Background
With the development of the IT industry and the rapid advance of the digitization process, the application of log collection in various industries is more and more extensive. How to collect, store, analyze and monitor user operation logs of each business level of an enterprise in a centralized manner becomes a common requirement. Meanwhile, with the rapid development of the internet industry, the enterprise service log magnitude is leaped from GB to TB to PB, functional requirements are eliminated, and the performance standard of the log collection method is also more and more strictly required.
In recent years, head Internet enterprises such as ali and huashi have proposed respective Log collection methods and system architectures, and have developed mainstream Log Service products and solutions such as SLS (Log Service, abbreviated as SLS), LogHub (real-time collection and consumption), and Log Tank Service (cloud Log Service) by collecting, analyzing and monitoring Log data on users, sensors, servers, and IoT (Internet of Things, chinese name is Internet of Things) devices, and combining technologies such as data cleaning, stream calculation, and data warehouse. The cloud Log Service (Log Tank Service) provides functions of one-stop Log collection, second-level search, mass storage, structured processing, dump, visual charts and the like, and application scenarios such as application operation and maintenance, visual analysis of network logs, equal-guarantee regulation, operation analysis and the like are met; the log service (SLS) is a one-stop service for log-like data, which is created by a large number of large data scenarios across the atliba group. The user can quickly complete functions of log data acquisition, consumption, delivery, query analysis and the like without development, the operation and maintenance efficiency and the operation efficiency are improved, and the processing capacity of massive logs in the DT era is established; the LogHub accesses real-time log data (such as Metric, Event, BinLog, TextLog, etc.) through ECS, containers, mobile terminals, open source software, JS, etc., provides a real-time consumption interface, interfaces with real-time computing and services, and is used for data cleansing (ETL), Stream computing (Stream computer), monitoring and alarming, machine learning and iterative computing.
However, the current mainstream log collection service mainly collects system logs or IoT device logs, is mainly used for post analysis or simple real-time early warning, lacks a solution for real-time collection, analysis and early warning of complex service operation logs, and has poor overall timeliness in processing of an ultra-large data magnitude. Moreover, due to lack of integration functions for different log formats and configuration functions for log fields, the compatibility of the current mainstream log collection service to a multi-source service log system is poor, and an efficient integration function is lacked when facing different log formats of different service source systems.
Disclosure of Invention
Based on the technical problem, the problem to be solved by the present application is to integrate different logs of different service source systems, so as to solve the problems that the compatibility of the current mainstream log collection service to a multi-source service log system is poor, and an efficient integration function is lacked when different log formats of different service source systems are faced.
In a first aspect, the present application provides a method for collecting a multi-source service operation log, where the method includes:
calling a file writing method of the log JAR packet, cleaning and storing an original log file of a service unit to generate a local log file;
a file uploading method is called to upload the local log file to a file server;
displaying the uploading progress of the local log file, and storing the local log file;
reading the uploading progress of the local log file in the file server;
after the local log file is uploaded, a log acquisition unit is informed;
downloading the local log file from the file server;
and archiving and saving the downloaded local log files to a storage database in batches.
In a second aspect, the present application further provides a multi-source service operation log collecting system corresponding to the first aspect, including: the system comprises a plurality of service units, a file server and a log acquisition unit, wherein the service units are provided with log JAR packages, the file server is in communication connection with the service units, and the log JAR packages comprise a file writing method and a file uploading method, wherein:
the service unit is configured to perform the following steps:
calling a file writing method of the log JAR packet, cleaning and storing an original log file of the service unit to generate a local log file;
calling the file uploading method to upload the local log file to a file server;
the file server is configured to perform the steps of:
displaying the uploading progress of the local log file, and storing the local log file;
the service unit is further configured to perform the steps of:
reading the uploading progress of the local log file in the file server;
after the local log file is uploaded, a log acquisition unit is informed;
the log collection unit is configured to perform the steps of:
downloading the local log file from the file server, and deleting the local log file on the file server after the downloading is finished;
and archiving and saving the downloaded local log files to a storage database in batches.
According to the technical scheme, the multi-source service operation log acquisition method and system comprise a file writing method for calling a log JAR package, and original log files of service units are cleaned and stored to generate local log files; a file uploading method is called to upload the local log file to a file server; displaying the uploading progress of the local log file and storing the local log file; reading the uploading progress of a local log file in a file server; after uploading the local log file, informing a log acquisition unit; downloading a local log file from a file server; and archiving and saving the downloaded local log files in a storage database in batches. The log JAR package is locally deployed in each service source system through codes, and an original log file is subjected to data cleaning and storage through a file writing method in the log JAR package to generate a local log file; a unified log format template aiming at the service operation log is provided by calling a file writing method, and efficient multi-source log format integration is realized.
Detailed Description
In order to make the objects, technical solutions and advantages of the present application more apparent, the technical solutions of the present application will be described in detail and completely with reference to the following specific embodiments of the present application and the accompanying drawings. It should be apparent that the described embodiments are only some of the embodiments of the present application, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present application. The technical solutions provided by the embodiments of the present application are described in detail below with reference to the accompanying drawings.
Referring to fig. 1, fig. 1 is a scene schematic diagram of a multi-source service operation log collection method, in the present application, a multi-source service refers to services from different sources, and fig. 1 illustrates data flow among three units, including a service unit, a file server, and a log collection unit. For convenience of description, the service units are described as the service source systems, each service unit actually corresponds to a specific service source system, each service source system generates an operation log in the operation process, the log generated in the operation process of the service source system is called as an original log file (not shown in the figure), and the original log file is generally stored in a server where the service source system is located.
In the software field, JAR files (Java Archive) are a software package file format that is commonly used to aggregate a large number of Java class files, associated metadata and resource (text, pictures, etc.) files into one file in order to develop Java platform application software or libraries. In the application, the log JAR package is locally deployed in each service source system through codes, that is, the JAR package is deployed in a server where the service source system is located, and the service source system can directly refer to the method in the JAR package. The log JAR package comprises a file writing method and a file uploading method, wherein the file writing method comprises two functions, namely log format conversion (realized by data cleaning); and secondly, writing the original log file of the service source system into a local log file after format conversion.
The principle of implementing conversion of the log format by a data cleaning mode is that a file writing method includes a plurality of log format templates, and the log format template and the cleaning mode can be specified in the file writing method, for example, a preset log format template may include the following service fields: the operation time, the event type, the scene code, the unique user identifier, the user description, the operation behavior identifier, the operation behavior description, the operation behavior result, the remark information 1, the remark information 2, the remark information 3 and the like can be modified on a preset log format template at a code layer. For another example, the preset cleaning mode includes regular matching and field matching, the regular matching is to match the log field according to the format rule of the data, for example, the number in the format of 1xxxxxxxx is automatically matched into a mobile phone number; the field matching, i.e. the exact matching according to the fields of the metadata, e.g. matching the "phone number" field to a mobile phone number, can be modified in the code level to the detailed matching in the cleaning mode. The method and the device realize high-efficiency integration of the multi-source log format by providing the uniform log format template aiming at the service operation log, and realize the conversion of different and complex log formats into the uniform log format template by the original log file of the multi-source service source system according to the preset log format template and the preset data cleaning mode.
Referring to fig. 2, fig. 2 is a schematic flow chart of a multi-source service operation log collecting method, as can be seen from fig. 2, the method specifically includes:
s1, calling a file writing method of the log JAR package, cleaning and storing the original log files of the service units to generate local log files;
the method comprises the steps that each service source system is provided with a log JAR packet, which is the core for finally realizing log integration of the multi-source service source systems, the service source systems firstly call a file writing method in the log JAR, original log files of the service source systems are cleaned and then written into local log files, and the cleaning step mainly comprises the step of carrying out format conversion on the original log files of the service source systems according to a unified log template, namely carrying out format conversion on the source log files of the service source systems according to a preset log template. With reference to fig. 1, there are n service source systems, where n is a positive integer not less than 1, and after cleaning, the cleaned original log file is stored locally in a server where the service source system is located, and after locally storing, the cleaned original log file generates a local log file, that is, the source log file after format conversion is locally stored to generate a local log file. Correspondingly, n service source systems correspond to n local log files. The local log files of the service source system are owned by the service source system, and can be filed, backed up and the like according to the requirements of each service source system. In this step, the original log file is written into the local log file by calling the log Jar packet, which is a pure local operation without network interaction and consumes time in milliseconds (depending on the size of the original log and the resources of the local server, but it can be almost ignored).
S2, calling a file uploading method to upload the local log file to a file server;
after the file writing method is completed, that is, after the cleaning of the original log file and the generation of the local log file are completed, the service source system calls a file uploading method in the log JAR package to upload n local log files to the file server, and in the file uploading method, the file uploading method can be configured according to a preset mode, including a file uploading mode, a file uploading frequency and a file resuming function, for example, the local file uploading mode can be designated as a fragmentation mode (by rows or by fields), the local log file can be uploaded when reaching a threshold size, for example, the local log file is uploaded when reaching 2M (megabytes), the uploading function can be triggered, the breakpoint resuming function can be started, the uploading frequency can be set, and the like, which is specifically determined according to actual conditions.
The file server collects transmitted local log files in a file acquisition mode, uploads the local log files to the file server by calling a file uploading function of a log JAR packet, and the step is file-level data transmission, wherein the transmission efficiency is specifically determined by the size of the local log files, the selection of the file server, server network resources and the like, and according to relevant data statistics, the local log files of about 200kb can be transmitted within 10ms, so that the transmission efficiency between a service source system and the file server is high. According to the description, the original log file is subjected to data cleaning and storage through a file writing method in the log Jar package, and a local log file is generated; and uploading the generated local log file to a file server by a file uploading method in the log Jar package.
S3, displaying the uploading progress of the local log file and storing the local log file;
when receiving the local log file, the file server can display the uploading progress of the local log file and store the local log file in real time.
S4, reading the uploading progress of the local log file in the file server;
because the file server and each service source system can be in communication connection, each service source system can also master the uploading progress of the local log file to the file server in real time, namely, the uploading progress of the local log file in the file server can be read.
S5, informing the log collection unit after uploading the local log file;
and after monitoring that the local log file is uploaded, the service source system informs the log acquisition unit of the uploaded message. Specifically, the local log file may generate an upload completion message after the file server finishes uploading, the upload completion message may trigger the message notification component, and then the message notification component sends the upload completion message to the log acquisition unit. The message notification component can be integrated in the log collection unit, and each service source system and the log collection unit are also in communication connection, so that after the local log file is uploaded, the service source system can notify the log collection unit of collecting the local log file through the message notification component, and the local log file can be collected and analyzed in real time.
S6, downloading the local log file from the file server;
the log collection unit downloads the local log file from the file server after receiving the uploaded message, wherein the downloading process is the process of collecting the local log file, but the collection is not the collection of common data, but the collection of the local log file after cleaning the original log file of the multi-source service source system and performing standard formatting treatment according to a uniform log format template. It should be noted that the local log file in the file server is temporarily stored, and the log collection unit deletes the local log file on the file server after downloading the local log file from the file server, thereby avoiding overload of the storage space of the file server. The log collection unit collects local log files in a file collection mode, the local log files are downloaded from the file server and are also in data transmission at a file level, compared with the data files transmitted through the interface, the log collection unit can minimize the transmission pressure of log data, and the transmission efficiency is greatly improved.
And S7, bulk archiving and saving the downloaded local log files to a storage database.
The log acquisition unit is used for archiving and storing downloaded local log files in a storage database in batches, the storage database can be an elastic search database (ES database for short), the elastic search can realize high-efficiency query, and is used for archiving the local log files and providing technical support for log acquisition and analysis of a real-time service source system.
According to the technical scheme, the multi-source service operation log acquisition method comprises the steps of calling a file writing method of a log JAR package, cleaning and storing original log files of service units to generate local log files; a file uploading method is called to upload the local log file to a file server; displaying the uploading progress of the local log file, and storing the local log file; reading the uploading progress of a local log file in a file server; after uploading the local log file, informing a log acquisition unit; downloading a local log file from a file server; and archiving and saving the downloaded local log files in a storage database in batches. The log JAR package is locally deployed in each service source system through codes, and an original log file is subjected to data cleaning and storage through a file writing method in the log JAR package to generate a local log file; a unified log format template aiming at the service operation log is provided by calling a file writing method, high-efficiency multi-source log format integration is realized, and the generated local log file is uploaded to a file server through a file uploading method in a log Jar packet. The log collection unit downloads a local log file from the file server, collects the local log file in a file collection mode, and archives and stores the local log file in a storage database in batches to realize real-time collection of the operation log of the multi-source service source system.
In addition, the application also provides a multi-source service operation log acquisition system corresponding to the method, and the system comprises: the system comprises a plurality of service units, a file server and a log acquisition unit, wherein the service units are provided with log JAR packages, the file server is in communication connection with the service units, and the log JAR packages comprise a file writing method and a file uploading method, wherein:
the service unit is configured to perform the following steps:
calling a file writing method of a log JAR package, and cleaning and storing original log files of service units to generate local log files;
a file uploading method is called to upload the local log file to a file server;
the file server is configured to perform the steps of:
displaying the uploading progress of the local log file, and storing the local log file;
the service unit is further configured to perform the following steps:
reading the uploading progress of a local log file in a file server;
after uploading the local log file, informing a log acquisition unit;
the log collection unit is configured to perform the steps of:
downloading a local log file from the file server, and deleting the local log file on the file server after the downloading is finished;
and archiving and saving the downloaded local log files in a storage database in batches.
Further, the system further comprises a message notification component in communication connection with the file server and the log collection unit, wherein the local log file generates an upload completion message after the file server finishes uploading, and the upload completion message triggers the message notification component, and the message notification component is configured to execute the following steps:
and after receiving the uploading completion message, sending the uploading completion message to the log acquisition unit.
Other embodiments of the invention will be apparent to those skilled in the art from consideration of the specification and practice of the invention disclosed herein. This application is intended to cover any variations, uses, or adaptations of the invention following, in general, the principles of the invention and including such departures from the present disclosure as come within known or customary practice within the art to which the invention pertains. It is intended that the specification and examples be considered as exemplary only, with a true scope and spirit of the invention being indicated by the following claims.