CN111651595A - Abnormal log processing method and device - Google Patents
Abnormal log processing method and device Download PDFInfo
- Publication number
- CN111651595A CN111651595A CN202010447139.6A CN202010447139A CN111651595A CN 111651595 A CN111651595 A CN 111651595A CN 202010447139 A CN202010447139 A CN 202010447139A CN 111651595 A CN111651595 A CN 111651595A
- Authority
- CN
- China
- Prior art keywords
- abnormal
- logs
- log
- classified
- classification
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/30—Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
- G06F16/35—Clustering; Classification
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/30—Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
- G06F16/33—Querying
- G06F16/335—Filtering based on additional data, e.g. user or group profiles
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Data Mining & Analysis (AREA)
- Databases & Information Systems (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Computational Linguistics (AREA)
- Debugging And Monitoring (AREA)
Abstract
The application discloses an abnormal log processing method and device, which are used for reducing the time spent by operation and maintenance personnel in obtaining abnormal information and improving the efficiency of obtaining the abnormal information. The method comprises the following steps: receiving an abnormal log sent by at least one application server; classifying each abnormal log at least twice according to at least two classification modes to obtain classified abnormal logs, wherein each type of abnormal logs in the classified abnormal logs is in a convergence state under the condition of the same abnormal factors; and then classifying and storing the classified abnormal logs.
Description
Technical Field
The present application relates to the field of computer technologies, and in particular, to an exception log processing method and apparatus.
Background
At present, terminals such as smart phones, tablet computers, and notebooks have become essential electronic devices in people's lives. In the using process of the terminal equipment, problems such as system errors or application program errors and the like often occur, and when the problems occur, the terminal can automatically generate an abnormal log.
In the related art, when the system is abnormal, a developer may manually search an abnormal log from a plurality of log files, and then perform analysis to determine the problem of the system that is abnormal, and perform corresponding processing. However, when the program is deployed in a distributed manner on a plurality of servers, a large number of logs are generated at every moment, and when the system is abnormal, the operation and maintenance personnel are required to determine the abnormal logs generated by the system due to the abnormality from the large number of logs, and then the abnormal information is obtained by checking the logs, which greatly depends on the level and experience of the operation and maintenance personnel, so that the final abnormal positioning has great uncertainty, the time spent by the operation and maintenance personnel in obtaining the abnormal information is long, and the obtaining efficiency is low.
Disclosure of Invention
The embodiment of the application provides an abnormal log processing method and device, which are used for reducing the time spent by operation and maintenance personnel in acquiring abnormal information and improving the acquisition efficiency.
In a first aspect, a method for processing an exception log is provided, where the method includes:
receiving an abnormal log sent by at least one application server;
classifying each abnormal log at least twice according to at least two classification modes to obtain classified abnormal logs, wherein each type of abnormal logs in the classified abnormal logs is in a convergence state under the condition of the same abnormal factors;
and classifying and storing the classified abnormal logs.
In one possible design, each exception log is classified at least twice according to at least two classification modes, including:
determining the priority corresponding to each preset classification mode in multiple classification modes;
selecting at least two classification modes with different priorities from the preset multiple classification modes;
and classifying each abnormal log according to the sequence of the priority from high to low in the at least two classification modes.
In one possible design, the preset multiple classification modes are classification according to stack information context of the abnormal log, classification according to an abnormal function type corresponding to the abnormal log, classification according to an abnormal character string template corresponding to the abnormal log, or classification according to abnormal information content of the abnormal log.
In one possible design, after obtaining the classified anomaly log, the method further comprises:
and performing data statistics on each type of abnormal logs in the classified abnormal logs according to a preset sample dimension to obtain a data sample corresponding to each type of abnormal logs in the classified abnormal logs, wherein the preset sample dimension comprises one of abnormal generation times and influence user number, the abnormal generation times are the times of generating each type of abnormal logs in the classified abnormal logs within a preset time period, and the influence user number is the number of users influenced when each type of abnormal logs in the classified abnormal logs are generated.
In one possible design, the method further includes:
determining whether the classified abnormal logs have abnormal log classification meeting an abnormal early warning triggering condition;
and if the classified abnormal logs have abnormal log classifications meeting the abnormal early warning triggering conditions, sending abnormal early warning information corresponding to the abnormal log classifications meeting the abnormal early warning triggering conditions.
In one possible design, determining whether there is an exception log classification that satisfies an exception warning trigger condition includes:
if the first-class abnormal logs in the classified abnormal logs are determined to be generated for the first time, determining that the first-class abnormal logs are classified as abnormal logs meeting an abnormal early warning triggering condition, wherein the first-class abnormal logs are any one of the classified abnormal logs; alternatively, the first and second electrodes may be,
if the second-class abnormal logs in the classified abnormal logs are determined to be abnormal logs matched with preset keywords, determining that the second-class abnormal logs are abnormal log classifications meeting abnormal early warning triggering conditions, wherein the second-class abnormal logs are any one of the classified abnormal logs; alternatively, the first and second electrodes may be,
if the third type of abnormal logs in the classified abnormal logs are determined to be the abnormal logs corresponding to the sent abnormal early warning information, determining that the third type of abnormal logs are the abnormal log classification meeting the abnormal early warning triggering condition, wherein the third type of abnormal logs are any type of abnormal logs in the classified abnormal logs; alternatively, the first and second electrodes may be,
and if the sample number of the data samples corresponding to the fourth type of abnormal logs in the classified abnormal logs is determined to be larger than the preset number, determining that the fourth type of abnormal logs is the abnormal log classification meeting the abnormal early warning triggering condition, wherein the fourth type of abnormal logs is any type of abnormal logs in the classified abnormal logs.
In one possible design, the method further includes:
determining that a preset cleaning condition is met, wherein the preset cleaning condition is that a preset cleaning time is reached, or the residual cache space in an abnormal log database is smaller than a preset cache space, or the total number of at least one type of abnormal logs in the classified abnormal logs reaches a preset threshold value;
and cleaning the abnormal logs before the preset moment in the classified abnormal logs.
In a second aspect, an exception log processing apparatus is provided, the apparatus comprising:
the receiving module is used for receiving the abnormal log sent by at least one application server;
the classification module is used for performing classification processing on each abnormal log for at least two times according to at least two classification modes to obtain classified abnormal logs, and each type of abnormal logs in the classified abnormal logs is in a convergence state under the condition of the same abnormal factors;
and the storage module is used for classifying and storing the classified abnormal logs.
In one possible design, the classification module is to:
determining the priority corresponding to each preset classification mode in multiple classification modes;
selecting at least two classification modes with different priorities from the preset multiple classification modes;
and classifying each abnormal log according to the sequence of the priority from high to low in the at least two classification modes.
In one possible design, the preset multiple classification modes are classification according to stack information context of the abnormal log, classification according to an abnormal function type corresponding to the abnormal log, classification according to an abnormal character string template corresponding to the abnormal log, or classification according to abnormal information content of the abnormal log.
In one possible design, the apparatus further includes a statistics module to:
and performing data statistics on each type of abnormal logs in the classified abnormal logs according to a preset sample dimension to obtain a data sample corresponding to each type of abnormal logs in the classified abnormal logs, wherein the preset sample dimension comprises one of abnormal generation times and influence user number, the abnormal generation times are the times of generating each type of abnormal logs in the classified abnormal logs within a preset time period, and the influence user number is the number of users influenced when each type of abnormal logs in the classified abnormal logs are generated.
In one possible design, the apparatus further includes an early warning module to:
determining whether the classified abnormal logs have abnormal log classification meeting an abnormal early warning triggering condition;
and if the classified abnormal logs have abnormal log classifications meeting the abnormal early warning triggering conditions, sending abnormal early warning information corresponding to the abnormal log classifications meeting the abnormal early warning triggering conditions.
In one possible design, the early warning module is further configured to:
if the first-class abnormal logs in the classified abnormal logs are determined to be generated for the first time, determining that the first-class abnormal logs are classified as abnormal logs meeting an abnormal early warning triggering condition, wherein the first-class abnormal logs are any one of the classified abnormal logs; alternatively, the first and second electrodes may be,
if the second-class abnormal logs in the classified abnormal logs are determined to be abnormal logs matched with preset keywords, determining that the second-class abnormal logs are abnormal log classifications meeting abnormal early warning triggering conditions, wherein the second-class abnormal logs are any one of the classified abnormal logs; alternatively, the first and second electrodes may be,
if the third type of abnormal logs in the classified abnormal logs are determined to be the abnormal logs corresponding to the sent abnormal early warning information, determining that the third type of abnormal logs are the abnormal log classification meeting the abnormal early warning triggering condition, wherein the third type of abnormal logs are any type of abnormal logs in the classified abnormal logs; alternatively, the first and second electrodes may be,
and if the sample number of the data samples corresponding to the fourth type of abnormal logs in the classified abnormal logs is determined to be larger than the preset number, determining that the fourth type of abnormal logs is the abnormal log classification meeting the abnormal early warning triggering condition, wherein the fourth type of abnormal logs is any type of abnormal logs in the classified abnormal logs.
In one possible design, the apparatus further includes a cleaning module to:
determining that a preset cleaning condition is met, wherein the preset cleaning condition is that a preset cleaning time is reached, or the residual cache space in an abnormal log database is smaller than a preset cache space, or the total number of at least one type of abnormal logs in the classified abnormal logs reaches a preset threshold value;
and cleaning the abnormal logs before the preset moment in the classified abnormal logs.
In a third aspect, a computing device is provided, the computing device comprising:
at least one processor, and
a memory communicatively coupled to the at least one processor;
wherein the memory stores instructions executable by the at least one processor, the at least one processor implementing the method as described in the first aspect and any possible embodiment by executing the instructions stored by the memory.
In a fourth aspect, a computer-readable storage medium is provided, which stores computer instructions that, when executed on a computer, cause the computer to perform the method as described in the first aspect and any possible embodiment.
In a fifth aspect, a computer program product containing instructions is provided, which when run on a computer causes the computer to perform the method for exception log handling described in the various possible implementations described above.
In the embodiment of the application, after the abnormal logs sent by the application server are received, each abnormal log can be classified at least twice through at least two classification modes, so that the abnormal log classification with fine granularity is obtained, and then the classified abnormal logs can be classified. Therefore, when the system is abnormal and developers need to locate and maintain abnormal problems by checking corresponding abnormal logs, the abnormal logs needing to be checked at present can be determined from the classified and stored abnormal logs for checking, and compared with a checking mode that developers need to check a large number of mixed log locating abnormal problems in the related art, the method in the embodiment of the application can effectively reduce the number of logs checked by the developers, shorten the period for obtaining abnormal information, and improve the efficiency for obtaining the abnormal information.
It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.
Drawings
In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings needed to be used in the description of the embodiments are briefly introduced below, it is obvious that the drawings in the following description are only some embodiments of the present application, and for those skilled in the art, other drawings can be obtained according to the provided drawings without creative efforts.
Fig. 1 is a schematic diagram of an application scenario provided in an embodiment of the present application;
fig. 2 is a schematic flowchart of an exception log processing method according to an embodiment of the present application;
fig. 3a is a block diagram of an exception log processing apparatus according to an embodiment of the present disclosure;
fig. 3b is another block diagram of an exception log processing apparatus according to an embodiment of the present disclosure;
fig. 4 is a schematic structural diagram of a computing device according to an embodiment of the present application.
Detailed Description
In order to make the objects, technical solutions and advantages of the present application more apparent, the technical solutions in the embodiments of the present application will be described clearly and completely with reference to the accompanying drawings in the embodiments of the present application, and it is obvious that the described embodiments are only a part of the embodiments of the present application, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application. In the present application, the embodiments and features of the embodiments may be arbitrarily combined with each other without conflict. Also, while a logical order is shown in the flow diagrams, in some cases, the steps shown or described may be performed in an order different than here.
The terms "first" and "second" in the description and claims of the present application and the above-described drawings are used for distinguishing between different objects and not for describing a particular order. Furthermore, the term "comprises" and any variations thereof, which are intended to cover non-exclusive protection. For example, a process, method, system, article, or apparatus that comprises a list of steps or elements is not limited to only those steps or elements listed, but may alternatively include other steps or elements not listed, or inherent to such process, method, article, or apparatus. The "plurality" in the present application may mean at least two, for example, two, three or more, and the embodiments of the present application are not limited.
In addition, the term "and/or" herein is only one kind of association relationship describing an associated object, and means that there may be three kinds of relationships, for example, a and/or B, which may mean: a exists alone, A and B exist simultaneously, and B exists alone. In addition, the character "/" in this document generally indicates that the preceding and following related objects are in an "or" relationship unless otherwise specified.
In order to facilitate understanding of the technical solutions provided in the embodiments of the present application, some brief descriptions are provided below for application scenarios used in the technical solutions provided in the embodiments of the present application, and it should be noted that the application scenarios described below are only used for illustrating the embodiments of the present invention and are not limited. In specific implementation, the technical scheme provided by the embodiment of the application can be flexibly applied according to actual needs.
Please refer to fig. 1, where fig. 1 is an application scenario to which the technical solution of the embodiment of the present application can be applied. In the application scenario, at least one application server and one exception management center server are included, and fig. 1 illustrates that at least one application server is 3, and the at least one application server is an application server 1, an application server 2, and an application server 3.
The application server may be understood as a server that generates an exception log when the system is abnormal during the use of the user, and the exception management center server may be understood as a server that collects and processes the exception log generated by the application server. It should be noted that the application server may also generate a normal log, and similarly, the abnormal management center server may also collect and process the normal log.
When a user operates a system, for example, the user operates on an interface, if a function on the interface is abnormal, the application servers generate abnormal logs corresponding to the function abnormality, then the abnormal management center server can collect the abnormal logs generated by the application servers, and perform corresponding classification processing on the abnormal logs, when developers need to locate abnormal problems by looking up the abnormal logs, the abnormal logs needing to be looked up can be determined, corresponding abnormal information can be obtained in time by looking up the abnormal logs, and the corresponding abnormal problems are processed.
To further illustrate the technical solutions provided by the embodiments of the present application, the following detailed description is made with reference to the accompanying drawings and the detailed description. Although the embodiments of the present application provide the method operation steps as shown in the following embodiments or figures, more or less operation steps may be included in the method based on the conventional or non-inventive labor. In steps where no necessary causal relationship exists logically, the order of execution of the steps is not limited to that provided by the embodiments of the present application. The method can be executed in sequence or in parallel according to the method shown in the embodiment or the figure when the method is executed in an actual processing procedure or a device.
Referring to fig. 2, fig. 2 is a flowchart of an exception log processing method according to an embodiment of the present disclosure. The method is described below by taking an application scenario as shown in fig. 1 as an example, and the method can be executed by the aforementioned exception management center server in fig. 1. The flow diagram is described as follows:
step 201: and receiving an abnormal log sent by at least one application server.
In a possible implementation manner, after the exception log is generated by each application server, the corresponding exception log may be saved, and the exception log may be automatically reported to the exception management center server while being saved. In a specific implementation process, each application server may send an exception log to the exception management center server in a Domain Name System (DNS) forwarding manner. The method comprises the steps that a message queue address for receiving an abnormal log can be configured in advance, the message queue address can be understood as a transfer station or an intermediate application server, each application server can report the abnormal log to the message queue address actively after generating the abnormal log, and the abnormal management center server acquires the abnormal log from the message queue address and then carries out classification processing. It should be noted that each application server may also send the exception log to the exception management center server in other ways, which is not limited in the embodiment of the present application.
In the embodiment of the application, the abnormal logs can be actively sent to the abnormal management center server through each application server, and compared with a collection mode that logs need to be collected periodically in the related art, or when developers need to check the logs, the management center server collects the abnormal logs from each application server, and a mode that each application server actively reports the abnormal logs when the abnormal logs are generated can be ensured to a certain extent.
Step 202: and performing classification processing on each abnormal log at least twice according to at least two classification modes to obtain classified abnormal logs, wherein each type of abnormal logs in the classified abnormal logs is in a convergence state under the condition of the same abnormal factors.
The exception factor is a factor causing an exception problem, and each exception problem may be caused by any one of a plurality of exception factors, for example, when a saving function of the system fails, an exception may occur in a certain part of a program in an operation interface of the system, or an exception may occur in a certain script in a database, and then each part of the program, or each script, at this time may be understood as an exception factor.
Each type of abnormal log in the classified abnormal logs is in a convergence state under the condition of the same abnormal factor, namely, each type of abnormal log corresponds to one abnormal factor causing a certain abnormal problem, so that when a developer views the abnormal log, the developer can view the abnormal log causing the abnormality in a targeted manner, for example, when the storage function of the current system is abnormal, the abnormality is caused by the abnormal exit of the script update data.
In a possible embodiment, the exception management center server may load the exception configuration information from the configuration center and place the exception configuration information into the cache, for example, may place the exception configuration information into a redis cache, and the type of the cache is not limited herein. The abnormal configuration information may be understood as a classification mechanism for classifying the abnormal log, and after the abnormal configuration information is obtained, it indicates that the corresponding classification processing rule is determined, and then the abnormal log may be classified through the classification processing rule.
In a possible implementation manner, some classification manners may be preset in the abnormality management center server, and during the classification processing, at least two classification manners may be selected from the preset multiple classification manners to perform classification processing on the abnormality logs, and then each abnormality log may be classified according to the order of the priority from high to low in the selected classification manners. In a specific implementation process, the priority corresponding to the classification mode may be obtained from a configuration center, that is, the priority of each classification mode may be set in the configuration center, and after the abnormal management center server obtains the abnormal configuration information from the configuration center, the priority corresponding to each classification mode may be determined, or the priority corresponding to each classification mode may be preset when the abnormal management center server sets the classification mode, which is not limited in the embodiment of the present application.
The preset multiple classification manners may be, for example, classification according to the stack information context of the abnormal logs, that is, classification of the abnormal logs having the same stack information context into one class, or classification according to the abnormal function type corresponding to the abnormal logs, that is, classification of the abnormal logs belonging to the same abnormal function type into one class, where the abnormal function type may be, for example, a service abnormality, a database abnormality, an input/output abnormality, and the like, and the embodiment of the present application does not limit the type of the abnormal function.
Or the abnormal logs can be classified according to the abnormal character string templates corresponding to the abnormal logs, that is, the abnormal logs belonging to the same abnormal character string template are classified into one class, generally, the sub-services corresponding to each function have different templates, for example, the sub-services corresponding to each function can include sub-services such as contract, security, claim settlement and the like in the service function, each sub-service has different abnormal character string templates, and then the classification can be performed according to different abnormal character type templates. Or the abnormal information content of the abnormal logs can be classified, some keywords can be preset, and then the abnormal logs matched with the same keywords in the abnormal information content are classified into one type. In a specific implementation process, the abnormal logs may be classified in other manners, and the classification manner of the abnormal logs is not limited in the embodiment of the present application.
For example, two classification manners are selected from the preset classification manners, that is, the preset classification manners are classified according to the stack information context and classified according to the abnormal function types corresponding to the abnormal logs, the priority of the classification according to the stack information is higher, and the priority of the classification according to the abnormal function types is lower, so that when the classification processing is performed, the abnormal logs can be firstly classified according to the stack information context to obtain the abnormal logs after the first classification, and then the abnormal logs after the first classification are secondly classified according to the abnormal function types to obtain the abnormal logs after the second classification. For example, after the stack information is classified, the exception logs are divided into A, B, C three types, then A, B, C types of exception logs are secondarily classified according to exception function types, for example, a type exception log is divided into a1 type and a2 type, a type B log is divided into B1 type, B2 type and B3 type, a type C log is divided into C1 type, C2 type, C3 type and C4 type, and each exception log is classified twice to obtain a final classification result.
In a possible implementation manner, after the abnormality log is classified and the classified abnormality log is obtained, data statistics may be performed on the classified abnormality log. For example, data statistics may be performed on each type of abnormal log according to a preset sample dimension, where the preset sample dimension may be the number of times of abnormal occurrence or may affect the number of users, the number of times of abnormal occurrence may be understood as the number of times of generating each type of abnormal log within a preset time period, and the preset time period may be a time period set according to actual needs, for example, three days or one week. For example, if the preset time period is three days, the number of times of generation of each type of abnormal log may be counted every three days. The number of affected users can be understood as the number of users affected when each type of exception log is generated, for example, if the currently generated exception log is of type a, then it is counted how many users are affected when the type a exception log is generated. It should be noted that, in a specific implementation process, data statistics may also be performed on each type of exception log through some other sample dimensions, which is not limited herein.
In the embodiment of the application, after data statistics is carried out on each type of abnormal logs according to the preset sample dimension, which type of abnormal logs is generated with higher frequency can be determined, and then when the system is abnormal, developers can give priority to abnormal problems which may be high in occurrence frequency, so that the time for determining the abnormal problems is saved. And the number of the users influencing the abnormal problems can be determined to be the largest, so that when the system has multiple abnormal problems, developers can preferentially process the abnormal problems influencing the users with larger number, and the timeliness of solving the abnormal problems can be improved and the user experience is promoted.
Step 203: and classifying and storing the classified abnormal logs.
After the classified abnormal logs are obtained, the classified abnormal logs can be classified and stored, when developers need to check the abnormal logs, the corresponding logs can be checked directly, and the logs are checked according to the same type of abnormal logs in a convergence state under the condition of abnormal factors, so that the logs can be checked in a targeted manner, the developers can obtain the abnormal information quickly, and the abnormal problems can be located and solved timely.
In a possible implementation manner, whether an abnormal log classification meeting an abnormal early warning triggering condition exists in the classified abnormal logs can be determined, and when the abnormal log classification meeting the abnormal early warning triggering condition exists, abnormal early warning information corresponding to the abnormal log classification can be sent. When sending the abnormal early warning information, the information may be sent to the relevant early warning personnel through communication modes such as mail, WeChat, and short message, or voice early warning reminding may be performed through voice broadcasting, or early warning reminding may be performed through flashing of a flashing light, and the embodiment of the application is not limited to the mode of sending the abnormal early warning information.
In a specific implementation process, if the abnormal early warning information is sent to related early warning personnel through a certain communication mode, an association relationship between the abnormal early warning type and the early warning personnel can be set in advance, for example, in a current system medical insurance major illness handling system, the abnormal type can be divided into interface type abnormality and database type abnormality, then the early warning personnel A and the interface type abnormality are set to be an association relationship, the early warning personnel B and the database abnormality are set to be an association relationship, when an abnormal log meeting an early warning triggering condition is found, whether the daily log corresponds to the interface type abnormality or the database type abnormality is determined, and then the daily log is sent to the corresponding early warning personnel according to the association relationship. Thus, the efficiency of processing the abnormal problem can be further improved.
The abnormal early warning triggering condition is a condition for triggering the abnormal management center server to early warn abnormal problems corresponding to a certain type of abnormal logs, so that when the certain type of abnormal logs meet the abnormal early warning triggering condition, the abnormal logs are indicated to be early warned. In the embodiment of the present application, it may be determined that there is an abnormality log that satisfies an abnormality warning trigger condition, for example, in the following four ways.
First mode of determination
The exception early warning triggering condition may be, for example, that there is an exception log generated for the first time, that is, when some kind of exception log is generated for the first time, the exception log is early warned. After the abnormality management center server performs classification processing on the received abnormality logs, if a certain kind of abnormality logs are generated for the first time, the kind of abnormality logs are determined to be the abnormality logs meeting the abnormality early warning triggering condition, for example, the abnormality logs are convenient to distinguish, and for example, the kind of abnormality logs are referred to as first kind of abnormality logs. It should be noted that the first-type exception log may be any one of the classified exception logs. Since the developer may need to preferentially locate such an abnormal problem when a certain abnormality is first generated, this may enable the developer to locate the abnormal problem in time to ensure the stability of the system.
Second mode of determination
The abnormal early warning triggering condition may be that an abnormal log corresponding to the abnormal content matching the preset keyword exists, that is, when the abnormal information of a certain type of abnormal log includes the information content matching the preset keyword, the abnormal log is early warned, for example, the abnormal log may be called a second type of abnormal log, and it should be noted that the second type of abnormal log may also be any type of abnormal log in the classified abnormal logs. That is to say, some keywords may be preset, for example, some specific words included in the severity-level abnormal log, and if the preset keywords exist in the second-type abnormal log, it is indicated that the abnormal problem corresponding to the abnormal log needs to be processed in time, so that the abnormal log that needs to be processed in time can be pre-warned by setting the keywords.
Third mode of determination
The abnormal early warning triggering condition may be, for example, when an abnormal log corresponding to the sent abnormal early warning information is generated again, that is, after the developer has solved the corresponding abnormal problem according to the abnormal early warning, when the abnormal problem occurs again, the developer performs the corresponding early warning, and for example, the abnormal log may be referred to as a third-type abnormal log. The third-type abnormality log may be any one of the classified abnormality logs. That is, when a problem of an abnormality is solved, a second abnormality may repeatedly occur, and the warning may be performed again. When the same abnormal factor causes system abnormality for many times, the system problem corresponding to the abnormal factor is possibly shown to have larger hidden danger, and the mode of early warning again can be beneficial to developers to improve the system in time.
Fourth mode of determination
The abnormality early warning triggering condition may be, for example, that the number of samples of data samples of a certain type of abnormality log is greater than a preset number, for example, the type of abnormality log may be referred to as a fourth type of abnormality log, and it should be noted that the third type of abnormality log may also be any type of abnormality log in the classified abnormality logs. When the frequency of the abnormal logs in a preset time period exceeds the preset frequency, the abnormal logs can be indicated to be high in generation frequency in a certain period, and then the abnormal logs need to be pre-warned, or when the abnormal problems corresponding to the abnormal logs occur and the number of affected users is larger than the preset number, the abnormal problems corresponding to the abnormal logs can affect the normal use of most of the users, and then the abnormal logs need to be pre-warned, so that developers can timely deal with the corresponding abnormal problems.
In a possible implementation manner, when there is an abnormal log classification satisfying an abnormal early warning condition, the time for sending the abnormal early warning information last time can be further determined, then the early warning time interval between the current time and the early warning time for sending the early warning last time is determined, if the early warning time interval exceeds a preset early warning time interval, the abnormal early warning information of this time is directly sent, if the early warning time interval does not exceed the preset early warning time interval, whether the abnormal early warning information of this time has already been sent can be further determined, if the abnormal early warning information of this time has not already been sent, the abnormal early warning information of this time is sent, and if the abnormal early warning information of this time has already been sent, the abnormal early warning information is. Therefore, the abnormal early warning information can be prevented from being sent for many times after a certain type of abnormal logs meet the abnormal early warning condition, and the accuracy of the abnormal early warning is ensured.
In a possible implementation manner, when the preset cleaning condition is determined to be met, the abnormal logs stored in a classified mode can be cleaned. The preset cleaning condition is a condition for triggering the abnormal management center server to clean the stored abnormal log, so that when the preset cleaning condition is met, the abnormal log needs to be cleaned. The preset cleaning condition may be, for example, that a preset cleaning time is reached, or that the remaining cache controls in the exception log database are smaller than a preset cache space, or that the total number of at least one type of exception logs in the exception logs stored in a classified manner reaches a preset threshold.
That is, the cleaning time may be set in advance, for example, it may be set that log cleaning is performed every three days, and then after 72 hours after log cleaning, the abnormal logs stored in the classified manner are cleaned again; or a preset cache space of a database for storing the abnormal logs can be set, and when the remaining cache space of the database is smaller than the preset cache space, the database indicates that the abnormal logs can not be cached normally, and then the cached abnormal logs are cleaned; or the maximum number of each type of exception logs that can be cached may also be set, for example, the maximum number is referred to as a preset threshold, and then when the total number of at least one type of exception logs in the exception logs stored in a classified manner reaches the preset threshold, the exception logs that have been stored are cleaned. It should be noted that, the setting of the preset cleaning time, the preset buffer space, and the preset threshold may be determined according to an actual situation, and the embodiment of the present application is not limited.
In a specific cleaning process, the old log stored may be cleaned, a time may be preset, for example, the time may be called a preset time, and when a preset cleaning condition is met, the abnormal log stored before the preset time may be cleaned. The preset time may be set to a time twenty four hours before log cleaning is performed, or if periodic timing cleaning is set, the preset time may also be set to a time when 1/3 cycles are reached in each cycle, and the like. Therefore, the abnormal log database stored in a classified manner can be cleaned, and the abnormal logs reported by the application servers can be classified and stored in time.
In the embodiment of the application, after the abnormal logs sent by the application server are received, each abnormal log can be classified at least twice through at least two classification modes, so that more precise abnormal log classification can be obtained, and then the classified abnormal logs can be classified. When the system is abnormal, developers need to check corresponding abnormal logs to position and maintain abnormal problems, the abnormal logs needing to be checked at present can be determined according to the classification of the abnormal logs, and compared with a mode that the abnormal logs needing to be checked in a large number of mixed logs in the related art, the method in the embodiment of the application can reduce the number of the logs checked by the developers, reduce the period for acquiring abnormal information, and further improve the efficiency for acquiring the abnormal information.
Based on the same inventive concept, the embodiment of the present application provides an exception log processing apparatus, which can implement a function corresponding to the foregoing exception log processing method. The exception log handling means may be a hardware structure, a software module, or a hardware structure plus a software module. The exception log processing device can be realized by a chip system, and the chip system can be formed by a chip and can also comprise the chip and other discrete devices. Referring to fig. 3a, the exception log processing apparatus includes a receiving module 301, a classifying module 302, and a saving module 303. Wherein:
a receiving module 301, configured to receive an exception log sent by at least one application server;
the classification module 302 is configured to perform classification processing on each abnormal log at least twice according to at least two classification manners to obtain classified abnormal logs, where each type of abnormal log in the classified abnormal logs is in a convergence state under the condition of the same abnormal factor;
a saving module 303, configured to classify and save the classified abnormal log.
In one possible implementation, the classification module 302 is configured to:
determining the priority corresponding to each preset classification mode in multiple classification modes;
selecting at least two classification modes with different priorities from a plurality of preset classification modes;
and classifying each abnormal log according to the sequence of the priority from high to low in at least two classification modes.
In a possible implementation manner, the preset multiple classification manners are classification according to the stack information context of the abnormal log, classification according to the abnormal function type corresponding to the abnormal log, classification according to the abnormal character string template corresponding to the abnormal log, or classification according to the abnormal information content of the abnormal log.
Referring to fig. 3b, the exception log processing apparatus in the embodiment of the present application further includes a statistics module 304, configured to:
and performing data statistics on each type of abnormal logs in the classified abnormal logs according to a preset sample dimension to obtain a data sample corresponding to each type of abnormal logs in the classified abnormal logs, wherein the preset sample dimension comprises one of abnormal generation times and user influence number, the abnormal generation times are the times of generating each type of abnormal logs in the classified abnormal logs in a preset time period, and the user influence number is the number of users influenced when each type of abnormal logs in the classified abnormal logs are generated.
Referring to fig. 3b, the exception log processing apparatus in the embodiment of the present application further includes an early warning module 305, configured to:
determining whether abnormal log classifications meeting abnormal early warning triggering conditions exist in the classified abnormal logs;
and if the classified abnormal logs have abnormal log classifications meeting the abnormal early warning triggering conditions, sending abnormal early warning information corresponding to the abnormal log classifications meeting the abnormal early warning triggering conditions.
In one possible embodiment, the early warning module 305 is further configured to:
if the first-class abnormal logs in the classified abnormal logs are determined to be generated for the first time, determining the first-class abnormal logs as the abnormal log classifications meeting the abnormal early warning triggering conditions, wherein the first-class abnormal logs are any one of the classified abnormal logs; alternatively, the first and second electrodes may be,
if the second-class abnormal logs in the classified abnormal logs are determined to be abnormal logs matched with the preset keywords, determining the second-class abnormal logs to be abnormal log classifications meeting the abnormal early warning triggering conditions, wherein the second-class abnormal logs are any one of the classified abnormal logs; alternatively, the first and second electrodes may be,
if the third-class abnormal logs in the classified abnormal logs are determined to be the abnormal logs corresponding to the sent abnormal early warning information, determining the third-class abnormal logs to be the abnormal log classification meeting the abnormal early warning triggering condition, wherein the third-class abnormal logs are any one of the classified abnormal logs; alternatively, the first and second electrodes may be,
and if the sample number of the data samples corresponding to the fourth-class abnormal logs in the classified abnormal logs is larger than the preset number, determining that the fourth-class abnormal logs are classified abnormal logs meeting the abnormal early warning triggering condition, and determining that the fourth-class abnormal logs are any one of the classified abnormal logs.
Referring to fig. 3b, the exception log processing apparatus in the embodiment of the present application further includes a cleaning module 306, configured to:
determining that a preset cleaning condition is met, wherein the preset cleaning condition is that a preset cleaning time is reached, or the residual cache space in the abnormal log database is smaller than a preset cache space, or the total number of at least one type of abnormal logs in the classified abnormal logs reaches a preset threshold value;
and cleaning the abnormal logs before the preset moment in the classified abnormal logs.
All relevant contents of each step related to the foregoing embodiment of the exception log processing method may be cited to the functional description of the functional module corresponding to the exception log processing apparatus in the embodiment of the present application, and are not described herein again.
The division of the modules in the embodiments of the present application is schematic, and only one logical function division is provided, and in actual implementation, there may be another division manner, and in addition, each functional module in each embodiment of the present application may be integrated in one processor, may also exist alone physically, or may also be integrated in one module by two or more modules. The integrated module can be realized in a hardware mode, and can also be realized in a software functional module mode.
Based on the same inventive concept, the embodiment of the application provides a computing device. Referring to fig. 4, the computing device includes at least one processor 401 and a memory 402 connected to the at least one processor, a specific connection medium between the processor 401 and the memory 402 is not limited in this embodiment, in fig. 4, the processor 401 and the memory 402 are connected by a bus 400 as an example, the bus 400 is represented by a thick line in fig. 4, and a connection manner between other components is only schematically illustrated and is not limited. The bus 400 may be divided into an address bus, a data bus, a control bus, etc., and is shown with only one thick line in fig. 4 for ease of illustration, but does not represent only one bus or type of bus.
The computing device in the embodiment of the present application may further include a communication interface 403, where the communication interface 403 is, for example, a network port, and the computing device may receive data or transmit data through the communication interface 403.
In the embodiment of the present application, the memory 402 stores instructions executable by the at least one processor 401, and the at least one processor 401 may execute the steps included in the foregoing exception log processing method by executing the instructions stored in the memory 402.
The processor 401 is a control center of the computing device, and may connect various parts of the entire device by using various interfaces and lines, and perform various functions and process data of the computing device by operating or executing instructions stored in the memory 402 and calling data stored in the memory 402, thereby performing overall monitoring of the computing device. Optionally, the processor 401 may include one or more processing units, and the processor 401 may integrate an application processor and a modem processor, wherein the application processor mainly handles operating systems, application programs, and the like, and the modem processor mainly handles wireless communication. It will be appreciated that the modem processor described above may not be integrated into the processor 401. In some embodiments, processor 401 and memory 402 may be implemented on the same chip, or in some embodiments, they may be implemented separately on separate chips.
The processor 401 may be a general-purpose processor, such as a Central Processing Unit (CPU), digital signal processor, application specific integrated circuit, field programmable gate array or other programmable logic device, discrete gate or transistor logic, discrete hardware components, or the like, that may implement or perform the methods, steps, and logic blocks disclosed in embodiments of the present application. A general purpose processor may be a microprocessor or any conventional processor or the like. The steps of the method for processing the exception log disclosed in the embodiments of the present application may be directly implemented by a hardware processor, or implemented by a combination of hardware and software modules in the processor.
By programming the processor 401, the code corresponding to the exception log processing method described in the foregoing embodiment may be solidified in the chip, so that the chip can execute the steps of the exception log processing method when running, and how to program the processor 401 is a technique known by those skilled in the art, which is not described herein again.
Based on the same inventive concept, the present application further provides a storage medium storing computer instructions, which, when executed on a computer, cause the computer to perform the steps of the foregoing exception log processing method.
In some possible embodiments, the aspects of the exception log processing method provided in this application may also be implemented in the form of a program product, which includes program code for causing a computing device to perform the steps in the exception log processing method according to various exemplary embodiments of this application described above in this specification, when the program product is run on the computing device.
As will be appreciated by one skilled in the art, embodiments of the present application may be provided as a method, system, or computer program product. Accordingly, the present application may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present application may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
The present application is described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to the application. It will be understood that each flow and/or block of the flow diagrams and/or block diagrams, and combinations of flows and/or blocks in the flow diagrams and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be stored in a computer-readable memory that can direct a computer or other programmable data processing apparatus to function in a particular manner, such that the instructions stored in the computer-readable memory produce an article of manufacture including instruction means which implement the function specified in the flowchart flow or flows and/or block diagram block or blocks.
These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer implemented process such that the instructions which execute on the computer or other programmable apparatus provide steps for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.
It will be apparent to those skilled in the art that various changes and modifications may be made in the present application without departing from the spirit and scope of the application. Thus, if such modifications and variations of the present application fall within the scope of the claims of the present application and their equivalents, the present application is intended to include such modifications and variations as well.
Claims (10)
1. An exception log handling method, the method comprising:
receiving an abnormal log sent by at least one application server;
classifying each abnormal log at least twice according to at least two classification modes to obtain classified abnormal logs, wherein each type of abnormal logs in the classified abnormal logs is in a convergence state under the condition of the same abnormal factors;
and classifying and storing the classified abnormal logs.
2. The method of claim 1, wherein classifying each anomaly log at least twice in at least two classifications comprises:
determining the priority corresponding to each preset classification mode in multiple classification modes;
selecting at least two classification modes with different priorities from the preset multiple classification modes;
and classifying each abnormal log according to the sequence of the priority from high to low in the at least two classification modes.
3. The method according to claim 2, wherein the predetermined plurality of classification manners are classification according to a stack information context of the abnormal log, classification according to an abnormal function type corresponding to the abnormal log, classification according to an abnormal character string template corresponding to the abnormal log, or classification according to an abnormal information content of the abnormal log.
4. The method of any of claims 1-3, wherein after obtaining the classified anomaly log, the method further comprises:
and performing data statistics on each type of abnormal logs in the classified abnormal logs according to a preset sample dimension to obtain a data sample corresponding to each type of abnormal logs in the classified abnormal logs, wherein the preset sample dimension comprises one of abnormal generation times and influence user number, the abnormal generation times are the times of generating each type of abnormal logs in the classified abnormal logs within a preset time period, and the influence user number is the number of users influenced when each type of abnormal logs in the classified abnormal logs are generated.
5. The method of claim 1, wherein the method further comprises:
determining whether the classified abnormal logs have abnormal log classification meeting an abnormal early warning triggering condition;
and if the classified abnormal logs have abnormal log classifications meeting the abnormal early warning triggering conditions, sending abnormal early warning information corresponding to the abnormal log classifications meeting the abnormal early warning triggering conditions.
6. The method of claim 5, wherein determining whether there is an exception log classification that satisfies an exception warning triggering condition comprises:
if the first-class abnormal logs in the classified abnormal logs are determined to be generated for the first time, determining that the first-class abnormal logs are classified as abnormal logs meeting an abnormal early warning triggering condition, wherein the first-class abnormal logs are any one of the classified abnormal logs; alternatively, the first and second electrodes may be,
if the second-class abnormal logs in the classified abnormal logs are determined to be abnormal logs matched with preset keywords, determining that the second-class abnormal logs are abnormal log classifications meeting abnormal early warning triggering conditions, wherein the second-class abnormal logs are any one of the classified abnormal logs; alternatively, the first and second electrodes may be,
if the third type of abnormal logs in the classified abnormal logs are determined to be the abnormal logs corresponding to the sent abnormal early warning information, determining that the third type of abnormal logs are the abnormal log classification meeting the abnormal early warning triggering condition, wherein the third type of abnormal logs are any type of abnormal logs in the classified abnormal logs; alternatively, the first and second electrodes may be,
and if the sample number of the data samples corresponding to the fourth type of abnormal logs in the classified abnormal logs is determined to be larger than the preset number, determining that the fourth type of abnormal logs is the abnormal log classification meeting the abnormal early warning triggering condition, wherein the fourth type of abnormal logs is any type of abnormal logs in the classified abnormal logs.
7. The method of claim 1, wherein the method further comprises:
determining that a preset cleaning condition is met, wherein the preset cleaning condition is that a preset cleaning time is reached, or the residual cache space in an abnormal log database is smaller than a preset cache space, or the total number of at least one type of abnormal logs in the classified abnormal logs reaches a preset threshold value;
and cleaning the abnormal logs before the preset moment in the classified abnormal logs.
8. An exception log handling apparatus, the apparatus comprising:
the receiving module is used for receiving the abnormal log sent by at least one application server;
the classification module is used for performing classification processing on each abnormal log for at least two times according to at least two classification modes to obtain classified abnormal logs, and each type of abnormal logs in the classified abnormal logs is in a convergence state under the condition of the same abnormal factors;
and the storage module is used for classifying and storing the classified abnormal logs.
9. A computing device, wherein the computing device comprises:
at least one processor, and
a memory communicatively coupled to the at least one processor;
wherein the memory stores instructions executable by the at least one processor, the at least one processor implementing the method of any one of claims 1-7 by executing the instructions stored by the memory.
10. A computer-readable storage medium having stored thereon computer instructions which, when executed on a computer, cause the computer to perform the method of any one of claims 1-7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010447139.6A CN111651595A (en) | 2020-05-25 | 2020-05-25 | Abnormal log processing method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202010447139.6A CN111651595A (en) | 2020-05-25 | 2020-05-25 | Abnormal log processing method and device |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN111651595A true CN111651595A (en) | 2020-09-11 |
Family
ID=72346767
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202010447139.6A Pending CN111651595A (en) | 2020-05-25 | 2020-05-25 | Abnormal log processing method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN111651595A (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN112416705A (en) * | 2020-11-11 | 2021-02-26 | 北京五八信息技术有限公司 | Abnormal information processing method and device |
| CN112463542A (en) * | 2020-12-15 | 2021-03-09 | 深圳供电局有限公司 | Log abnormity reason diagnosis method and device, computer equipment and storage medium |
| CN113849337A (en) * | 2021-11-30 | 2021-12-28 | 飞狐信息技术（天津）有限公司 | System exception handling method and device |
| CN114024839A (en) * | 2022-01-06 | 2022-02-08 | 深圳市明源云科技有限公司 | Server log message classification method, device, equipment and readable storage medium |
| CN114301768A (en) * | 2020-09-23 | 2022-04-08 | 中国移动通信集团广东有限公司 | Anomaly detection method and device for Network Function Virtualization (NFV) equipment |
Citations (18)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2012198796A (en) * | 2011-03-22 | 2012-10-18 | Nec Corp | Log collection system, device, method and program |
| CN105183912A (en) * | 2015-10-12 | 2015-12-23 | 北京百度网讯科技有限公司 | Abnormal log determination method and device |
| US9552249B1 (en) * | 2014-10-20 | 2017-01-24 | Veritas Technologies | Systems and methods for troubleshooting errors within computing tasks using models of log files |
| CN106844170A (en) * | 2015-12-04 | 2017-06-13 | 阿里巴巴集团控股有限公司 | A kind of troubleshooting, the influence face method and apparatus of analysis failure |
| WO2017110720A1 (en) * | 2015-12-25 | 2017-06-29 | 日本電気株式会社 | Log analysis system, log analysis method, and recording medium storing program |
| CN107193723A (en) * | 2017-05-17 | 2017-09-22 | 深圳怡化电脑股份有限公司 | Processing method, device, ATM and the storage medium of abnormal log |
| CN107291605A (en) * | 2017-07-11 | 2017-10-24 | 郑州云海信息技术有限公司 | The processing method and system of a kind of system journal |
| CN107622120A (en) * | 2017-09-22 | 2018-01-23 | 新华三技术有限公司 | System journal method for cleaning and device |
| CN109032909A (en) * | 2018-07-18 | 2018-12-18 | 携程旅游信息技术（上海）有限公司 | Processing method, system, equipment and the storage medium of application crash log |
| CN109271355A (en) * | 2018-08-27 | 2019-01-25 | 杭州迪普科技股份有限公司 | A kind of method and device of cleaning journal file caching |
| CN109299042A (en) * | 2018-11-12 | 2019-02-01 | 郑州云海信息技术有限公司 | A kind of log processing method and system |
| CN109309579A (en) * | 2018-01-30 | 2019-02-05 | 深圳壹账通智能科技有限公司 | Log recording processing method, device, computer equipment and storage medium |
| CN109739718A (en) * | 2018-11-30 | 2019-05-10 | 贵阳朗玛信息技术股份有限公司 | Log alarming method and device |
| CN110347547A (en) * | 2019-05-27 | 2019-10-18 | 中国平安人寿保险股份有限公司 | Log method for detecting abnormality, device, terminal and medium based on deep learning |
| CN110457174A (en) * | 2019-05-24 | 2019-11-15 | 深圳市金泰克半导体有限公司 | Blog management method, device, electronic equipment and storage medium |
| CN110825873A (en) * | 2019-10-11 | 2020-02-21 | 支付宝(杭州)信息技术有限公司 | Method and device for expanding log exception classification rule |
| CN110968487A (en) * | 2018-09-30 | 2020-04-07 | 北京国双科技有限公司 | Abnormal data analysis method and device |
| CN111177360A (en) * | 2019-12-16 | 2020-05-19 | 中国电子科技网络信息安全有限公司 | Self-adaptive filtering method and device based on user logs on cloud |
-
2020
- 2020-05-25 CN CN202010447139.6A patent/CN111651595A/en active Pending
Patent Citations (18)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| JP2012198796A (en) * | 2011-03-22 | 2012-10-18 | Nec Corp | Log collection system, device, method and program |
| US9552249B1 (en) * | 2014-10-20 | 2017-01-24 | Veritas Technologies | Systems and methods for troubleshooting errors within computing tasks using models of log files |
| CN105183912A (en) * | 2015-10-12 | 2015-12-23 | 北京百度网讯科技有限公司 | Abnormal log determination method and device |
| CN106844170A (en) * | 2015-12-04 | 2017-06-13 | 阿里巴巴集团控股有限公司 | A kind of troubleshooting, the influence face method and apparatus of analysis failure |
| WO2017110720A1 (en) * | 2015-12-25 | 2017-06-29 | 日本電気株式会社 | Log analysis system, log analysis method, and recording medium storing program |
| CN107193723A (en) * | 2017-05-17 | 2017-09-22 | 深圳怡化电脑股份有限公司 | Processing method, device, ATM and the storage medium of abnormal log |
| CN107291605A (en) * | 2017-07-11 | 2017-10-24 | 郑州云海信息技术有限公司 | The processing method and system of a kind of system journal |
| CN107622120A (en) * | 2017-09-22 | 2018-01-23 | 新华三技术有限公司 | System journal method for cleaning and device |
| CN109309579A (en) * | 2018-01-30 | 2019-02-05 | 深圳壹账通智能科技有限公司 | Log recording processing method, device, computer equipment and storage medium |
| CN109032909A (en) * | 2018-07-18 | 2018-12-18 | 携程旅游信息技术（上海）有限公司 | Processing method, system, equipment and the storage medium of application crash log |
| CN109271355A (en) * | 2018-08-27 | 2019-01-25 | 杭州迪普科技股份有限公司 | A kind of method and device of cleaning journal file caching |
| CN110968487A (en) * | 2018-09-30 | 2020-04-07 | 北京国双科技有限公司 | Abnormal data analysis method and device |
| CN109299042A (en) * | 2018-11-12 | 2019-02-01 | 郑州云海信息技术有限公司 | A kind of log processing method and system |
| CN109739718A (en) * | 2018-11-30 | 2019-05-10 | 贵阳朗玛信息技术股份有限公司 | Log alarming method and device |
| CN110457174A (en) * | 2019-05-24 | 2019-11-15 | 深圳市金泰克半导体有限公司 | Blog management method, device, electronic equipment and storage medium |
| CN110347547A (en) * | 2019-05-27 | 2019-10-18 | 中国平安人寿保险股份有限公司 | Log method for detecting abnormality, device, terminal and medium based on deep learning |
| CN110825873A (en) * | 2019-10-11 | 2020-02-21 | 支付宝(杭州)信息技术有限公司 | Method and device for expanding log exception classification rule |
| CN111177360A (en) * | 2019-12-16 | 2020-05-19 | 中国电子科技网络信息安全有限公司 | Self-adaptive filtering method and device based on user logs on cloud |
Cited By (7)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114301768A (en) * | 2020-09-23 | 2022-04-08 | 中国移动通信集团广东有限公司 | Anomaly detection method and device for Network Function Virtualization (NFV) equipment |
| CN112416705A (en) * | 2020-11-11 | 2021-02-26 | 北京五八信息技术有限公司 | Abnormal information processing method and device |
| CN112463542A (en) * | 2020-12-15 | 2021-03-09 | 深圳供电局有限公司 | Log abnormity reason diagnosis method and device, computer equipment and storage medium |
| CN112463542B (en) * | 2020-12-15 | 2023-06-02 | 深圳供电局有限公司 | Log abnormality cause diagnosis method, device, computer equipment and storage medium |
| CN113849337A (en) * | 2021-11-30 | 2021-12-28 | 飞狐信息技术（天津）有限公司 | System exception handling method and device |
| CN113849337B (en) * | 2021-11-30 | 2022-03-01 | 飞狐信息技术（天津）有限公司 | System exception handling method and device |
| CN114024839A (en) * | 2022-01-06 | 2022-02-08 | 深圳市明源云科技有限公司 | Server log message classification method, device, equipment and readable storage medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN111651595A (en) | Abnormal log processing method and device | |
| CN112311617A (en) | Configured data monitoring and alarming method and system | |
| CN111143163B (en) | Data monitoring method, device, computer equipment and storage medium | |
| CN103401698B (en) | For the monitoring system that server health is reported to the police in server set group operatione | |
| CN112183782B (en) | Fault work order processing method and equipment | |
| CN111768097B (en) | Task execution state monitoring method, device, system and storage medium | |
| CN109495291B (en) | Calling abnormity positioning method and device and server | |
| CN110955586A (en) | System fault prediction method, device and equipment based on log | |
| CN110912757B (en) | Service monitoring method and server | |
| CN111694677A (en) | Message queue management method, device, terminal and computer-readable storage medium | |
| CN112559285A (en) | Distributed service architecture-based micro-service monitoring method and related device | |
| CN110807050B (en) | Performance analysis method, device, computer equipment and storage medium | |
| CN111124791A (en) | System testing method and device | |
| CN110414591A (en) | A kind of data processing method and equipment | |
| CN108111328B (en) | Exception handling method and device | |
| CN111159009B (en) | Pressure testing method and device for log service system | |
| CN113259878B (en) | Call bill settlement method, system, electronic device and computer readable storage medium | |
| KR102464688B1 (en) | Method and apparatus for detrmining event level of monitoring result | |
| CN111885159B (en) | Data acquisition method and device, electronic equipment and storage medium | |
| CN114443302A (en) | Container cluster capacity expansion method, system, terminal and storage medium | |
| CN115729727A (en) | Fault repairing method, device, equipment and medium | |
| CN113010310A (en) | Job data processing method and device and server | |
| CN112491732A (en) | Storage network congestion management method, system, terminal and storage medium | |
| CN112612679A (en) | System running state monitoring method and device, computer equipment and storage medium | |
| CN111211938A (en) | Biological information software monitoring system and method |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |