where indicating that the first verification tool verifies the first equipment, only default verifying time
The failure of Fisrt fault classification is not present in the first equipment in several verifyings, and log processing device does not just accuse the first log
Alert processing.
In a kind of possible embodiment, the first verification tool, which can be, is sent to the first equipment by log processing equipment
's.And before indicating that the first equipment runs the first verification tool, it can also include determining whether be stored in log processing library
The step of with the verification tool of Fisrt fault categorical match.It is tested that is, determining and whether being stored with first in preset log processing library
Otherwise card tool determines if so, the first verification tool is sent to the first equipment and carries out alarming processing to the first log.
Wherein, log processing library is for storing file relevant to log processing, for example, in addition to verification tool above-mentioned
Outside, log processing library can be also used for the contents such as storage fault solution information.
In a kind of possible embodiment, the first log can also include for indicating the first equipment locating for itself
The topology information of position in network topology structure can determine the first equipment in the network topology structure according to the topology information
In position.
For example, topology information can be the number of the host in log when the first log uses default journal format above-mentioned
And cluster number.Specifically, in network topology structure is set when the cluster number of the host number of each host and each cluster,
It can recorde each host and number topology location corresponding with each cluster number.In this way, know the first equipment host number and
When cluster number, so that it may according to the corresponding relationship of host number and cluster number and topology location, determine that the first equipment exists
Position in the network topology structure.
Before determining the log that the first log is expression Fisrt fault classification according to fault message, so that it may according to topology
Information, determines whether the first equipment is located at the insignificant position in network topology structure, if it is not, then directly determining to the first log
Carry out alarming processing.
Usually, the range that the device fails of insignificant position are influenced is smaller, because without to insignificant position
The log for the equipment set preferentially is alerted.And the range that the device fails of critical positions are influenced is larger, thus need
The log of the equipment of critical positions is preferentially alerted.It, can be with setting network topology knot in a kind of feasible division mode
It is insignificant position that cluster internal location of fault can only be caused in structure, will lead to other clusters events in setting network topological structure
The position of barrier is critical positions.
For concrete example, which can indicate that the first equipment is the node in cluster, or indicate that first sets
The standby cluster to be in end in network topology structure.
In a kind of possible embodiment, when determining to the first log progress alarming processing, log can also be determined
Whether fault solution information with Fisrt fault categorical match is stored in processing library, if so, showing the event to user
Hinder solution information, to prompt user's failure according to existing for the fault solution information the first equipment of solution.
Wherein, fault solution information may include for instructing the help for how solving Fisrt fault classification failure literary
Shelves, for solving the application program etc. of Fisrt fault classification failure automatically.
In the embodiment of the present invention, carrying out alarming processing to the first log at least may include in the following two kinds alarm mode
It is one or more:
(1) management platform output: the warning information of the first log is exported to the management platform of log processing device, user
Warning information can be viewed by the management platform, wherein Fisrt fault classification is stored in determining log processing library
When fault solution information, the fault solution information and warning information are exported together to management platform；
(2) expansion interface exports: by expanding interface, log processing device being docked with short message, mailing system, works as presence
When the warning information and/or fault solution information that need to export, it can be exported by short message, mailing system, to facilitate use
Family carries out operation management whenever and wherever possible.
Through the embodiment of the present invention log processing method handle log during, can also record to log into
The specific operation process of row analysis, processing, facilitates subsequent search problem.
Also, it for the failure that corresponding solution information is not present in log processing library, is carried out to such failure
After alarm and user handle such failure, the operation note that user can also be solved to such failure is added at log
It manages in library, when encountering such problem again, to be supplied to user's reference.
Fig. 3 is referred to, Fig. 3 show a kind of flow chart of log processing method in the embodiment of the present invention.It should illustrate
It is that the execution sequence of each step shown in Fig. 3 is only used for illustrating, is not used to limit the sequence that executes of each step, also, having
In the implementation process of body, it is convenient to omit the part steps in Fig. 3 can also add new step in Fig. 3.
The process of log processing method shown in Fig. 3 is introduced below:
Step 301: obtaining the generation of the first equipment is default other first log of journal stage；
Step 302: it is non-in the network topology structure of network locating for the first equipment itself to determine whether the first equipment is located at
Critical positions, it is no to then follow the steps 311 if so then execute subsequent step 303；
Step 303: the fault message for including according to the first log determines that the first log is the day for indicating Fisrt fault classification
Will；
Step 304: determining the first verification tool whether is stored in log processing library, if so then execute subsequent step
305, it is no to then follow the steps 310, and step 311 is executed after executing 310；
Step 305: the first verification tool is sent to the first equipment；
Step 306: the first equipment of instruction executes following operation: it is verified by the first verification tool, it is default reaching
It verifies number or determines there are when the failure of Fisrt fault classification, generate verification result；
Step 307: obtaining the verification result that the first equipment generates；
Step 308: determining from whether the verification result that the first equipment obtains shows in the verifying of default verifying number the
The failure of Fisrt fault classification is not present in one equipment, no to then follow the steps 310 if so then execute subsequent step 309, and
Step 311 is executed after executing 310；
Step 309: the log rank cancelled and carry out alarming processing to the first log, and adjust the first log is different from pre-
If the other other log ranks of journal stage；
Step 310: determining whether to be stored in log processing library and believe with the fault solution of Fisrt fault categorical match
Breath, if so, showing the fault solution information to user；
Step 311: alarming processing is carried out to the first log.
Embodiment two
Fig. 4 is referred to, based on the same inventive concept, the embodiment of the present invention provides a kind of log processing device, at the log
It manages device and includes at least log acquisition module 401, fault category determining module 402, authentication module 403 and alarm judgment module
404, in which:
Log obtains module 401, is default other first log of journal stage for obtaining the generation of the first equipment, presets day
Will rank indicates that the information of the first log recording includes fault message；
Fault category determining module 402, for determining that the first log is to indicate Fisrt fault classification according to fault message
Log；
Authentication module 403, is used to indicate the operation of the first equipment and the first verification tool of Fisrt fault categorical match, and first
Verification tool is for verifying whether that there are the failures of Fisrt fault classification；
Judgment module 404 is alerted, runs the verification result that the first verification tool is verified for obtaining the first equipment, and
Determined whether to carry out alarming processing to the first log according to verification result.
In a kind of possible embodiment, authentication module 403 is used for: instruction the first equipment by the first verification tool into
Row verifying, and reaching default verifying number or determining there are when the failure of Fisrt fault classification, generate verification result；
Alarm judgment module 404 is used for: if verification result shows that the first equipment is not in the verifying of default verifying number
There are the failures of Fisrt fault classification, then cancel and carry out alarming processing to the first log, and adjust the log rank of the first log
For different from presetting the other other log ranks of journal stage；Otherwise, it determines carrying out alarming processing to the first log.
In a kind of possible embodiment, log processing device further includes verification tool determining module, is used for:
Before indicating the first verification tool of the operation of the first equipment and Fisrt fault categorical match, preset log is determined
Whether first verification tool is stored in processing library, and log processing library is for storing file relevant to log processing；
If so, the first verification tool is sent to the first equipment；
Otherwise, it determines carrying out alarming processing to the first log.
In a kind of possible embodiment, device further include: solution determining module is used for:
When determining to the first log progress alarming processing, determine whether be stored in preset log processing library and first
The matched fault solution information of fault category, log processing library is for storing file relevant to log processing；
If so, fault solution information is shown to user, to prompt user to solve according to fault solution information
Failure existing for first equipment.
In a kind of possible embodiment, the first log further includes the network for indicating the first equipment locating for itself
The topology information of position in topological structure, device further include topology information determining module, are used for:
Before according to fault message, determining that the first log is to indicate the log of Fisrt fault classification, according to topology information,
Determine whether the first equipment is located at the insignificant position in network topology structure, wherein insignificant position indicates that the first equipment is
Node in cluster, or indicate that the first equipment is the cluster that end is in network topology structure；
If not, it is determined that alarming processing is carried out to the first log.
In a kind of possible embodiment, log processing device can also include operation Audit Module, for recording day
The specific operation process that will processing unit is analyzed log, handled facilitates subsequent search problem.
Embodiment three
Based on the same inventive concept, the embodiment of the present invention provides a kind of computer equipment, comprising:
At least one processor, and
The memory being connect at least one processor；
Wherein, memory is stored with the instruction that can be executed by least one processor, at least one processor passes through execution
The instruction of memory storage, executes the method as described in embodiment one.
Example IV
Based on the same inventive concept, the embodiment of the present invention provides a kind of computer readable storage medium, this is computer-readable
Storage medium is stored with computer instruction, when computer instruction is run on computers, so that computer executes embodiment one
The method.
In the specific implementation process, computer readable storage medium includes: general serial bus USB
(Universal Serial Bus flash drive, USB), mobile hard disk, read-only memory (Read-OnlyMemory,
ROM), random access memory (Random Access Memory, RAM), magnetic or disk etc. are various can store program
The storage medium of code.
Above-mentioned one or more technical solutions, at least have the following beneficial effects:
In the embodiment of the present invention, obtaining the generation of the first equipment is default other first log of journal stage, the default log
Rank indicates that the information of first log recording includes fault message；According to the fault message, first log is determined to indicate
The log of Fisrt fault classification；Indicate first equipment operation and the first verification tool of the Fisrt fault categorical match, this
One verification tool is for verifying whether that there are the failures of the Fisrt fault classification；It obtains first equipment and runs the first verifying work
Have the verification result verified, and is determined whether to carry out alarming processing to first log according to the verification result.
The first equipment is verified with the presence or absence of Fisrt fault classification failure by the first verification tool, is being verified
As a result after, determined whether to carry out alarming processing to the first log according to the difference of verification result, if verification result shows not needing
Alarm, so that it may determine and cancel to the first log progress alarming processing.Pass through the further sieve to the log for including fault message
Choosing, investigation have achieved the effect that the log quantity for reducing alarm, have reduced electronic equipment O&M difficulty.
Further, by setting the verifying of default verifying number, can more accurately determine be in the first equipment
No other failures there are outside transient fault.
Further, by determining whether be stored with the first verification tool in log processing library, and in determining be stored with
First verification tool is sent to the first equipment, can guarantee the normal execution of subsequent verifying step, also, have for not stored
The case where first verification tool, directly alerts the first log, can be avoided and misses important log information.
Further, when determination needs to alert there are failure, it can also search the failure for solving such failure and solve
Scheme information, prompt user according to the fault solution information solve first equipment existing for failure, in order to which user is fast
Speed efficiently solves failure.
Further, position of first equipment in network topology structure is determined according to topology information, and is closed according to topology
System judges the coverage of failure, and the log of the equipment of the critical positions big to coverage is preferentially alerted, is conducive to transport
Dimension personnel have found the fault condition of critical positions in time, and the failure of critical positions is avoided to cause excessive loss.
The apparatus embodiments described above are merely exemplary, wherein units/modules as illustrated by the separation member
It may or may not be physically separated, the component shown as units/modules may or may not be
Physical unit/module, it can it is in one place, or may be distributed in multiple network unit/modules.It can basis
It is actual to need that some or all of the modules therein is selected to achieve the purpose of the solution of this embodiment.Ordinary skill people
Member is without paying creative labor, it can understands and implements.
Through the above description of the embodiments, those skilled in the art can be understood that each embodiment can
It realizes by means of software and necessary general hardware platform, naturally it is also possible to pass through hardware.Based on this understanding, on
Stating technical solution, substantially the part that contributes to existing technology can be embodied in the form of software products in other words, should
Computer software product may be stored in a computer readable storage medium, such as ROM/RAM, magnetic disk, CD, including several fingers
It enables and using so that a computer equipment (can be personal computer, server or the network equipment etc.) executes each implementation
Method described in certain parts of example or embodiment.
Finally, it should be noted that the above embodiments are merely illustrative of the technical solutions of the present invention, rather than its limitations；Although
Present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that: it still may be used
To modify the technical solutions described in the foregoing embodiments or equivalent replacement of some of the technical features；
And these are modified or replaceed, technical solution of various embodiments of the present invention that it does not separate the essence of the corresponding technical solution spirit and
Range.
Claims (12)
1. a kind of log processing method, which is characterized in that the described method includes:
Obtaining the generation of the first equipment is default other first log of journal stage, and the default log rank indicates described first day
The information of will record includes fault message；
According to the fault message, determine that first log is to indicate the log of Fisrt fault classification；
Indicate the first verification tool of the first equipment operation and the Fisrt fault categorical match, first verification tool
For verifying whether that there are the failures of the Fisrt fault classification；
It obtains first equipment and runs the verification result that first verification tool is verified, and according to the verification result
Determine whether to carry out alarming processing to first log.
2. the method as described in claim 1, which is characterized in that instruction the first equipment operation and the Fisrt fault classification
Matched first verification tool, comprising:
It indicates that first equipment is verified by first verification tool, and is deposited reaching default verifying number or determining
In the failure of the Fisrt fault classification, the verification result is generated；
Determined whether to carry out alarming processing to first log according to the verification result, comprising:
If the verification result shows that the first equipment described in the verifying of the default verifying number is not present described first
The failure of fault category is then cancelled and carries out alarming processing to first log, and adjusts the log rank of first log
For different from the default other other log ranks of journal stage；Otherwise, it determines carrying out alarming processing to first log.
3. method according to claim 1 or 2, which is characterized in that indicating the first equipment operation and first event
Before the first verification tool for hindering categorical match, the method also includes:
Determine and whether be stored with first verification tool in preset log processing library, the log processing library for store with
The relevant file of log processing；
If so, first verification tool is sent to first equipment；
Otherwise, it determines carrying out alarming processing to first log.
4. method according to claim 1 or 2, which is characterized in that when determining to first log progress alarming processing,
The method also includes:
Determine the fault solution information whether being stored in preset log processing library with the Fisrt fault categorical match,
The log processing library is for storing file relevant to log processing；
If so, the fault solution information is shown to user, to prompt the user according to the fault solution
Information solves failure existing for first equipment.
5. method according to claim 1 or 2, which is characterized in that first log further includes for indicating described first
The topology information of position of the equipment in the network topology structure locating for itself determines described according to the fault message
Before one log is the log of expression Fisrt fault classification, the method also includes:
According to the topology information, determine whether first equipment is located at the insignificant position in the network topology structure,
Wherein, the insignificant position indicates that first equipment is the node in cluster, or indicates that first equipment is the net
The cluster of end is in network topological structure；
If so, determining that first log is to indicate the log of Fisrt fault classification according to the fault message；
Otherwise, it determines carrying out alarming processing to first log.
6. a kind of log processing device, which is characterized in that described device includes:
Log obtains module, is default other first log of journal stage, the default log for obtaining the generation of the first equipment
Rank indicates that the information of first log recording includes fault message；
Fault category determining module, for determining first log to indicate Fisrt fault classification according to the fault message
Log；
Authentication module is used to indicate the first verification tool of the first equipment operation and the Fisrt fault categorical match, institute
The first verification tool is stated for verifying whether that there are the failures of the Fisrt fault classification；
Judgment module is alerted, runs the verification result that first verification tool is verified for obtaining first equipment,
And determined whether to carry out alarming processing to first log according to the verification result.
7. device as claimed in claim 6, which is characterized in that the authentication module is used for: instruction first equipment passes through
First verification tool is verified, and is being reached default verifying number or determined that there are the failures of the Fisrt fault classification
When, generate the verification result；
The alarm judgment module is used for: if the verification result shows first described in the verifying of the default verifying number
The failure of the Fisrt fault classification is not present in equipment, then cancels and carry out alarming processing to first log, and adjust institute
The log rank for stating the first log is different from the default other other log ranks of journal stage；Otherwise, it determines to described
One log carries out alarming processing.
8. device as claimed in claims 6 or 7, which is characterized in that described device further includes verification tool determining module, is used
In:
Before indicating the first verification tool of the first equipment operation and the Fisrt fault categorical match, determine preset
Whether first verification tool is stored in log processing library, and the log processing library is relevant to log processing for storing
File；
If so, first verification tool is sent to first equipment；
Otherwise, it determines carrying out alarming processing to first log.
9. device as claimed in claims 6 or 7, which is characterized in that described device further include: solution determining module is used
In:
Determine to first log carry out alarming processing when, determine whether be stored in preset log processing library with it is described
The fault solution information of Fisrt fault categorical match, the log processing library is for storing text relevant to log processing
Part；
If so, the fault solution information is shown to user, to prompt the user according to the fault solution
Information solves failure existing for first equipment.
10. device as claimed in claims 6 or 7, which is characterized in that first log further includes for indicating described first
The topology information of position of the equipment in the network topology structure locating for itself, described device further include that topology information determines mould
Block is used for:
Before according to the fault message, determining that first log is to indicate the log of Fisrt fault classification, according to described
Topology information, determines whether first equipment is located at the insignificant position in the network topology structure, wherein described non-heavy
It wants position to indicate that first equipment is the node in cluster, or indicates that first equipment is in the network topology structure
Cluster in end；
If so, determining that first log is to indicate the log of Fisrt fault classification according to the fault message；
Otherwise, it determines carrying out alarming processing to first log.
11. a kind of computer equipment, which is characterized in that the computer equipment includes:
At least one processor, and
The memory being connect at least one described processor；
Wherein, the memory is stored with the instruction that can be executed by least one described processor, at least one described processor
By executing the instruction of the memory storage, method according to any one of claims 1 to 5 is executed.
12. a kind of computer readable storage medium, it is characterised in that:
The computer-readable recording medium storage has computer instruction, when the computer instruction is run on computers,
So that computer executes method according to any one of claims 1 to 5.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810427172.5A CN110457183A (en) | 2018-05-07 | 2018-05-07 | A kind of log processing method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN201810427172.5A CN110457183A (en) | 2018-05-07 | 2018-05-07 | A kind of log processing method and device |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN110457183A true CN110457183A (en) | 2019-11-15 |
Family
ID=68472129
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN201810427172.5A Pending CN110457183A (en) | 2018-05-07 | 2018-05-07 | A kind of log processing method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN110457183A (en) |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111314115A (en) * | 2020-01-19 | 2020-06-19 | 苏州浪潮智能科技有限公司 | Alarm method, device and equipment based on IDL log and readable medium |
| CN111756581A (en) * | 2020-07-07 | 2020-10-09 | 南方电网数字电网研究院有限公司 | Power distribution network operation fault processing method and device, computer equipment and storage medium |
Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107563528A (en) * | 2017-09-07 | 2018-01-09 | 朱明增 | A kind of intelligent operational system strengthened EMS system defence and quickly healed |
| CN107612756A (en) * | 2017-10-31 | 2018-01-19 | 广西宜州市联森网络科技有限公司 | A kind of operation management system with intelligent trouble analyzing and processing function |
| CN107862393A (en) * | 2017-10-31 | 2018-03-30 | 广西宜州市联森网络科技有限公司 | A kind of IT operation management system |
-
2018
- 2018-05-07 CN CN201810427172.5A patent/CN110457183A/en active Pending
Patent Citations (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN107563528A (en) * | 2017-09-07 | 2018-01-09 | 朱明增 | A kind of intelligent operational system strengthened EMS system defence and quickly healed |
| CN107612756A (en) * | 2017-10-31 | 2018-01-19 | 广西宜州市联森网络科技有限公司 | A kind of operation management system with intelligent trouble analyzing and processing function |
| CN107862393A (en) * | 2017-10-31 | 2018-03-30 | 广西宜州市联森网络科技有限公司 | A kind of IT operation management system |
Cited By (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN111314115A (en) * | 2020-01-19 | 2020-06-19 | 苏州浪潮智能科技有限公司 | Alarm method, device and equipment based on IDL log and readable medium |
| CN111756581A (en) * | 2020-07-07 | 2020-10-09 | 南方电网数字电网研究院有限公司 | Power distribution network operation fault processing method and device, computer equipment and storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| US9569325B2 (en) | Method and system for automated test and result comparison | |
| CN107797919A (en) | The method and computing device of a kind of automatic test | |
| CN106155883B (en) | A kind of virtual machine method for testing reliability and device | |
| US7801719B2 (en) | Processor-based system analysis automation | |
| CN112181804B (en) | Parameter verification method, device and storage medium | |
| CN109471845A (en) | Blog management method, server and computer readable storage medium | |
| CN111209166B (en) | Automatic inspection system for B/S architecture service system | |
| CN112737800B (en) | Service node fault positioning method, call chain generating method and server | |
| CN110222028A (en) | A kind of data managing method, device, equipment and storage medium | |
| CN110245077A (en) | A kind of response method and equipment of program exception | |
| CN109254922A (en) | A kind of automated testing method and device of server B MC Redfish function | |
| CN110457183A (en) | A kind of log processing method and device | |
| CN112313627A (en) | Mapping mechanism of events to serverless function workflow instances | |
| CN111913824A (en) | Method for determining data link fault reason and related equipment | |
| Iyer et al. | Measurement-based analysis of networked system availability | |
| CN116743619B (en) | Network service testing method, device, equipment and storage medium | |
| CN113010341A (en) | Method and equipment for positioning fault memory | |
| CN109634838A (en) | Position method, apparatus, storage medium and the electronic equipment of application failure | |
| CN101373506B (en) | Method for detecting software loophole model based on loophole model | |
| KR20190002280A (en) | Apparatus and method for managing trouble using big data of 5G distributed cloud system | |
| US9354962B1 (en) | Memory dump file collection and analysis using analysis server and cloud knowledge base | |
| CN114338347A (en) | Ampere platform-based fault information out-of-band acquisition method and device | |
| CN113626288A (en) | Fault processing method, system, device, storage medium and electronic equipment | |
| CN1592238A (en) | Method and appatatus for processing wide band device fault positioning requesting | |
| CN108848005A (en) | A kind of method and system of the test network in cloud computing system |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| RJ01 | Rejection of invention patent application after publication |
Application publication date: 20191115 |
|
| RJ01 | Rejection of invention patent application after publication |