CN111324505B

CN111324505B - Log collection method and device, electronic equipment and storage medium

Info

Publication number: CN111324505B
Application number: CN201911102477.XA
Authority: CN
Inventors: 徐立峰
Original assignee: Hangzhou Hikvision System Technology Co Ltd
Current assignee: Hangzhou Hikvision System Technology Co Ltd
Priority date: 2019-11-12
Filing date: 2019-11-12
Publication date: 2023-03-14
Anticipated expiration: 2039-11-12
Also published as: CN111324505A

Abstract

The embodiment of the invention provides a log collection method, a log collection device, electronic equipment and a storage medium, which relate to the technical field of computers and comprise the following steps: after a first log buried point is triggered, collecting log data, determining a first probability of the log data being stored in a log file, storing the collected log data in a memory under the condition that the first probability is smaller than a preset threshold, and storing the collected log data and the log data collected when a second log buried point stored in the memory is triggered in the log file under the condition that the first probability reaches the preset threshold. Therefore, when the scheme provided by the embodiment of the invention is applied to log collection, the requirement on storage resources can be reduced.

Description

Log collection method and device, electronic equipment and storage medium

Technical Field

The present invention relates to the field of computer technologies, and in particular, to a log collection method and apparatus, an electronic device, and a storage medium.

Background

In order to facilitate a developer to track and analyze the running condition of the program and locate a fault, log collection is required in the running process of the program, and the collected logs comprise log data generated in the running process of the program.

In the prior art, when collecting logs, all log data generated in the program running process are collected, and the collected log data are stored in a log file, so that log collection is completed. The data volume of the log data collected in the program running process is huge, so that the requirement on storage resources is high when the log collection is carried out by applying the method.

Disclosure of Invention

The embodiment of the invention aims to provide a log collection method, a log collection device, electronic equipment and a storage medium, so as to reduce the requirement on storage resources during log collection. The specific technical scheme is as follows:

in a first aspect, an embodiment of the present invention provides a log collecting method, where the method includes:

collecting log data after the first log buried point is triggered;

determining a first probability of the log data being stored in a log file, wherein the first probability is positively correlated with a probability of triggering a preset event in the process of executing a first task, each embedded point path corresponds to a program task, and the first task is: program tasks corresponding to the embedded point paths where the first log embedded points are located, wherein each embedded point path is as follows: executing a path formed by sequentially triggering the log embedded points in the program task process corresponding to the embedded point path;

under the condition that the first probability is smaller than a preset threshold value, storing the collected log data into a memory;

under the condition that the first probability reaches the preset threshold, storing the collected log data and log data collected when a second log burying point stored in the memory is triggered into the log file, wherein the second log burying point is as follows: triggering a logging site that is sequentially prior to the first logging site during execution of the first task.

In an embodiment of the present invention, the first probability P is calculated by the following formula:

P＝a*S1/S2

wherein, the S2 represents the number of times that the first log burying point has been triggered, the S1 represents the number of times that the preset event has been triggered during the execution of the first task, and a is a preset weight coefficient.

In one embodiment of the invention, the first task comprises at least one program task including an actually executed second task, and the method further comprises:

after the second task is executed, according to a result of whether the preset event is triggered in the process of executing the second task, updating a second probability representing that first log data is stored in the log file in the process of executing the second task, wherein the first log data is as follows: and log data collected when each log buried point included in the buried point path corresponding to the second task is triggered.

In one embodiment of the invention, the first task comprises at least one program task including a second task actually performed, and the method further comprises:

after the second task is executed, deleting the log data stored in the memory and acquired in the process of executing the second task;

and/or

And recording an identifier representing that the second task is executed in the log file under the condition that the second task is executed completely and the preset event is not triggered.

In a second aspect, an embodiment of the present invention provides a log collecting device, where the log collecting device includes:

the data acquisition module is used for acquiring log data after the first log buried point is triggered;

a probability determination module, configured to determine a first probability that the log data is stored in a log file, where the first probability is positively correlated to a probability that a preset event is triggered in a process of executing a first task, each of the embedded point paths corresponds to a program task, and the first task is: program tasks corresponding to the embedded point paths where the first log embedded points are located, wherein each embedded point path is as follows: a path formed by log embedded points sequentially triggered in the process of executing the program task corresponding to the embedded point path;

the first data storage module is used for storing the collected log data into a memory under the condition that the first probability is smaller than a preset threshold value;

a second data storage module, configured to, when the first probability reaches the preset threshold, store the acquired log data and log data acquired when a second log burying point stored in the memory is triggered into the log file, where the second log burying point is: triggering a logging site that is sequentially prior to the first logging site during execution of the first task.

P＝a*S1/S2

In one embodiment of the invention, the first task comprises at least one program task including a second task actually performed, the apparatus further comprises:

a probability updating module, configured to update a second probability representing that first log data is stored in the log file in a process of executing a second task according to a result of whether the preset event is triggered in the process of executing the second task after the second task is executed, where the first log data is: and log data collected when each log buried point included in the buried point path corresponding to the second task is triggered.

the data deleting module is used for deleting the log data which are stored in the memory and acquired in the process of executing the second task after the second task is executed;

and/or

And the identification recording module is used for recording an identification which represents that the second task is executed in the log file under the condition that the second task is executed and the preset event is not triggered.

In a third aspect, an embodiment of the present invention provides an electronic device, including a processor, a communication interface, a memory, and a communication bus, where the processor and the communication interface complete communication between the memory and the processor through the communication bus;

a memory for storing a computer program;

a processor for implementing the method steps of any of the first aspect when executing a program stored in the memory.

In a fourth aspect, the present invention provides a computer-readable storage medium, in which a computer program is stored, and the computer program, when executed by a processor, implements the method steps in any one of the first aspect.

The embodiment of the invention has the following beneficial effects:

as can be seen from the above, when the log is collected by applying the scheme provided by the embodiment of the present invention, after the first log burying point is triggered, the log data is collected, and the first probability that the log data is stored in the log file is determined, where the first probability is positively correlated with the probability that the preset event is triggered in the process of executing the first task, that is, when the first probability is smaller than the preset threshold, it indicates that the probability that the preset event is triggered in the process of executing the first task is low, it can be understood that the correlation between the event represented by the first log burying point and the preset event is low, and therefore, the collected log data is temporarily stored in the memory; when the first probability reaches the preset threshold, it is stated that the probability that the preset event is triggered during the execution of the first task is high, and it can be understood that the correlation between the event represented by the first log burial point and the preset event is high, so that the collected log data and the log data collected when the second log burial point stored in the memory is triggered are stored in the log file. Therefore, the finally obtained log file only contains data with a certain correlation with the preset event, so that the storage resources occupied by the log can be reduced, and the requirement on the storage resources during log collection can be reduced.

In addition, when the log data is stored in the log file, the log data acquired when the second log buried point stored in the memory is triggered is stored in the storage file, so that the acquired log file contains the data acquired when the first task is executed completely, the log content is not lost, and the log is convenient to analyze subsequently.

Drawings

In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to the drawings without creative efforts.

Fig. 1 is a schematic flowchart of a log collection method according to an embodiment of the present invention.

Fig. 2 is a first directional diagram provided by the embodiment of the present invention.

Fig. 3 is a second directional diagram provided by the embodiment of the present invention.

Fig. 4 is a schematic diagram of a third directional diagram provided by the embodiment of the present invention.

Fig. 5 is a schematic diagram of a fourth directional diagram provided in an embodiment of the present invention.

Fig. 6 is a schematic structural diagram of a log collection device according to an embodiment of the present invention.

Fig. 7 is a schematic structural diagram of an electronic device according to an embodiment of the present invention.

Detailed Description

The technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be obtained by a person skilled in the art without making any creative effort based on the embodiments in the present invention, belong to the protection scope of the present invention.

Referring to fig. 1, fig. 1 is a schematic flowchart of a log collection method according to an embodiment of the present invention, including steps 101 to 104.

The execution main body of the embodiment of the present invention may be an electronic device running an application program, for example, the application program may be a device testing program, a device monitoring program, an online forwarding program, and the like, and the electronic device may be a desktop computer, a notebook computer, a server, a mobile phone, and the like.

Step 101, collecting log data after a first log buried point is triggered.

Wherein, the log burial point representation: for convenience of description, in the embodiment of the present invention, a currently triggered log burying point is referred to as a first log burying point. These events may be events determined by application test requirements, monitoring requirements, and the like. For example, the event may be an event of sending a test instruction, an event of starting a monitoring agent, or the like. The log data is preset data to be collected after the log burying point is triggered, and may be, for example, trigger time, parameters of program operation, information of an event represented by the triggered log burying point, and the like.

Specifically, in order to complete a program task, for example, the program task may be to test device performance, upload local data, and the like, one or more events may be triggered in an operation process, and an event to be log-collected is preset in the triggered events as a log burying point according to a requirement, so that after an event corresponding to the log burying point is triggered, log data can be collected.

For example, assuming that the program task is to open an encrypted file, the events that may be triggered during execution of the program task include: the method comprises the steps of obtaining file information, searching a file position, selecting an encrypted file, inputting a password, selecting an opening mode, successfully opening the encrypted file and the like, wherein the file position searching, the encrypted file selecting and the password inputting are events needing to be monitored, log burial is carried out on the events, and therefore log data acquisition can be carried out when an application program executes to the file position searching, the encrypted file selecting and the password inputting.

At step 102, a first probability that log data is stored to a log file is determined.

The first probability is positively correlated with the probability that the preset event is triggered in the process of executing the first task. The higher the probability that the preset event is triggered in the process of executing the first task, the larger the first probability; the lower the probability that the preset event is triggered during the execution of the first task, the smaller the first probability.

Each of the plurality of buried point paths corresponds to a program task, and each of the plurality of buried point paths is: the paths formed by the log embedded points sequentially triggered in the process of executing the program task corresponding to the embedded point paths can form a directed graph. In an embodiment of the present invention, a buried point path where the first log buried point is located may be determined, and the first task is a program task corresponding to the first buried point path as the first buried point path.

For example, as shown in FIG. 2, FIG. 2 is a directed graph composed of various interrelated buried point paths, wherein 1-9 represent various journal buried points, and 1-2-3-5-8, 1-2-3-6-9, and 1-2-4-7-9 represent various buried point paths. Assuming that the journal buried point 3 is the first journal buried point, the first buried point path includes 1-2-3-5-8 and 1-2-3-6-9.

The preset events are as follows: events needing attention are preset in the events triggered in the running process of the application program. The preset event may be an event characterized by a log burying point, or an event other than the event characterized by the log burying point. The preset event is triggered in the process of executing the program task corresponding to at least one embedded point path in each embedded point path. The probability that the preset event is triggered is greater than or equal to 0% and less than or equal to 100%. The first probability is 0% or more.

In an embodiment of the present invention, a hooking function may be set for an implementation function of a preset event, and after the preset event is triggered, the hooking function may learn that the preset event is triggered. Besides, whether the preset event is triggered or not can be determined by means of event monitoring.

The probability that the preset event is triggered in the process of executing the first task can be obtained by counting the number of times that the preset event is triggered in the process of executing the first task before. Specifically, the number Num1 of times of executing the first task before may be counted, and since the first task is a program task corresponding to a buried point path where the first log buried point is located, the number Num1 of times of executing the first task is the number of times that the first log buried point is triggered; the number Num2 of times the preset event is triggered in the process of executing the first task before is counted, and since the first task is a program task corresponding to at least one embedded point path, that is, the first task includes at least one program task, the number Num2 of times the preset event is triggered in the process of executing the first task is counted, that is, the sum of the number of times the preset event is triggered in the program task corresponding to each embedded point path where the first log is located is counted. And calculating the ratio of Num2 to Num1 as the probability of triggering the preset event in the process of executing the first task.

For example, as shown in fig. 2, if the first log buried point is the log buried point 2, the first task is a program task corresponding to the buried point path 1-2-3-5-8, the buried point path 1-2-4-7-9, and the buried point path 1-2-3-6-9, and the preset event is the log buried point 9. Suppose that the log embedded point 2 is triggered 100 times in the process of executing the first task, that is, the number Num1 of times of executing the first task is 100 times, wherein in the process of executing the first task, the number of times that the program task corresponding to the embedded point path 1-2-3-5-8 is triggered to the preset event is 0, the number of times that the program task corresponding to the embedded point path 1-2-3-6-9 is triggered to the preset event is 8, and the number of times that the program task corresponding to the embedded point path 1-2-4-7-9 is triggered to the preset event is 2, so the number Num2 of times of triggering the preset event in the process of executing the first task is counted as 10 times, and the probability that the preset event is triggered in the process of executing the first task is calculated as 10%.

In one embodiment of the invention, a first probability that log data is stored in a log file can be calculated after a first log buried point is triggered, so as to obtain the first probability. The first probability may be calculated before the first buried log is triggered, and the first probability may be obtained directly after the first buried log is triggered.

In the case where the first probability is calculated before the first log burying point is triggered, the first probability may be calculated after the last preset event is triggered, or may be calculated after the last program task is completed.

In one embodiment of the present invention, the first probability P can be calculated by the following formula:

P＝a*S1/S2

wherein, S2 represents the number of times that the first log burying point has been triggered, S1 represents the number of times that a preset event has been triggered during the execution of the first task, and a is a preset weight coefficient. The weighting factor may be 0.5, 1.0, 1.5, 2, etc., and the embodiment of the present invention does not limit this. The specific value of the weight coefficient may be determined according to the degree of attention to the preset event, and the weight coefficient is larger if the degree of attention to the preset event is higher, and the weight coefficient is smaller if the degree of attention to the preset event is lower. For an application, there may be multiple preset events, and the attention degree for different preset events may be different, and therefore, different weighting factors may be set for different preset events.

For example, if the first log burial point is triggered 100 times in the process of executing the program task before, S2 is 100, wherein if the preset event is triggered 8 times in the process of executing the first task, S1 is 8, and the weighting factor is 1, the first probability calculated in this way is 8%.

And 103, storing the acquired log data into a memory under the condition that the first probability is smaller than a preset threshold.

The preset threshold may be a threshold preset according to an application scenario and an empirical value, and may be 5%, 9%, 10%, or the like.

When the first probability is smaller than the preset threshold, it is described that the probability of triggering the preset event is small in the process of executing the first task, and it can also be understood that the correlation between the event represented by the first log buried point and the preset event is small, that is, the importance of the log data collected when the event is triggered is small, and the collected log data is temporarily stored in the memory because there is a possibility of triggering the preset event in the process of subsequently executing the first task.

For example, as shown in fig. 3, fig. 3 is a directed graph composed of the respective buried point paths associated with each other, where 1 to 9 represent the respective log buried points, 9 further represents the preset event, and the data on the upper side of each log buried point respectively represents the number of times the log buried point is triggered, the number of times the preset event is triggered during the execution of the program task corresponding to the buried point path in which the log buried point is located, and the probability of triggering the preset event during the execution of the program task corresponding to the buried point path in which the log buried point is located.

Taking the log embedded point 3 as an example, 98 indicates that the log embedded point 3 has been triggered 98 times, 8 indicates that the preset event 9 has been triggered 8 times in the process of executing the program task corresponding to the embedded point path where the log embedded point 3 is located, 8.2% is the ratio of 8 to 98, and indicates the probability that the preset event 9 is triggered in the process of executing the program task corresponding to the embedded point path where the log embedded point 3 is located. Assuming a weight factor of 1, the first probability calculated is 8.2%.

Assuming that the preset threshold is 9%, the log data is stored in the memory because the first probability corresponding to the log embedding point 3 is smaller than the preset threshold.

And step 104, under the condition that the first probability reaches a preset threshold, storing the collected log data and the log data collected when a second log buried point stored in the memory is triggered into a log file.

Wherein, the second log burial point is: a logging site that is sequentially before the first logging site is triggered during execution of the first task. For example, as shown in FIG. 3, assume that the first log burial point is: and 3, burying a point in the log, wherein the first task is as follows: the program tasks corresponding to the embedded point path 1-2-3-5-8 and the embedded point path 1-2-3-6-9, and the log embedded points with the triggering sequence before the log embedded point 3 in the first task execution process are as follows: the first journal buried point is a journal buried point 1 and a journal buried point 2, and therefore, the second journal buried point is: journal burial point 1 and journal burial point 2.

When the first probability reaches the preset threshold, it is said that the probability of triggering the preset event is higher during the execution of the first task, and it may also be understood that the correlation between the event represented by the first log buried point and the preset event is higher, that is, the importance of the log data collected when the event is triggered is higher, so that the collected log data is stored in the log file.

In addition, when an event before the event in the first task is executed, log data may be stored in the memory, and in order to ensure that the obtained log file may include complete log data collected during the execution of the first task, it is necessary to store the log data collected when the second log burying point stored in the memory is triggered into the log file.

For example, as shown in fig. 3, taking the journal buried point 6 as an example, the probability that the preset event 9 is triggered in the process of executing the program task corresponding to the buried point path where the journal buried point 6 is located is 100%. Assuming that the preset threshold is 9%, the log data is stored in the log file because the probability corresponding to the log burying point 6 reaches the preset threshold. Since the log data corresponding to the trigger of the buried journal point 3 is stored in the memory during execution of the task, the log data corresponding to the buried journal point 3 stored in the memory is also stored in the log file when the trigger of the buried journal point 6 is performed.

It should be noted that the execution sequence of collecting log data in step 101 is not limited, where the execution sequence of collecting log data is after the first log burying point is triggered and before storing the log data in step 103 and step 104, specifically, the log data may be collected after the first log burying point is triggered in step 101, or the log data may be collected after the first probability is determined in step 102, and the present invention is not limited thereto.

In an embodiment of the present invention, the first task includes at least one program task including a second task actually executed, and the log collection method further includes the following steps:

and after the second task is executed, updating a second probability representing that the first log data is stored in the log file in the process of executing the second task according to the result of whether the preset event is triggered in the process of executing the second task.

Wherein the second task is: the program task actually executed in the first task is the program task corresponding to the embedded point path formed by the embedded points of the logs actually triggered in the first task process. For example, as shown in fig. 3, assuming that the first logging site is logging site 3, the first task includes: the embedded point path 1-2-3-5-8 and the embedded point path 1-2-3-6-9 correspond to program tasks, and actually, in the program running process, the actually triggered embedded point path is one of the two paths. Assuming that the actually triggered buried point path is 1-2-3-5-8, the second task is: program tasks corresponding to the embedded point paths 1-2-3-5-8; assuming that the actually triggered buried point path is 1-2-3-6-9, the second task is: and program tasks corresponding to the buried point paths 1-2-3-6-9.

The first log data is: and log data collected when each log buried point included in the buried point path corresponding to the second task is triggered. For example, in the case that the buried point path corresponding to the second task is 1-2-3-5-8, the log buried point included in the buried point path is: and if the logs are embedded at

points

1, 2, 3, 5 and 8, the first log data is as follows: and log data collected when the

log burying points

1, 2, 3, 5 and 8 are triggered.

Specifically, when the preset event is triggered during the execution of the second task, the probability representing the probability that the preset event is triggered during the execution of the second task increases, and accordingly, the second probability that the first log data is stored in the log file also increases. It can be understood that, when a new program task is executed, assuming that a log buried point in a buried point path corresponding to a second task is triggered during the execution of the new program task, the probability that log data collected when the log buried point is triggered is stored in a log file increases.

In the case that the preset event is not triggered during the execution of the second task, the probability of representing the probability of the preset event being triggered during the execution of the second task is reduced, and accordingly, the second probability of the first log data being stored into the log file is also reduced. It can be understood that, when a new program task is executed, if a log buried point in a buried point path corresponding to a second task is triggered during the execution of the new program task, the probability that log data collected when the log buried point is triggered is stored in a log file is reduced.

For example, as shown in fig. 3, assuming that the path of the embedded point corresponding to the second task is 1-2-3-6-9 and the preset event is an event corresponding to the embedded point of the log 9, it can be known that the preset event is triggered in the process of executing the second task, and therefore, a second probability that the log data collected when the embedded point of the

log

1, 2, 3, 6, 9 is triggered in the process of executing the second task is stored in the log file is increased; assuming that the embedded point path corresponding to the second task is 1-2-3-5-8 and the preset event is an event corresponding to the log embedded point 9, it can be known that the preset event is not triggered in the process of executing the second task, and therefore, the second probability that the log data collected when the log embedded

points

1, 2, 3, 5, and 8 are triggered in the process of executing the second task is stored in the log file is reduced.

In an embodiment of the present invention, the second probability is calculated in the same manner as the first probability in step 103, and a ratio between the number of times that the preset event has been triggered and the number of times that each log burying point has been triggered in the process of executing the second task may be multiplied by a preset weight coefficient to obtain the second probability.

Specifically, taking the embedded journal point 3 as an example, the embedded journal point 3 is triggered 98 times, and the preset event 9 is triggered 8 times in the process of executing the program task corresponding to the embedded journal point path where the embedded journal point 3 is located. After the second task is executed, the log burying point 3 is triggered 99 times, the preset event 9 is triggered 9 times in the process of executing the program task corresponding to the burying point path where the log burying point 3 is located, and if the weight coefficient is 1, the second probability corresponding to the log burying point 3 becomes 9.1%. Similarly, the second probability corresponding to each log buried point in the buried point path corresponding to the second task is updated, and finally, the probability that the preset event in the program task represented by the buried point path where each log buried point is located is triggered is shown in fig. 4.

In an embodiment of the present invention, the first task includes at least one program task including an actually executed second task, and after the second task is executed, the log data collected during the execution of the second task and stored in the memory is deleted. After the second task is executed, if log data acquired in the process of executing the second task also exists in the memory, it indicates that an event with high correlation with a preset event is not triggered in the subsequent process of executing the second task, that is, the log data in the memory has no analytical significance, and in order to save memory space, the log data acquired in the process of executing the second task and stored in the memory is deleted.

In one embodiment of the invention, the first task comprises at least one program task including an actually executed second task, and under the condition that the second task is executed completely and a preset event is not triggered, an identifier which indicates that the second task is executed completely is recorded in the log file.

The identifier indicating that the second task has been executed may be a mathematical symbol, such as "0001", or an english symbol, such as "over", "end", and the like, which is not limited in the present invention.

In a complete embodiment of the present invention, as shown in fig. 5, if the path of the embedded point is 1-2-3-5-8 and the preset threshold is 9%, the specific storage process of the log data in the process of executing the program task is as follows:

triggering a log burying point 1, collecting log data corresponding to the log burying point 1, and storing the log data in a log file;

triggering the log burying point 2, collecting log data corresponding to the log burying point 2, and storing the log data in a log file;

triggering a log burying point 3, collecting log data corresponding to the log burying point 3, and storing the log data in a log file;

triggering the log burying point 5, collecting log data corresponding to the log burying point 5, and storing the log data in a memory;

triggering the log burying point 8, collecting log data corresponding to the log burying point 8, and storing the log data in a memory;

after the program task is executed, deleting the log data stored in the memory, and recording an identifier indicating that the program task is executed in a log file, wherein if the identifier is "over", the log data stored in the final log file comprises: the log data corresponding to the log burying point 1, the log data corresponding to the log burying point 2, the log data corresponding to the collected log burying point 3 and the identifier "over".

As can be seen from the above, when the log is collected by applying the scheme provided in the above embodiment, after the first log buried point is triggered, the log data is collected, and the first probability that the log data is stored in the log file is determined, where the first probability is positively correlated to the probability that the preset event is triggered in the process of executing the first task, that is, when the first probability is smaller than the preset threshold, it indicates that the probability that the preset event is triggered in the process of executing the first task is low, it can be understood that the correlation between the event represented by the first log buried point and the preset event is low, and therefore the collected log data is temporarily stored in the memory; when the first probability reaches the preset threshold, it is described that the probability that the preset event is triggered during the execution of the first task is high, and it can be understood that the correlation between the event represented by the first log buried point and the preset event is high, so that the collected log data and the log data collected when the second log buried point stored in the memory is triggered are stored in the log file. The finally obtained log file only contains data which has a certain correlation with a preset event, so that storage resources occupied by the log can be reduced, and the log data collected when a second log buried point stored in the memory is triggered can be stored in the storage file when the log data is stored in the log file, so that the obtained log file contains the data collected when the first task is completely executed, the log content is not lost, and the log is convenient to analyze subsequently. Therefore, when the scheme provided by the embodiment is applied to log collection, the requirement on storage resources during log collection can be reduced.

Referring to fig. 6, fig. 6 is a schematic structural diagram of a log collecting device according to an embodiment of the present invention, where the log collecting device includes:

the data acquisition module 601 is used for acquiring log data after a first log buried point is triggered;

a probability determining module 602, configured to determine a first probability that the log data is stored in a log file, where the first probability is positively correlated to a probability that a preset event is triggered in a process of executing a first task, each embedded point path corresponds to a program task, and the first task is: program tasks corresponding to the embedded point paths where the first log embedded points are located, wherein each embedded point path is as follows: a path formed by log embedded points sequentially triggered in the process of executing the program task corresponding to the embedded point path;

a first data storage module 603, configured to store the acquired log data in a memory when the first probability is smaller than a preset threshold;

a second data storage module 604, configured to, when the first probability reaches the preset threshold, store the collected log data and log data collected when a second log burying point stored in the memory is triggered into the log file, where the second log burying point is: triggering a first logging site prior in sequence to the first logging site during execution of the first task.

P＝a*S1/S2

In one embodiment of the invention, the first task comprises at least one program task including a second task actually performed, the apparatus further comprising:

a probability updating module, configured to update a second probability representing that first log data is stored in the log file in a process of executing a second task according to a result of whether the preset event is triggered in the process of executing the second task after the second task is executed, where the first log data is: and log data collected when all log buried points included in the buried point path corresponding to the second task are triggered.

and/or

As can be seen from the above, when the log is collected by applying the scheme provided by the above embodiment, after the first log burying point is triggered, the log data is collected, and the first probability that the log data is stored in the log file is determined, where the first probability is positively correlated with the probability that the preset event is triggered in the process of executing the first task, that is, when the first probability is smaller than the preset threshold, it indicates that the probability that the preset event is triggered in the process of executing the first task is low, it can be understood that the correlation between the event represented by the first log burying point and the preset event is low, and therefore, the collected log data is temporarily stored in the memory; when the first probability reaches the preset threshold, it is stated that the probability that the preset event is triggered during the execution of the first task is high, and it can be understood that the correlation between the event represented by the first log burial point and the preset event is high, so that the collected log data and the log data collected when the second log burial point stored in the memory is triggered are stored in the log file. The finally obtained log file only contains data which has a certain correlation with a preset event, so that storage resources occupied by the log can be reduced, and the log data collected when a second log buried point stored in the memory is triggered can be stored in the storage file when the log data is stored in the log file, so that the obtained log file contains the data collected when the first task is completely executed, the log content is not lost, and the log is convenient to analyze subsequently. Therefore, when the scheme provided by the embodiment is applied to log collection, the requirement on storage resources during log collection can be reduced.

An embodiment of the present invention further provides an electronic device, as shown in fig. 7, including a processor 701, a communication interface 702, a memory 703 and a communication bus 704, where the processor 701, the communication interface 702, and the memory 703 complete mutual communication through the communication bus 704,

a memory 703 for storing a computer program;

the processor 701 is configured to implement the log collection method provided in the embodiment of the present invention when executing the program stored in the memory 703.

The communication bus mentioned in the electronic device may be a Peripheral Component Interconnect (PCI) bus, an Extended Industry Standard Architecture (EISA) bus, or the like. The communication bus may be divided into an address bus, a data bus, a control bus, etc. For ease of illustration, only one thick line is shown, but this does not mean that there is only one bus or one type of bus.

The communication interface is used for communication between the electronic equipment and other equipment.

The Memory may include a Random Access Memory (RAM) or a Non-Volatile Memory (NVM), such as at least one disk Memory. Optionally, the memory may also be at least one memory device located remotely from the processor.

The Processor may be a general-purpose Processor, including a Central Processing Unit (CPU), a Network Processor (NP), and the like; but also Digital Signal Processors (DSPs), application Specific Integrated Circuits (ASICs), field Programmable Gate Arrays (FPGAs) or other Programmable logic devices, discrete Gate or transistor logic devices, discrete hardware components.

In another embodiment of the present invention, a computer-readable storage medium is further provided, in which a computer program is stored, and the computer program, when executed by a processor, implements the steps of any of the log collection methods described above.

In yet another embodiment, a computer program product containing instructions is provided, which when run on a computer, causes the computer to perform any of the log collection methods of the above embodiments.

It can be seen that, when the electronic device provided by the above embodiment is applied to log collection, when the computer program stored in the computer-readable storage medium provided by the above embodiment is executed to perform log collection, and when the computer program product provided by the above embodiment is executed on a computer to perform log collection, after a first log burying point is triggered, log data is collected, a first probability that the log data is stored in a log file is determined, and since the first probability is positively correlated with a probability that a preset event is triggered during execution of a first task, that is, when the first probability is smaller than a preset threshold, it is described that a probability that the preset event is triggered during execution of the first task is low, it can be understood that an event characterized by the first log burying point has low correlation with the preset event, and thus the collected log data is temporarily stored in a memory; when the first probability reaches the preset threshold, it is described that the probability that the preset event is triggered during the execution of the first task is high, and it can be understood that the correlation between the event represented by the first log buried point and the preset event is high, so that the collected log data and the log data collected when the second log buried point stored in the memory is triggered are stored in the log file. The finally obtained log file only contains data which has a certain correlation with a preset event, so that storage resources occupied by the log can be reduced, and the log data collected when a second log buried point stored in the memory is triggered can be stored in the storage file when the log data is stored in the log file, so that the obtained log file contains the data collected when the first task is completely executed, the log content is not lost, and the log is convenient to analyze subsequently.

Therefore, when the scheme provided by the embodiment is applied to log collection, the requirement on storage resources during log collection can be reduced.

In the above embodiments, all or part of the implementation may be realized by software, hardware, firmware, or any combination thereof. When implemented in software, it may be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. The procedures or functions described in accordance with the embodiments of the invention are collected in whole or in part when the computer program instructions are loaded and executed on a computer. The computer may be a general purpose computer, a special purpose computer, a network of computers, or other programmable device. The computer instructions may be stored in a computer readable storage medium or transmitted from one computer readable storage medium to another, for example, from one website site, computer, server, or data center to another website site, computer, server, or data center via wired (e.g., coaxial cable, fiber optic, digital Subscriber Line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.). The computer-readable storage medium can be any available medium that can be accessed by a computer or a data storage device, such as a server, a data center, etc., that incorporates one or more of the available media. The usable medium may be a magnetic medium (e.g., floppy Disk, hard Disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid State Disk (SSD)), among others.

It is noted that, herein, relational terms such as first and second, and the like may be used solely to distinguish one entity or action from another entity or action without necessarily requiring or implying any actual such relationship or order between such entities or actions. Also, the terms "comprises," "comprising," or any other variation thereof, are intended to cover a non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements does not include only those elements but may include other elements not expressly listed or inherent to such process, method, article, or apparatus. Without further limitation, an element defined by the phrases "comprising a," "8230," "8230," or "comprising" does not exclude the presence of additional like elements in a process, method, article, or apparatus that comprises the element.

All the embodiments in the present specification are described in a related manner, and the same and similar parts among the embodiments may be referred to each other, and each embodiment focuses on differences from other embodiments. In particular, apparatus embodiments, electronic device embodiments, computer-readable storage medium embodiments, and computer program product embodiments are substantially similar to method embodiments and therefore are described with relative ease with reference to the partial description of the method embodiments.

The above description is only for the preferred embodiment of the present invention, and is not intended to limit the scope of the present invention. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention shall fall within the protection scope of the present invention.

Claims

1. A method of log collection, the method comprising:

collecting log data after the first log buried point is triggered;

under the condition that the first probability reaches the preset threshold, storing the collected log data and log data collected when a second log buried point stored in the memory is triggered into the log file, wherein the second log buried point is as follows: triggering a first logging site prior in sequence to the first logging site during execution of the first task.

2. The method of claim 1, wherein the first probability P is calculated by the following formula:

P＝a*S1/S2

wherein, the S2 represents the number of times that the first log burying point has been triggered, the S1 represents the number of times that the preset event has been triggered during the execution of the first task, and the a is a preset weighting factor.

3. A method according to claim 1 or 2, wherein the first task comprises at least one program task including an actually performed second task, the method further comprising:

after the second task is executed, according to a result that whether the preset event is triggered or not in the process of executing the second task, updating a second probability representing that first log data is stored in the log file in the process of executing the second task, wherein the first log data is as follows: and log data collected when each log buried point included in the buried point path corresponding to the second task is triggered.

4. A method according to claim 1 or 2, wherein the first task comprises at least one program task including an actually performed second task, the method further comprising:

and/or

5. An apparatus for log collection, the apparatus comprising:

a probability determining module, configured to determine a first probability that the log data is stored in a log file, where the first probability is positively correlated to a probability that a preset event is triggered in a process of executing a first task, each embedded point path corresponds to a program task, and the first task is: program tasks corresponding to the embedded point paths where the first log embedded points are located, wherein each embedded point path is as follows: executing a path formed by sequentially triggering the log embedded points in the program task process corresponding to the embedded point path;

6. The apparatus of claim 5, wherein the first probability P is calculated by the following equation:

P＝a*S1/S2

7. An apparatus according to claim 5 or 6, wherein the first task comprises at least one program task comprising an actually performed second task, the apparatus further comprising:

8. An apparatus according to claim 5 or 6, wherein the first task comprises at least one program task comprising an actually performed second task, the apparatus further comprising:

and/or

And the identification recording module is used for recording an identification which represents that the second task is executed in the log file under the conditions that the second task is executed and the preset event is not triggered.

9. An electronic device is characterized by comprising a processor, a communication interface, a memory and a communication bus, wherein the processor and the communication interface are used for realizing mutual communication by the memory through the communication bus;

a memory for storing a computer program;

a processor for implementing the method steps of any of claims 1 to 4 when executing a program stored in the memory.

10. A computer-readable storage medium, characterized in that a computer program is stored in the computer-readable storage medium, which computer program, when being executed by a processor, carries out the method steps of any one of claims 1 to 4.