CN112506748A - Abnormal log analysis method, device, equipment and storage medium - Google Patents
Abnormal log analysis method, device, equipment and storage medium Download PDFInfo
- Publication number
- CN112506748A CN112506748A CN202110150294.6A CN202110150294A CN112506748A CN 112506748 A CN112506748 A CN 112506748A CN 202110150294 A CN202110150294 A CN 202110150294A CN 112506748 A CN112506748 A CN 112506748A
- Authority
- CN
- China
- Prior art keywords
- matching
- log
- feature chain
- log text
- text
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Granted
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3065—Monitoring arrangements determined by the means or processing involved in reporting the monitored data
- G06F11/3072—Monitoring arrangements determined by the means or processing involved in reporting the monitored data where the reporting involves data filtering, e.g. pattern matching, time or event triggered, adaptive or policy-based reporting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/30—Information retrieval; Database structures therefor; File system structures therefor of unstructured textual data
- G06F16/33—Querying
Landscapes
- Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Physics & Mathematics (AREA)
- General Engineering & Computer Science (AREA)
- General Physics & Mathematics (AREA)
- Computational Linguistics (AREA)
- Data Mining & Analysis (AREA)
- Databases & Information Systems (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Quality & Reliability (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
Abstract
The application relates to an abnormal log analysis method, an abnormal log analysis device, abnormal log analysis equipment and a storage medium, wherein the method comprises the following steps: acquiring a log text; extracting problems from a problem set of an experience library one by one, and determining a problem feature chain corresponding to the problems one by one, wherein the problem set comprises at least one problem used for matching an abnormal log, and the problem feature chain at least comprises two orderly-arranged features; sequentially matching the features in the problem feature chain with the log text according to a preset sequence; when a first preset condition is met, stopping matching of the log text and the problem feature chain, and calculating the accumulated number of the features matched in the problem feature chain by the log text; and when the accumulated quantity meets a second preset condition, determining the problem corresponding to the problem feature chain as a target problem matched with the log text. The method and the device can solve the problem that the relevance of the matching result of the abnormal log and the specific problem is low in the prior art.
Description
Technical Field
The present application relates to the field of log analysis, and in particular, to a method, an apparatus, a device, and a storage medium for analyzing an abnormal log.
Background
In the use process of electronic equipment such as a mobile phone, a computer or a server, problems such as system errors or application program operation errors often occur, and when the error problems occur, an abnormal log is automatically generated. How to accurately and quickly determine the analysis result of the abnormal log and know the existing abnormal log and the analysis result thereof becomes important.
In the prior art, the abnormal log is usually matched with a single or multiple unordered abnormal keywords, and finally, the relevance between the matched result and a specific problem is low, and the reference value is also low.
Disclosure of Invention
The technical problem to be solved by the present application is to provide an abnormal log analysis method, apparatus, device and storage medium, which can solve the problems in the prior art that the correlation between the matching result of the abnormal log and the specific problem is low and the reference value is low.
In order to solve the above technical problem, in one aspect, the present application provides an abnormal log analysis method, where the method includes: acquiring a log text; extracting problems from a problem set of an experience library one by one, and determining a problem feature chain corresponding to the problems one by one, wherein the problem set comprises at least one problem used for matching an abnormal log, and the problem feature chain at least comprises two orderly-arranged features; sequentially matching the features in the problem feature chain with the log text according to a preset sequence; when a first preset condition is met, stopping matching of the log text and the problem feature chain, and calculating the accumulated number of the features matched in the problem feature chain by the log text; and when the accumulated quantity meets a second preset condition, determining the problem corresponding to the problem feature chain as a target problem matched with the log text.
Further, the method further comprises: adding a solution corresponding to each problem in an experience base in advance; determining a solution corresponding to the target problem as a target solution matching the log text.
Further, the sequentially matching the features in the problem feature chain with the log text according to a preset sequence includes: matching a first feature in the question feature chain with the journal text; and if the matching is successful, matching the next feature in the problem feature chain with the log text, and matching the features in the problem feature chain with the log text one by one through multiple iterations.
Further, the stopping the matching of the log text and the question feature chain when the first preset condition is met comprises: stopping matching of the log text with the problem feature chain when any feature in the problem feature chain cannot be successfully matched with the log text; or stopping matching the log text with the problem feature chain when the log text is matched with all the features in the problem feature chain.
Further, before the step of determining the question corresponding to the question feature chain as the target question matching the log text, the method further comprises: determining the ratio of the accumulated number to the total number of the features in the problem feature chain as the matching degree of the log text and the problem feature chain; and when the matching degree is greater than or equal to a preset matching degree, determining that the accumulated number meets a second preset condition.
Further, the method further comprises: when the matching degrees of all the problem feature chains in the experience library are smaller than a preset matching degree, arranging the problems corresponding to the problem feature chains according to the sequence from high matching degree to low matching degree to obtain a problem list related to the log text; displaying the question list on a display interface; or when the matching degree is greater than or equal to the preset matching degree, displaying the target problem matched with the log text on a display interface.
Further, before the step of obtaining the log text, the method further comprises: setting a problem set in the experience base, wherein the problem set comprises at least one problem used for matching an abnormal log; and setting problem feature chains in one-to-one correspondence to the problems in the experience base, wherein each problem feature chain at least comprises two sequentially arranged features.
In another aspect, the present application provides an abnormality log analyzing apparatus, including: the log acquisition module is used for acquiring a log text; the data extraction module is used for extracting problems one by one from a problem set of an experience base and determining a problem feature chain corresponding to the problems one by one, wherein the problem set comprises at least one problem used for matching an abnormal log, and the problem feature chain at least comprises two sequentially arranged features; the matching module is used for sequentially matching the features in the problem feature chain with the log text according to a preset sequence; the cumulative number determining module is used for stopping matching of the log text and the problem feature chain when a first preset condition is met, and calculating the cumulative number of the features matched by the log text in the problem feature chain; and the target problem determining module is used for determining the problem corresponding to the problem feature chain as the target problem matched with the log text when the accumulated quantity meets a second preset condition.
In another aspect, the present application provides an apparatus comprising a processor and a memory having stored therein at least one instruction, at least one program, set of codes, or set of instructions that is loaded and executed by the processor to implement any of the methods described herein.
In another aspect, the present application provides a computer readable storage medium having stored therein at least one instruction, at least one program, set of codes, or set of instructions for being loaded by a processor and executing any of the methods described herein.
In the embodiment of the application, by acquiring a log text, extracting questions one by one from a question set of an experience base, and determining a question feature chain corresponding to the questions one by one, wherein the question set comprises at least one question used for matching an abnormal log, the question feature chain comprises at least two sequentially arranged features, the features in the question feature chain are sequentially matched with the log text according to a preset sequence, when a first preset condition is met, the matching of the log text and the question feature chain is stopped, the accumulated number of the matched features of the log text in the question feature chain is calculated, and when the accumulated number meets a second preset condition, the question corresponding to the question feature chain is determined as a target question matched with the log text. Therefore, ordered chain matching can be carried out based on multiple ordered features, more accurate matching results can be brought by single keyword matching or unordered keyword matching, richer subdivision problem fields can be effectively identified, and the accuracy of automatic analysis of abnormal logs is improved.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions and advantages of the prior art, the drawings used in the description of the embodiments or the prior art will be briefly described below, it is obvious that the drawings in the following description are only some embodiments of the present invention, and other drawings can be obtained by those skilled in the art without creative efforts.
FIG. 1 is a diagram of a hardware environment provided by an embodiment of the present application;
fig. 2 is a flowchart of an exception log generation method provided in an embodiment of the present application;
FIG. 3 is a schematic diagram of an experience library provided by an embodiment of the present application;
FIG. 4 is a schematic diagram of an interface for configuring an experience base according to an embodiment of the present application;
FIG. 5 is a flowchart of determining a target solution matching a log text in an exception log generation method provided by an embodiment of the present application;
fig. 6 is a flowchart illustrating a problem list in an exception log generation method according to an embodiment of the present disclosure;
FIG. 7 is a schematic interface diagram of an embodiment of the present disclosure when outputting an analysis result;
FIG. 8 is a flow chart of another method for generating an exception log according to an embodiment of the present application;
fig. 9 is a schematic structural diagram of an exception log generation apparatus according to an embodiment of the present application;
fig. 10 is a schematic structural diagram of an exception log generation device according to an embodiment of the present application.
Detailed Description
To make the objects, technical solutions and advantages of the present application more clear, the present application will be further described in detail with reference to the accompanying drawings. It is to be understood that the described embodiments are merely a few embodiments of the present application and not all embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application.
It should be noted that the terms "first," "second," and the like in the description and claims of this application and in the drawings described above are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It is to be understood that the data so used is interchangeable under appropriate circumstances such that the embodiments of the application described herein are capable of operation in sequences other than those illustrated or described herein. Furthermore, the terms "comprises," "comprising," and "having," and any variations thereof, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or server that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
Optionally, in the embodiment of the present invention, the above-mentioned method for analyzing an exception log may be applied to a hardware environment formed by the terminal 101 and the server 102 shown in fig. 1. As shown in fig. 1, a server 102 is connected to a terminal 101 through a network including, but not limited to: the terminal 101 is not limited to a PC, a mobile phone, a tablet computer, and the like. The method for generating the abnormal log according to the embodiment of the present invention may be executed by the terminal 101 or the server 102, and the terminal 101 may be installed with a client for a user to configure an experience base.
An abnormal log analysis method provided by an embodiment of the present invention is described below with reference to fig. 2, and as shown in fig. 2, the method includes:
step S201: acquiring a log text;
in the embodiment of the present invention, the log text may be an exception log automatically generated when a system error or an application program operation error occurs.
Step S203: extracting problems from a problem set of an experience library one by one, and determining a problem feature chain corresponding to the problems one by one, wherein the problem set comprises at least one problem used for matching an abnormal log, and the problem feature chain at least comprises two orderly-arranged features;
in the embodiment of the present invention, the experience base may be configured with a problem set in advance, and the problem set may include at least one problem for matching the abnormal log.
The experience base can also be pre-configured with a question feature chain corresponding to the questions in the question set one by one, and the question feature chain at least comprises two orderly arranged features.
That is, before the step of obtaining the log text, the method may further include:
(1) setting a problem set in the experience base, wherein the problem set comprises at least one problem used for matching an abnormal log;
(2) and setting problem feature chains in one-to-one correspondence to the problems in the experience base, wherein each problem feature chain at least comprises two sequentially arranged features.
For example, as shown in fig. 3, the problem set includes at least three problems, which are numbered a, b and c, and for each problem in the problem set, a one-to-one problem feature chain is set, for example, for the problem numbered a, a problem feature chain a.1 → a.2 → a.3 is set, where the features a.1, a.2 and a.3 are sequentially set features; for the question numbered b, the question feature chain is set to b.1 → b.2 → b.3 → b.4; for the question numbered c, the question feature chain is set to c.1 → c.2.
In actual configuration, a client may be opened at a terminal such as a computer, and a problem experience library (i.e., a database containing problem descriptions, problem features, and solutions to problems) may be configured using a web interface (as shown in fig. 4) of the client.
Step S205: sequentially matching the features in the problem feature chain with the log text according to a preset sequence;
in the embodiment of the invention, the features in the problem feature chain can be sequentially matched with the log text from front to back.
That is, the sequentially matching the features in the problem feature chain with the log text according to the preset sequence may include:
(1) matching a first feature in the question feature chain with the journal text;
(2) and if the matching is successful, matching the next feature in the problem feature chain with the log text, and matching the features in the problem feature chain with the log text one by one through multiple iterations.
For example, the problem feature chain is a.1 → a.2 → a.3, then a.1, a.2 and a.3 can be matched with the log text respectively in turn.
Optionally, the features in the problem feature chain may be sequentially matched with the log text in a sequence from back to front.
That is, the sequentially matching the features in the problem feature chain with the log text according to the preset sequence may include:
(1) matching the last feature in the problem feature chain with the log text;
(2) and if the matching is successful, matching the last feature in the problem feature chain with the log text, and matching the features in the problem feature chain with the log text one by one through multiple iterations.
For example, the problem feature chain is a.1 → a.2 → a.3, then a.3, a.2 and a.1 can be matched with the log text respectively in turn.
Step S207: when a first preset condition is met, stopping matching of the log text and the problem feature chain, and calculating the accumulated number of the features matched in the problem feature chain by the log text;
in this embodiment of the present invention, the first preset condition may be that any feature in the problem feature chain cannot be successfully matched with the log text, or that the log text is matched with all features in the problem feature chain.
That is, when the first preset condition is satisfied, stopping matching between the log text and the problem feature chain, and calculating the cumulative number of features matched by the log text in the problem feature chain may include:
stopping matching of the log text with the problem feature chain when any feature in the problem feature chain cannot be successfully matched with the log text; or the like, or, alternatively,
and stopping matching the log text with the question feature chain when the log text is matched with all the features in the question feature chain.
For example, when the problem feature chain is a.1 → a.2 → a.3, if the feature a.1 can be successfully matched with the log text, the feature a.2 is matched with the log text, and if the feature a.2 cannot be successfully matched, the matching of the log text with the problem feature chain a.1 → a.2 → a.3 is stopped, and the cumulative number of features matched by the log text in the problem feature chain a.1 → a.2 → a.3 is 1.
Alternatively, when the question feature chain is a.1 → a.2 → a.3, if all the features are matched, i.e., the features a.1, a.2 and a.3 are matched, the matching of the log text with the question feature chain a.1 → a.2 → a.3 is stopped, and the cumulative number of the features matched by the log text in the question feature chain a.1 → a.2 → a.3 is 3.
Step S209: and when the accumulated quantity meets a second preset condition, determining the problem corresponding to the problem feature chain as a target problem matched with the log text.
In the embodiment of the present invention, the target question is a question that the log text actually reacts.
Optionally, the condition that the accumulated number satisfies the second preset condition may be that a ratio of the accumulated number to the total number of the features in the problem feature chain is greater than or equal to a preset matching degree, that is, before the step of determining the problem corresponding to the problem feature chain as the target problem matched with the journal text, the method may further include:
(1) determining the ratio of the accumulated number to the total number of the features in the problem feature chain as the matching degree of the log text and the problem feature chain;
(2) and when the matching degree is greater than or equal to a preset matching degree, determining that the accumulated number meets a second preset condition.
For example, the question feature chain is d.1 → d.2 → d.3 → d.4 → d.5 (assuming that the number of the corresponding question is d), the cumulative number of features in the question feature chain that match the log text is 5, the total number of features in the question feature chain is also 5, that is, the ratio is 1, when the preset matching degree is set to 0.9, the ratio is greater than the preset matching degree, which indicates that the cumulative number satisfies the second preset condition, and the question (the number is d) corresponding to the question feature chain is determined as the target question that matches the log text.
Optionally, that the accumulated number meets the second preset condition may also mean that an absolute value of the accumulated number is greater than or equal to a preset number threshold.
For example, the question feature chain is d.1 → d.2 → d.3 → d.4 → d.5 (assuming that the number of the corresponding question is d), the cumulative number of features matching the log text in the question feature chain is 5, when the preset number threshold is set to 4, the cumulative number is greater than the preset number threshold, it is stated that the cumulative number satisfies the second preset condition, and the question (number d) corresponding to the question feature chain is determined as the target question matching the log text.
In practical applications, the tester may determine that the problem occurs during the operation of the system or the application program based on the target problem matched with the log text, and may further propose a corresponding solution based on the problem.
In the embodiment of the application, by acquiring a log text, extracting questions one by one from a question set of an experience base, and determining a question feature chain corresponding to the questions one by one, wherein the question set comprises at least one question used for matching an abnormal log, the question feature chain comprises at least two sequentially arranged features, the features in the question feature chain are sequentially matched with the log text according to a preset sequence, when a first preset condition is met, the matching of the log text and the question feature chain is stopped, the accumulated number of the matched features of the log text in the question feature chain is calculated, and when the accumulated number meets a second preset condition, the question corresponding to the question feature chain is determined as a target question matched with the log text. Therefore, ordered chain matching can be carried out based on multiple ordered features, more accurate matching results can be brought by single keyword matching or unordered keyword matching, richer subdivision problem fields can be effectively identified, and the accuracy of automatic analysis of abnormal logs is improved. Moreover, for the abnormal problem of the reaction in the log text, automation can be realized only by carrying out the process once (judging, extracting the characteristics and inputting the problem characteristic chain), and the problem of the reaction in the log text does not need to be identified and judged by expending energy every time.
In some embodiments, as shown in fig. 5, the method may further include:
step S501: adding a solution corresponding to each problem in an experience base in advance;
step S503: determining a solution corresponding to the target problem as a target solution matching the log text.
In the embodiment of the invention, the target solution can solve the problem of reaction in the log text.
In practical application, after the target problem corresponding to the text log is determined, the target solution corresponding to the target problem is determined, so that the segmentation problem which is reflected in the log can be solved according to the provided target solution by a tester while the richer segmentation problem is identified.
In some embodiments, as shown in fig. 6, the method may further include:
step S601: when the matching degrees of all the problem feature chains in the experience library are smaller than a preset matching degree, arranging the problems corresponding to the problem feature chains according to the sequence from high matching degree to low matching degree to obtain a problem list related to the log text;
step S603: and displaying the question list on a display interface.
For example, the experience library includes three problems a, b, and c, and correspondingly, the experience library includes three problem feature chains, the matching degrees of the three problem feature chains and the log text are 60%, 70%, and 80%, respectively, when the preset matching degree is 90%, it is described that the matching degrees of all the problem feature chains in the experience library are smaller than the preset matching degree, the problems a, b, and c are arranged in an order from high to low according to the matching degrees, and a problem list related to the log text is formed, and then the problem list is displayed on a display interface, so that when there is no target problem matching with the log text in the experience library, a problem list related to the log text that can be referred to can be provided for a tester, and the tester can solve a problem possibly reacted in the log according to the related problem list.
In some embodiments, as shown in fig. 7, the method may further include:
and when the matching degree is greater than or equal to the preset matching degree, displaying the target problem matched with the log text on a display interface.
In practical application, as shown in fig. 7, while the target problem is displayed, the matching degree, the target solution, the analyzed log, and the like can be displayed at the same time, so that the tester can solve the subdivision problem of the reaction in the log according to the displayed content.
The method of the above example will be further described with reference to a specific example.
As shown in fig. 8, this embodiment includes a problem configuration process and a log analysis process, where the log analysis process includes a problem matching process and a feature matching process, and in this case,
in the problem configuration flow, a problem can be added in the experience base, including the name of the problem, the type of the problem, the description of the problem and the solution, and a problem feature chain can be set for the problem, wherein the problem feature chain defines what feature should be matched firstly, and the matching is tried after the matching is successful.
In the log analysis process, a log text may be input to match with a problem in the experience base, and a matching result of the log text and the problem is returned, where the matching result may specifically include a problem matching degree and a corresponding problem detail (name, type, description, and solution).
In the problem matching process, a problem in the experience base is firstly obtained, after the problem is successfully obtained, the problem feature chain corresponding to the problem is tried to be matched, the matching degree of the log text and the problem feature chain is recorded, the next problem in the experience base is continuously obtained, and the matching process is repeated until all the problems in the experience base are matched.
In the process of feature matching, acquiring one feature in a problem feature chain, trying to match the feature with a text log after the acquisition is successful, if the matching is successful, continuously acquiring the next feature in the problem feature chain, and repeating the process of feature matching until all the features in the problem feature chain are matched; in the process, if any feature can not be successfully matched, the matching degree of the problem feature chain is returned.
In practical application, daily experience is precipitated as data, so that logs can be automatically analyzed through the system, problem features which can be matched in the logs are automatically identified, and a problem solution is produced.
Technical details not described in detail in the above embodiments may be referred to a method provided in any of the embodiments of the present application.
An embodiment of the present invention further provides an apparatus for analyzing an abnormal log, please refer to fig. 9, where the apparatus includes:
a log obtaining module 910, configured to obtain a log text;
a data extraction module 920, configured to extract questions one by one from a question set of an experience base, and determine a question feature chain corresponding to the questions one by one, where the question set includes at least one question for matching an abnormal log, and the question feature chain includes at least two sequentially set features;
a matching module 930, configured to match the features in the problem feature chain with the log text in sequence according to a preset order;
an accumulated number determining module 940, configured to stop matching between the log text and the problem feature chain when a first preset condition is met, and calculate an accumulated number of features matched by the log text in the problem feature chain;
and a target problem determining module 950, configured to determine, when the accumulated number meets a second preset condition, a problem corresponding to the problem feature chain as a target problem matching the log text.
In some embodiments, the apparatus may further comprise:
a solution adding module, configured to add a solution corresponding to each of the problems in an experience base in advance;
a target solution determination module to determine a solution corresponding to the target problem as a target solution matching the log text.
In some embodiments, the matching module may include:
and the feature matching sub-module is used for matching the first feature in the problem feature chain with the log text, matching the next feature in the problem feature chain with the log text when the matching is successful, and matching the features in the problem feature chain with the log text one by one through multiple iterations.
In some embodiments, the cumulative number determination module may include:
the first matching stopping sub-module is used for stopping matching between the log text and the problem feature chain when any feature in the problem feature chain cannot be successfully matched with the log text; or the like, or, alternatively,
and the second matching stopping sub-module is used for stopping matching between the log text and the problem feature chain when the log text is matched with all the features in the problem feature chain.
In some embodiments, the apparatus may further comprise:
a matching degree determining module, configured to determine a ratio of the accumulated number to a total number of features in the question feature chain as a matching degree of the log text and the question feature chain;
and the judging module is used for determining that the accumulated number meets a second preset condition when the matching degree is greater than or equal to a preset matching degree.
In some embodiments, the apparatus may further comprise:
the problem list generating module is used for arranging the problems corresponding to the problem feature chains according to the sequence from high matching degree to low matching degree when the matching degrees of all the problem feature chains in the experience library are smaller than a preset matching degree, so as to obtain a problem list related to the log text;
the first display module is used for displaying the question list on a display interface; or the like, or, alternatively,
and the second display module is used for displaying the target problem matched with the log text on a display interface when the matching degree is more than or equal to the preset matching degree.
In some embodiments, the apparatus may further comprise:
the problem set setting module is used for setting a problem set in the experience base, wherein the problem set comprises at least one problem used for matching an abnormal log;
and the problem feature chain setting module is used for setting problem feature chains corresponding to the problems one by one in the experience library, and each problem feature chain at least comprises two sequentially set features.
The present embodiments also provide a computer-readable storage medium having stored therein at least one instruction, at least one program, set of codes, or set of instructions that is loaded by a processor and performs any of the methods described above in the present embodiments.
Referring to fig. 10, the apparatus 1000 may have a relatively large difference due to different configurations or performances, and may include one or more Central Processing Units (CPUs) 1022 (e.g., one or more processors) and a memory 1032, and one or more storage media 1030 (e.g., one or more mass storage devices) storing an application 1042 or data 1044. Memory 1032 and storage medium 1030 may be, among other things, transient or persistent storage. The program stored on the storage medium 1030 may include one or more modules (not shown), each of which may include a series of instruction operations for the device. Still further, the central processor 1022 may be disposed in communication with the storage medium 1030, and configured to execute a series of instruction operations in the storage medium 1030 on the device 1000. Apparatus 1000 may also include one or more power supplies 1026, one or more wired or wireless network interfaces 1050, one or more input-output interfaces 1058, and/or one or more operating systems 1041, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, and so forth. Any of the methods described above in this embodiment can be implemented based on the apparatus shown in fig. 10.
The present specification provides method steps as described in the examples or flowcharts, but may include more or fewer steps based on routine or non-inventive labor. The steps and sequences recited in the embodiments are but one manner of performing the steps in a multitude of sequences and do not represent a unique order of performance. In the actual system or interrupted product execution, it may be performed sequentially or in parallel (e.g., in the context of parallel processors or multi-threaded processing) according to the embodiments or methods shown in the figures.
The configurations shown in the present embodiment are only partial configurations related to the present application, and do not constitute a limitation on the devices to which the present application is applied, and a specific device may include more or less components than those shown, or combine some components, or have an arrangement of different components. It should be understood that the methods, apparatuses, and the like disclosed in the embodiments may be implemented in other manners. For example, the above-described apparatus embodiments are merely illustrative, and for example, the division of the modules is merely a division of one logic function, and there may be other divisions when actually implemented, for example, a plurality of units or components may be combined or may be integrated into another system, or some features may be omitted, or not executed. In addition, the shown or discussed mutual coupling or direct coupling or communication connection may be an indirect coupling or communication connection through some interfaces, devices or unit modules.
Based on such understanding, the technical solution of the present application may be substantially implemented or contributed to by the prior art, or all or part of the technical solution may be embodied in a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a magnetic disk or an optical disk, and other various media capable of storing program codes.
Those of skill would further appreciate that the various illustrative components and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, computer software, or combinations of both, and that the various illustrative components and steps have been described above generally in terms of their functionality in order to clearly illustrate this interchangeability of hardware and software. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the implementation. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.
The above embodiments are only used for illustrating the technical solutions of the present application, and not for limiting the same; although the present application has been described in detail with reference to the foregoing embodiments, it should be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and such modifications or substitutions do not depart from the spirit and scope of the corresponding technical solutions in the embodiments of the present application.
Claims (10)
1. An anomaly log analysis method, the method comprising:
acquiring a log text;
extracting problems from a problem set of an experience library one by one, and determining a problem feature chain corresponding to the problems one by one, wherein the problem set comprises at least one problem used for matching an abnormal log, and the problem feature chain at least comprises two orderly-arranged features;
sequentially matching the features in the problem feature chain with the log text according to a preset sequence;
when a first preset condition is met, stopping matching of the log text and the problem feature chain, and calculating the accumulated number of the features matched in the problem feature chain by the log text;
and when the accumulated quantity meets a second preset condition, determining the problem corresponding to the problem feature chain as a target problem matched with the log text.
2. The anomaly log analysis method of claim 1, further comprising:
adding a solution corresponding to each problem in an experience base in advance;
determining a solution corresponding to the target problem as a target solution matching the log text.
3. The anomaly log analysis method according to claim 1, wherein the sequentially matching the features in the problem feature chain with the log text according to a preset sequence comprises:
matching a first feature in the question feature chain with the journal text;
and if the matching is successful, matching the next feature in the problem feature chain with the log text, and matching the features in the problem feature chain with the log text one by one through multiple iterations.
4. The anomaly log analysis method according to claim 1, wherein stopping the matching of the log text with the problem feature chain when a first preset condition is satisfied comprises:
stopping matching of the log text with the problem feature chain when any feature in the problem feature chain cannot be successfully matched with the log text; or the like, or, alternatively,
and stopping matching the log text with the question feature chain when the log text is matched with all the features in the question feature chain.
5. The anomaly log analysis method according to claim 1, wherein before the step of determining the problem corresponding to the problem feature chain as the target problem matching the log text, the method further comprises:
determining the ratio of the accumulated number to the total number of the features in the problem feature chain as the matching degree of the log text and the problem feature chain;
and when the matching degree is greater than or equal to a preset matching degree, determining that the accumulated number meets a second preset condition.
6. The anomaly log analysis method of claim 5, further comprising:
when the matching degrees of all the problem feature chains in the experience library are smaller than a preset matching degree, arranging the problems corresponding to the problem feature chains according to the sequence from high matching degree to low matching degree to obtain a problem list related to the log text;
displaying the question list on a display interface; or the like, or, alternatively,
and when the matching degree is greater than or equal to the preset matching degree, displaying the target problem matched with the log text on a display interface.
7. The anomaly log analysis method according to claim 1, wherein before said step of obtaining log text, said method further comprises:
setting a problem set in the experience base, wherein the problem set comprises at least one problem used for matching an abnormal log;
and setting problem feature chains in one-to-one correspondence to the problems in the experience base, wherein each problem feature chain at least comprises two sequentially arranged features.
8. An anomaly log analysis apparatus, characterized in that the apparatus comprises:
the log acquisition module is used for acquiring a log text;
the data extraction module is used for extracting problems one by one from a problem set of an experience base and determining a problem feature chain corresponding to the problems one by one, wherein the problem set comprises at least one problem used for matching an abnormal log, and the problem feature chain at least comprises two sequentially arranged features;
the matching module is used for sequentially matching the features in the problem feature chain with the log text according to a preset sequence;
the cumulative number determining module is used for stopping matching of the log text and the problem feature chain when a first preset condition is met, and calculating the cumulative number of the features matched by the log text in the problem feature chain;
and the target problem determining module is used for determining the problem corresponding to the problem feature chain as the target problem matched with the log text when the accumulated quantity meets a second preset condition.
9. An apparatus comprising a processor and a memory, the memory having stored therein at least one instruction, at least one program, a set of codes, or a set of instructions, the at least one instruction, the at least one program, the set of codes, or the set of instructions being loaded and executed by the processor to implement the exception log analysis method of any of claims 1 to 7.
10. A computer readable storage medium having stored therein at least one instruction, at least one program, set of codes, or set of instructions that is loaded by a processor and that performs the exception log analysis method of any of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110150294.6A CN112506748B (en) | 2021-02-04 | 2021-02-04 | Abnormal log analysis method, device, equipment and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110150294.6A CN112506748B (en) | 2021-02-04 | 2021-02-04 | Abnormal log analysis method, device, equipment and storage medium |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN112506748A true CN112506748A (en) | 2021-03-16 |
| CN112506748B CN112506748B (en) | 2021-07-09 |
Family
ID=74952544
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110150294.6A Active CN112506748B (en) | 2021-02-04 | 2021-02-04 | Abnormal log analysis method, device, equipment and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112506748B (en) |
Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1619538A (en) * | 2004-12-03 | 2005-05-25 | 北京北方烽火科技有限公司 | Linear parameter fuzzy matching algorithm of short massage contents |
| CN107153584A (en) * | 2016-03-03 | 2017-09-12 | 中兴通讯股份有限公司 | Method for detecting abnormality and device |
| CN110019762A (en) * | 2017-12-08 | 2019-07-16 | 深圳壹账通智能科技有限公司 | A kind of positioning problems method, storage medium and server |
| CN111444321A (en) * | 2019-01-16 | 2020-07-24 | 北京字节跳动网络技术有限公司 | Question answering method, device, electronic equipment and storage medium |
-
2021
- 2021-02-04 CN CN202110150294.6A patent/CN112506748B/en active Active
Patent Citations (4)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN1619538A (en) * | 2004-12-03 | 2005-05-25 | 北京北方烽火科技有限公司 | Linear parameter fuzzy matching algorithm of short massage contents |
| CN107153584A (en) * | 2016-03-03 | 2017-09-12 | 中兴通讯股份有限公司 | Method for detecting abnormality and device |
| CN110019762A (en) * | 2017-12-08 | 2019-07-16 | 深圳壹账通智能科技有限公司 | A kind of positioning problems method, storage medium and server |
| CN111444321A (en) * | 2019-01-16 | 2020-07-24 | 北京字节跳动网络技术有限公司 | Question answering method, device, electronic equipment and storage medium |
Also Published As
| Publication number | Publication date |
|---|---|
| CN112506748B (en) | 2021-07-09 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112052151B (en) | Fault root cause analysis method, device, equipment and storage medium | |
| Baele et al. | Genealogical working distributions for Bayesian model testing with phylogenetic uncertainty | |
| US11915104B2 (en) | Normalizing text attributes for machine learning models | |
| RU2722692C1 (en) | Method and system for detecting malicious files in a non-isolated medium | |
| CN108459964B (en) | Test case selection method, device, equipment and computer readable storage medium | |
| CN112801800A (en) | Behavior fund analysis system, behavior fund analysis method, computer equipment and storage medium | |
| CN108388509B (en) | Software testing method, computer readable storage medium and terminal equipment | |
| CN112365202B (en) | Method for screening evaluation factors of multi-target object and related equipment thereof | |
| CN111104242A (en) | Method and device for processing abnormal logs of operating system based on deep learning | |
| CN109241511B (en) | Electronic report generation method and equipment | |
| CN112506748B (en) | Abnormal log analysis method, device, equipment and storage medium | |
| CN113268485A (en) | Data table association analysis method, device, equipment and storage medium | |
| CN116166967B (en) | Data processing method, equipment and storage medium based on meta learning and residual error network | |
| CN115589339B (en) | Network attack type identification method, device, equipment and storage medium | |
| CN109597702B (en) | Root cause analysis method, device, equipment and storage medium for message bus abnormity | |
| Davidson et al. | Efficient quartet representations of trees and applications to supertree and summary methods | |
| CN116560984A (en) | Test case clustering grouping method based on call dependency graph | |
| CN108984386A (en) | Test method, device and the storage medium of application program search | |
| JP6588494B2 (en) | Extraction apparatus, analysis system, extraction method, and extraction program | |
| CN113806231A (en) | Code coverage rate analysis method, device, equipment and medium | |
| CN111861701A (en) | Wind control model optimization method and device, computer equipment and storage medium | |
| CN112115046B (en) | Software fault positioning method, device and terminal | |
| CN114676656B (en) | Consistency measurement method, device, equipment and storage medium of multi-response CFD model | |
| CN115794646A (en) | Software testing method and device, electronic equipment and storage medium | |
| CN115619148A (en) | Demand analysis method and device for power distribution project |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant |