CN112711520A - Method, device and equipment for processing abnormal log information and storage medium - Google Patents
Method, device and equipment for processing abnormal log information and storage medium Download PDFInfo
- Publication number
- CN112711520A CN112711520A CN202011611184.7A CN202011611184A CN112711520A CN 112711520 A CN112711520 A CN 112711520A CN 202011611184 A CN202011611184 A CN 202011611184A CN 112711520 A CN112711520 A CN 112711520A
- Authority
- CN
- China
- Prior art keywords
- information
- abnormal
- log information
- preset
- log
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3452—Performance evaluation by statistical analysis
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/3003—Monitoring arrangements specially adapted to the computing system or computing system component being monitored
- G06F11/3006—Monitoring arrangements specially adapted to the computing system or computing system component being monitored where the computing system is distributed, e.g. networked systems, clusters, multiprocessor systems
Abstract
The invention relates to the field of big data, and provides a method, a device, equipment and a storage medium for processing abnormal log information, which are used for improving the processing efficiency of distributed abnormal log information. The processing method of the abnormal log information comprises the following steps: performing anomaly detection, reading and file writing on system application log information applied by each system through a section-oriented programming system to obtain an anomaly log file; reading and storing abnormal information in the abnormal log file according to a preset time interval through a log file acquisition system to obtain candidate abnormal log information; the method comprises the steps that candidate abnormal log information in a log file acquisition system is monitored and extracted in real time through a log management system based on a full-text search engine, and abnormal log information to be processed is obtained; and filtering, index creating and fragment processing are carried out on the abnormal log information to be processed to obtain target abnormal log information. In addition, the invention also relates to a block chain technology, and the target abnormal log information can be stored in the block chain.
Description
Technical Field
The present invention relates to the field of data processing of big data, and in particular, to a method, an apparatus, a device, and a storage medium for processing abnormal log information.
Background
In the enterprise application service of the large internet, with the continuous expansion of the log scale of each system, certain difficulties are brought to the state analysis of the system or other system analysis operations. A large amount of log information generated in the running process of the system is effectively utilized to analyze the state of the system, and the method has certain significance for the development of requirements on the aspects of the performance, the expandability and the like of the system. At present, the abnormal log information generated in the running process of the system is generally obtained from each application node, and is analyzed and processed.
With the increase of the number of the application nodes, the problems of complicated operation and difficult operation, such as collection, analysis, and retrieval of the distributed abnormal log information, are caused, and thus, the processing efficiency of the distributed abnormal log information is low.
Disclosure of Invention
The invention provides a method, a device, equipment and a storage medium for processing abnormal log information, which are used for improving the processing efficiency of distributed abnormal log information.
The invention provides a method for processing abnormal log information in a first aspect, which comprises the following steps:
sending an abnormal interception instruction to a preset section-oriented programming system, so that the section-oriented programming system performs abnormal detection, reading and file writing on system application log information applied by each system according to the abnormal interception instruction to obtain an abnormal log file;
sending a monitoring acquisition instruction to a preset log file acquisition system, so that the log file acquisition system reads and stores abnormal information in the abnormal log file according to the monitoring acquisition instruction and a preset time period to obtain candidate abnormal log information;
sending a monitoring and extracting instruction to a preset log management system based on a full-text search engine, so that the log management system based on the full-text search engine carries out real-time monitoring and extraction on candidate abnormal log information in the log file acquisition system according to the monitoring and extracting instruction to obtain abnormal log information to be processed;
and filtering, index creating and fragment processing are carried out on the abnormal log information to be processed to obtain target abnormal log information.
Optionally, in a first implementation manner of the first aspect of the present invention, the sending an exception intercepting instruction to a preset section-oriented programming system, so that the section-oriented programming system performs exception detection, reading, and file writing on system application log information applied by each system according to the exception intercepting instruction, to obtain an exception log file, includes:
sending an abnormal interception instruction to a preset section-oriented programming system, so that the section-oriented programming system calls a pre-configured interceptor chain according to the abnormal interception instruction, and performs abnormal detection and abnormal information reading on system application log information applied by each system to obtain initial abnormal log information;
classifying the types of the initial abnormal log information to obtain classified log information, and acquiring a target error log file corresponding to the classification type of the classified log information;
and writing the initial abnormal log information into the target error log file according to a preset writing time interval to obtain an abnormal log file.
Optionally, in a second implementation manner of the first aspect of the present invention, the sending a monitoring extraction instruction to a preset full-text search engine-based log management system, so that the full-text search engine-based log management system performs real-time monitoring and extraction on candidate abnormal log information in the log file acquisition system according to the monitoring extraction instruction, to obtain abnormal log information to be processed, includes:
sending a monitoring extraction instruction to a preset full-text search engine-based log management system, so that the full-text search engine-based log management system monitors and analyzes increment, reading time and storage time of candidate abnormal log information in the log file acquisition system based on a preset monitoring mechanism according to the monitoring extraction instruction to obtain abnormal log information meeting preset monitoring conditions;
and extracting the abnormal log information meeting the preset monitoring conditions from the log file acquisition system to a full-text search engine corresponding to a pre-configured cluster service address to obtain the abnormal log information to be processed.
Optionally, in a third implementation manner of the first aspect of the present invention, the filtering, index creating, and fragment processing the to-be-processed abnormal log information to obtain target abnormal log information includes:
performing information matching, information extraction and key word extraction on the abnormal log information to be processed through the full-text search engine and a preset log key information decision tree to obtain filtered abnormal log information and a target key word corresponding to the filtered abnormal log information;
creating a cluster index according to the filtering abnormal log information and the target key words, and carrying out fragment processing on data in the cluster index to obtain fragment index data;
and storing the fragment index data to a preset storage space according to a preset storage strategy to obtain target abnormal log information.
Optionally, in a fourth implementation manner of the first aspect of the present invention, the sending a monitoring acquisition instruction to a preset log file acquisition system, so that the log file acquisition system reads and stores abnormal information in the abnormal log file according to the monitoring acquisition instruction and according to a preset time period, to obtain candidate abnormal log information, includes:
sending a monitoring acquisition instruction to a preset log file acquisition system so that the log file acquisition system reads abnormal information in the abnormal log file according to the monitoring acquisition instruction and a preset time period;
acquiring historical reading position information and target position offset information of the abnormal log file, wherein the historical position is used for indicating the position offset information of the abnormal log file read before the starting time of the preset time period, and the target position offset information is used for indicating the position offset information read at the ending time of the preset time period;
judging whether the historical reading position information is consistent with the target position offset information or not;
and if the historical reading position information is inconsistent with the target position offset information, writing the abnormal information, the historical reading position information and the target position offset information into a registration file of a preset storage space to obtain candidate abnormal log information.
Optionally, in a fifth implementation manner of the first aspect of the present invention, after the filtering, index creating, and fragment processing are performed on the to-be-processed abnormal log information to obtain target abnormal log information, the method further includes:
receiving a retrieval instruction sent by a preset visual user interface, inquiring the target abnormal log information and generating a report based on the retrieval instruction to obtain a statistical analysis report, and sending the statistical analysis report to the visual user interface.
Optionally, in a sixth implementation manner of the first aspect of the present invention, the receiving a search instruction sent by a preset visual user interface, querying the target abnormal log information and generating a statistical analysis report based on the search instruction, and sending the statistical analysis report to the visual user interface includes:
receiving a retrieval instruction sent by a preset visual user interface, and retrieving and filtering the target abnormal log information through a preset routing algorithm and a genetic algorithm based on the retrieval instruction to obtain target retrieval information;
and performing statistical analysis on the target retrieval information to obtain statistical analysis information, generating a statistical analysis report according to the statistical analysis information, and sending the statistical analysis report to the visual user interface.
A second aspect of the present invention provides an apparatus for processing exception log information, including:
the system comprises an exception interception module, a section-oriented programming system and an exception processing module, wherein the exception interception module is used for sending an exception interception instruction to the preset section-oriented programming system so that the section-oriented programming system performs exception detection, reading and file writing on system application log information applied by each system according to the exception interception instruction to obtain an exception log file;
the monitoring acquisition module is used for sending a monitoring acquisition instruction to a preset log file acquisition system so that the log file acquisition system reads and stores abnormal information in the abnormal log file according to the monitoring acquisition instruction and a preset time interval to obtain candidate abnormal log information;
the monitoring extraction module is used for sending a monitoring extraction instruction to a preset full-text search engine-based log management system so that the full-text search engine-based log management system can monitor and extract candidate abnormal log information in the log file acquisition system in real time according to the monitoring extraction instruction to obtain abnormal log information to be processed;
and the exception handling module is used for filtering, index creating and fragment processing the exception log information to be processed to obtain target exception log information.
Optionally, in a first implementation manner of the second aspect of the present invention, the exception intercepting module is specifically configured to:
sending an abnormal interception instruction to a preset section-oriented programming system, so that the section-oriented programming system calls a pre-configured interceptor chain according to the abnormal interception instruction, and performs abnormal detection and abnormal information reading on system application log information applied by each system to obtain initial abnormal log information;
classifying the types of the initial abnormal log information to obtain classified log information, and acquiring a target error log file corresponding to the classification type of the classified log information;
and writing the initial abnormal log information into the target error log file according to a preset writing time interval to obtain an abnormal log file.
Optionally, in a second implementation manner of the second aspect of the present invention, the monitoring extraction module is specifically configured to:
sending a monitoring extraction instruction to a preset full-text search engine-based log management system, so that the full-text search engine-based log management system monitors and analyzes increment, reading time and storage time of candidate abnormal log information in the log file acquisition system based on a preset monitoring mechanism according to the monitoring extraction instruction to obtain abnormal log information meeting preset monitoring conditions;
and extracting the abnormal log information meeting the preset monitoring conditions from the log file acquisition system to a full-text search engine corresponding to a pre-configured cluster service address to obtain the abnormal log information to be processed.
Optionally, in a third implementation manner of the second aspect of the present invention, the exception handling module is specifically configured to:
performing information matching, information extraction and key word extraction on the abnormal log information to be processed through the full-text search engine and a preset log key information decision tree to obtain filtered abnormal log information and a target key word corresponding to the filtered abnormal log information;
creating a cluster index according to the filtering abnormal log information and the target key words, and carrying out fragment processing on data in the cluster index to obtain fragment index data;
and storing the fragment index data to a preset storage space according to a preset storage strategy to obtain target abnormal log information.
Optionally, in a fourth implementation manner of the second aspect of the present invention, the monitoring and acquiring module is specifically configured to:
sending a monitoring acquisition instruction to a preset log file acquisition system so that the log file acquisition system reads abnormal information in the abnormal log file according to the monitoring acquisition instruction and a preset time period;
acquiring historical reading position information and target position offset information of the abnormal log file, wherein the historical position is used for indicating the position offset information of the abnormal log file read before the starting time of the preset time period, and the target position offset information is used for indicating the position offset information read at the ending time of the preset time period;
judging whether the historical reading position information is consistent with the target position offset information or not;
and if the historical reading position information is inconsistent with the target position offset information, writing the abnormal information, the historical reading position information and the target position offset information into a registration file of a preset storage space to obtain candidate abnormal log information.
Optionally, in a fifth implementation manner of the second aspect of the present invention, the apparatus for processing exception log information further includes:
and the generation and sending module is used for receiving a retrieval instruction sent by a preset visual user interface, inquiring the target abnormal log information and generating a report based on the retrieval instruction to obtain a statistical analysis report, and sending the statistical analysis report to the visual user interface.
Optionally, in a sixth implementation manner of the second aspect of the present invention, the generating and sending module is specifically configured to:
receiving a retrieval instruction sent by a preset visual user interface, and retrieving and filtering the target abnormal log information through a preset routing algorithm and a genetic algorithm based on the retrieval instruction to obtain target retrieval information;
and performing statistical analysis on the target retrieval information to obtain statistical analysis information, generating a statistical analysis report according to the statistical analysis information, and sending the statistical analysis report to the visual user interface.
A third aspect of the present invention provides an apparatus for processing exception log information, including: a memory and at least one processor, the memory having instructions stored therein; the at least one processor calls the instruction in the memory to enable the processing device of the abnormal log information to execute the processing method of the abnormal log information.
A fourth aspect of the present invention provides a computer-readable storage medium having stored therein instructions, which, when run on a computer, cause the computer to execute the above-described method of processing abnormality log information.
In the technical scheme provided by the invention, an abnormal interception instruction is sent to a preset section-oriented programming system, so that the section-oriented programming system performs abnormal detection, reading and file writing on system application log information applied by each system according to the abnormal interception instruction to obtain an abnormal log file; sending a monitoring acquisition instruction to a preset log file acquisition system, so that the log file acquisition system reads and stores abnormal information in an abnormal log file according to the monitoring acquisition instruction and a preset time period to obtain candidate abnormal log information; sending a monitoring extraction instruction to a preset log management system based on a full-text search engine, so that the log management system based on the full-text search engine carries out real-time monitoring and extraction on candidate abnormal log information in a log file acquisition system according to the monitoring extraction instruction, and obtaining abnormal log information to be processed; and filtering, index creating and fragment processing are carried out on the abnormal log information to be processed to obtain target abnormal log information. In the embodiment of the invention, the system is programmed to the tangent plane to perform abnormity detection, reading and file writing on the system application log information applied by each system, so that the problems of long application starting time and low efficiency of obtaining the abnormal log information are solved, the accuracy and the efficiency of generating the abnormal log file are improved, the abnormal information in the abnormal log file is read and stored according to the preset time period through the log file acquisition system, and the abnormal log information to be processed is filtered, indexed and fragmented, so that the subsequent query and positioning are facilitated, the log collection performance and the application decoupling are improved, the distributed operations of collecting, analyzing and retrieving the abnormal log information are simplified and facilitated, and the processing efficiency of the distributed abnormal log information is improved.
Drawings
FIG. 1 is a diagram of an embodiment of a method for processing exception log information according to an embodiment of the present invention;
FIG. 2 is a diagram of another embodiment of a method for processing exception log information according to an embodiment of the present invention;
FIG. 3 is a schematic diagram of an embodiment of an apparatus for processing exception log information according to an embodiment of the present invention;
FIG. 4 is a schematic diagram of another embodiment of an apparatus for processing exception log information according to an embodiment of the present invention;
fig. 5 is a schematic diagram of an embodiment of an exception log information processing apparatus in the embodiment of the present invention.
Detailed Description
The embodiment of the invention provides a method, a device, equipment and a storage medium for processing abnormal log information, which are used for improving the processing efficiency of distributed abnormal log information.
The terms "first," "second," "third," "fourth," and the like in the description and in the claims, as well as in the drawings, if any, are used for distinguishing between similar elements and not necessarily for describing a particular sequential or chronological order. It will be appreciated that the data so used may be interchanged under appropriate circumstances such that the embodiments described herein may be practiced otherwise than as specifically illustrated or described herein. Furthermore, the terms "comprises," "comprising," or "having," and any variations thereof, are intended to cover non-exclusive inclusions, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
For convenience of understanding, a specific flow of the embodiment of the present invention is described below, and referring to fig. 1, an embodiment of the method for processing exception log information in the embodiment of the present invention includes:
101. and sending an exception interception instruction to a preset section-oriented programming system, so that the section-oriented programming system performs exception detection, reading and file writing on system application log information applied by each system according to the exception interception instruction to obtain an exception log file.
It is to be understood that the execution subject of the present invention may be a processing device of the abnormal log information, and may also be a terminal or a server, which is not limited herein. The embodiment of the present invention is described by taking a server as an execution subject.
The preset profile-oriented programming frame may be an aspect-oriented programming (AOP) frame of Java, or may be a profile-oriented programming frame. spring AOP. The server pre-sets and configures a section-oriented programming system which is connected with each system application, sends an abnormal interception instruction to the section-oriented programming system, so as to start the section-oriented programming system, monitor system application log information generated by each system application according to the abnormal interception instruction, read the system application log information, perform data cleaning and data conversion (convert into a data format corresponding to the section-oriented programming framework AOP, and the like) on the system application log information, intercepting abnormal information in system application log information after data cleaning and data conversion, writing the intercepted abnormal information into a pre-generated single error log file, therefore, the abnormal log file is obtained, the problems of long application starting time and low efficiency of intercepting abnormal log information are solved, and the accuracy and the efficiency of generating the abnormal log file are improved.
102. And sending a monitoring acquisition instruction to a preset log file acquisition system, so that the log file acquisition system reads and stores abnormal information in the abnormal log file according to the monitoring acquisition instruction and a preset time period to obtain candidate abnormal log information.
For example, the preset log file collection system may be Filebeat, the server sends a monitoring collection instruction to the log file collection system Filebeat, so that the log file collection system monitors the generation time of the abnormal log file in the tangent plane programming system according to the monitoring collection instruction and the preset time period, and judges whether the generation time is later than the starting time of the preset time period, if so, reads the abnormal information written in the abnormal log file at the starting time later than the preset time period to obtain the collected abnormal log information, if not, continues to monitor the generation time of the abnormal log file in the tangent plane programming system until the collected abnormal log information written in the abnormal log file at the starting time later than the preset time period is obtained, and after the log file collection system obtains the collected abnormal log information, obtains the abnormal type of the collected abnormal log information, and marking the abnormal log information with label information according to the abnormal type to obtain marked abnormal log information, and storing the marked abnormal log information into a storage space corresponding to the abnormal type or writing the marked abnormal log information into a file corresponding to the abnormal type to obtain candidate abnormal log information.
103. And sending a monitoring and extracting instruction to a preset log management system based on a full-text search engine so that the log management system based on the full-text search engine can monitor and extract candidate abnormal log information in the log file acquisition system in real time according to the monitoring and extracting instruction to obtain abnormal log information to be processed.
The method comprises the steps that a server respectively builds a log collection system Logstash and a distributed full-text retrieval system Elasticissearch in advance, a config configuration file and Elasticissearch cluster service address information in the log collection system Logstash are obtained, and Elasticissearch cluster service addresses are configured in the config configuration file so as to carry out butt joint integration on the log collection system Logstash and the distributed full-text retrieval system Elasticissearch, and therefore the log management system based on a full-text search engine is obtained.
The server sends a monitoring and extracting instruction to a log management system based on a full-text search engine, so that the log management system based on the full-text search engine monitors the updating of candidate abnormal log information in a log file acquisition system in real time according to the monitoring and extracting instruction, and when the log acquisition system logstack in the log management system based on the full-text search engine monitors that the log file acquisition system updates the candidate abnormal log information, the candidate abnormal log information is extracted and sent to a distributed full-text retrieval system Elasticissearch, so that the abnormal log information to be processed is obtained.
104. And filtering, index creating and fragment processing are carried out on the abnormal log information to be processed to obtain target abnormal log information.
After the server obtains the abnormal log information to be processed through a log management system based on a full-text search engine, the abnormal log information to be processed is filtered through a distributed full-text retrieval system elastic search according to a preset filtering rule to obtain filtering information, wherein the preset filtering rule comprises identification, encryption and conversion of sensitive fields, empty fields, and preset packets and logs which are not needed, and the preset packets and logs which are not needed are as follows: the method comprises the steps that things which can be put in one log are put in a plurality of logs, a stack of useless stacks which are output, expected to occur and can be printed due to normal processing of abnormity, temporary logs which are added for developing and debugging convenience and the like are put in the logs, index creation is carried out on filtering information through a distributed full-text retrieval system Elasticissearch to obtain index data, a plurality of sub-tables with association relations and corresponding relations are created according to the index data, fragmentation processing of the index data is achieved, and therefore target abnormal log information is obtained.
In the embodiment of the invention, the system is programmed to the tangent plane to perform abnormity detection, reading and file writing on the system application log information applied by each system, so that the problems of long application starting time and low efficiency of obtaining the abnormal log information are solved, the accuracy and the efficiency of generating the abnormal log file are improved, the abnormal information in the abnormal log file is read and stored according to the preset time period through the log file acquisition system, and the abnormal log information to be processed is filtered, indexed and fragmented, so that the subsequent query and positioning are facilitated, the log collection performance and the application decoupling are improved, the distributed operations of collecting, analyzing and retrieving the abnormal log information are simplified and facilitated, and the processing efficiency of the distributed abnormal log information is improved.
Referring to fig. 2, another embodiment of the method for processing exception log information according to the embodiment of the present invention includes:
201. and sending an exception interception instruction to a preset section-oriented programming system, so that the section-oriented programming system performs exception detection, reading and file writing on system application log information applied by each system according to the exception interception instruction to obtain an exception log file.
Specifically, the server sends an exception interception instruction to a preset section-oriented programming system, so that the section-oriented programming system calls a pre-configured interceptor chain according to the exception interception instruction, and performs exception detection and exception information reading on system application log information applied by each system to obtain initial exception log information; classifying the types of the initial abnormal log information to obtain classified log information, and acquiring a target error log file corresponding to the classification type of the classified log information; and writing the initial abnormal log information into a target error log file according to a preset writing time interval to obtain an abnormal log file.
The server sends an abnormal interception instruction to a preset section-oriented programming system, so that the section-oriented programming system receives a target object which is sent by an event sender and processed based on system application log information according to the abnormal interception instruction, calls a pre-configured interceptor chain based on the triggering of the event object, performs abnormal detection and abnormal information reading on the system application log information applied by each system according to a preset execution sequence to obtain initial abnormal log information, and performs type classification on the initial abnormal log information according to abnormal types through a preset classifier or a classification network to obtain classification log information, wherein the classification network comprises but is not limited to a residual error network ResNext, a convolutional neural network inclusion V4, a compression and excitation network (SENET) and the like, and according to the classification type (namely abnormal type) of the classification log information, and retrieving the preset database, matching the corresponding target error log file from the preset database, writing the initial abnormal log information into the target error log file according to a preset writing time interval through a section-oriented programming frame to obtain an abnormal log file, facilitating the classification management of the initial abnormal log information and improving the efficiency of the classification management of the initial abnormal log information.
202. And sending a monitoring acquisition instruction to a preset log file acquisition system, so that the log file acquisition system reads and stores abnormal information in the abnormal log file according to the monitoring acquisition instruction and a preset time period to obtain candidate abnormal log information.
Specifically, the server sends a monitoring acquisition instruction to a preset log file acquisition system, so that the log file acquisition system reads abnormal information in an abnormal log file according to the monitoring acquisition instruction and a preset time period; acquiring historical reading position information and target position offset information of the abnormal log file, wherein the historical position is used for indicating the position offset information of the abnormal log file read before the starting time of the preset time period, and the target position offset information is used for indicating the position offset information read at the ending time of the preset time period; judging whether the historical reading position information is consistent with the target position offset information or not; and if the historical reading position information is inconsistent with the target position offset information, writing the abnormal information, the historical reading position information and the target position offset information into a registration file of a preset storage space to obtain candidate abnormal log information.
For example, the server sends a monitoring acquisition instruction to a preset log file acquisition system Filebeat, so that the log file acquisition system Filebeat calls a preset monitoring recording component according to the monitoring acquisition instruction, monitors the update time and write time of an abnormal log file in the face-to-face programming system according to a preset time interval in days to obtain an abnormal log file written and updated before the preset time interval, acquires the abnormal log file, and obtains historical read position information and target position offset information read by the abnormal log file, wherein the historical position is used for indicating the position offset information of the abnormal log file read before the start time of the preset time interval, the target position offset information is used for indicating the position offset information read at the end time of the preset time interval to prevent the abnormal log information from being read repeatedly, and calls a preset acquisition tool harveter, reading abnormal information written before a preset time interval in an abnormal log file, judging whether historical reading position information is consistent with target position offset information or not, if so, writing the historical reading position information and the target position offset information into a register file of a preset storage space to obtain stored abnormal log information, and if not, writing the abnormal information, the historical reading position information and the target position offset information into the register file of the preset storage space to obtain candidate abnormal log information.
203. And sending a monitoring and extracting instruction to a preset log management system based on a full-text search engine so that the log management system based on the full-text search engine can monitor and extract candidate abnormal log information in the log file acquisition system in real time according to the monitoring and extracting instruction to obtain abnormal log information to be processed.
Specifically, the server sends a monitoring extraction instruction to a preset full-text search engine-based log management system, so that the full-text search engine-based log management system monitors and analyzes increment, reading time and storage time of candidate abnormal log information in the log file acquisition system based on a preset monitoring mechanism according to the monitoring extraction instruction to obtain abnormal log information meeting preset monitoring conditions; and extracting the abnormal log information meeting the preset monitoring conditions from the log file acquisition system to a full-text search engine corresponding to a pre-configured cluster service address to obtain the abnormal log information to be processed.
For example, the increment includes the size of the file or space increment after the candidate abnormal log information is stored, the server sends a monitoring extraction instruction to the log management system based on the full-text search engine, so that the log management system based on the full-text search engine monitors the reading time, the storage time and the size of the reading content after the log file acquisition system reads the abnormal information in the abnormal log file and the size (increment) of the file or space increment after the candidate abnormal log information is stored according to a preset monitoring mechanism, and analyzes the reading time, the storage time, the size of the reading content and the increment according to preset monitoring conditions, so as to obtain the abnormal log information meeting the monitoring conditions, wherein the preset monitoring conditions include the time when the reading time and the storage time are within a preset time period, the size of the reading time and the increment, And reading the size of the content larger than the size before the monitoring moment and generating an increment, extracting the abnormal log information meeting the preset monitoring condition from a log file acquisition system based on a log management system of a full-text search engine, and storing the abnormal log information meeting the preset monitoring condition into the full-text search engine corresponding to a pre-configured cluster service address, thereby obtaining the abnormal log information to be processed.
204. And filtering, index creating and fragment processing are carried out on the abnormal log information to be processed to obtain target abnormal log information.
Specifically, the server performs information matching, information extraction and key word extraction on abnormal log information to be processed through a full-text search engine and a preset log key information decision tree to obtain filtered abnormal log information and target key words corresponding to the filtered abnormal log information; creating a cluster index according to the filtering abnormal log information and the target key words, and carrying out fragment processing on data in the cluster index to obtain fragment index data; and storing the fragment index data to a preset storage space according to a preset storage strategy to obtain target abnormal log information.
For example, after the server obtains the abnormal log information to be processed through a log management system based on a full-text search engine, the information matching and information extraction are carried out on the abnormal log information to be processed through the full-text search engine and a preset log key information decision tree to obtain extracted abnormal log information, sensitive information in the extracted abnormal log information is encrypted and converted to obtain filtered abnormal log information, key words of the filtered abnormal log information are extracted to obtain corresponding target key words, the log key information decision tree includes but is not limited to sensitive information, log field information related to service information, log information required by an abnormal log analysis rule and the like, a cluster index of the target key words and the filtered abnormal log information is established through the full-text search engine, data in the cluster index is subjected to fragmentation processing to obtain fragmented index data, the effect of ensuring the retrieval accuracy and improving the retrieval efficiency is achieved, wherein the preset storage strategy comprises the step of storing the fragment index data to the corresponding preset storage space (the resource occupation ratio is smaller) according to the resource occupation ratio of the preset storage space, and/or the step of storing the fragment index data to the preset storage space corresponding to the preset theme according to the theme of the cluster, so that the safety and the storage availability of the target abnormal log information are improved.
205. And receiving a retrieval instruction sent by a preset visual user interface, inquiring target abnormal log information and generating a report based on the retrieval instruction to obtain a statistical analysis report, and sending the statistical analysis report to the visual user interface.
For example, a user inputs abnormal log retrieval information in a preset visual user interface, the visual user interface can be set up through a log analysis platform Kibana, the visual user interface generates a retrieval instruction based on the abnormal log retrieval information and sends the retrieval instruction to a server, when the server receives the retrieval instruction sent by the visual user interface, the retrieval instruction is analyzed to obtain analysis information, a query language is generated according to the analysis information, the query language is used for querying target abnormal log information to obtain query information, the target retrieval information is subjected to statistical analysis and generates a report, a statistical analysis report is obtained, and the statistical analysis report is sent to the visual user interface to be rendered to the visual user interface. By inquiring and generating the report of the target abnormal log information, the statistical analysis report is obtained and sent to the visual user interface, so that the automatic retrieval, automatic analysis and display of the distributed abnormal log information are realized, the accuracy and efficiency of generating the statistical analysis report are improved, the processing efficiency of the distributed abnormal log information is improved, and the processing automation of the distributed abnormal log information is increased.
Specifically, the server receives a retrieval instruction sent by a preset visual user interface, and retrieves and filters target abnormal log information through a preset routing algorithm and a genetic algorithm based on the retrieval instruction to obtain target retrieval information; and performing statistical analysis on the target retrieval information to obtain statistical analysis information, generating a statistical analysis report according to the statistical analysis information, and sending the statistical analysis report to a visual user interface.
For example, when a server receives a retrieval instruction sent by a preset visual user interface, a preset routing algorithm is called based on the retrieval instruction, path selection analysis and log information reading are carried out on target abnormal log information, so that initial retrieval information is obtained, initial population generation, fitness calculation and iterative intersection and variation processing are sequentially carried out on the initial retrieval information through a preset genetic algorithm, so that target retrieval information is obtained, a preset statistical analysis tool is called to carry out statistical analysis on the target retrieval tool according to business requirements, a statistical analysis report is generated, the statistical analysis report is sent to the visual user interface, and the statistical analysis report is rendered on the visual user interface.
In the embodiment of the invention, the problems of long starting time and low efficiency of acquiring the abnormal log information are solved, the accuracy and the efficiency of generating the abnormal log file are improved, the subsequent query and positioning are convenient, the log collection performance and the application decoupling are improved, the distributed operations of acquiring, analyzing and retrieving the abnormal log information are simplified and facilitated, thereby improving the processing efficiency of the distributed abnormal log information, obtaining a statistical analysis report by inquiring the target abnormal log information and generating the report, and sends the statistical analysis report to the visual user interface, thereby realizing automatic retrieval, automatic analysis and display of distributed abnormal log information, improving the accuracy and efficiency of generating the statistical analysis report, therefore, the processing efficiency of the distributed abnormal log information is improved, and the processing automation of the distributed abnormal log information is increased.
With reference to fig. 3, the method for processing abnormal log information in the embodiment of the present invention is described above, and a processing apparatus for abnormal log information in the embodiment of the present invention is described below, where an embodiment of the processing apparatus for abnormal log information in the embodiment of the present invention includes:
the exception intercepting module 301 is configured to send an exception intercepting instruction to a preset section-oriented programming system, so that the section-oriented programming system performs exception detection, reading and file writing on system application log information applied by each system according to the exception intercepting instruction to obtain an exception log file;
the monitoring acquisition module 302 is configured to send a monitoring acquisition instruction to a preset log file acquisition system, so that the log file acquisition system reads and stores abnormal information in an abnormal log file according to the monitoring acquisition instruction and according to a preset time period to obtain candidate abnormal log information;
the monitoring extraction module 303 is configured to send a monitoring extraction instruction to a preset full-text search engine-based log management system, so that the full-text search engine-based log management system monitors and extracts candidate abnormal log information in the log file acquisition system in real time according to the monitoring extraction instruction to obtain abnormal log information to be processed;
and the exception handling module 304 is configured to filter, index create, and fragment the exception log information to be handled to obtain target exception log information.
The function implementation of each module in the processing apparatus for abnormal log information corresponds to each step in the processing method embodiment for abnormal log information, and the function and implementation process thereof are not described in detail herein.
In the embodiment of the invention, the system is programmed to the tangent plane to perform abnormity detection, reading and file writing on the system application log information applied by each system, so that the problems of long application starting time and low efficiency of obtaining the abnormal log information are solved, the accuracy and the efficiency of generating the abnormal log file are improved, the abnormal information in the abnormal log file is read and stored according to the preset time period through the log file acquisition system, and the abnormal log information to be processed is filtered, indexed and fragmented, so that the subsequent query and positioning are facilitated, the log collection performance and the application decoupling are improved, the distributed operations of collecting, analyzing and retrieving the abnormal log information are simplified and facilitated, and the processing efficiency of the distributed abnormal log information is improved.
Referring to fig. 4, another embodiment of the apparatus for processing exception log information according to the embodiment of the present invention includes:
the exception intercepting module 301 is configured to send an exception intercepting instruction to a preset section-oriented programming system, so that the section-oriented programming system performs exception detection, reading and file writing on system application log information applied by each system according to the exception intercepting instruction to obtain an exception log file;
the monitoring acquisition module 302 is configured to send a monitoring acquisition instruction to a preset log file acquisition system, so that the log file acquisition system reads and stores abnormal information in an abnormal log file according to the monitoring acquisition instruction and according to a preset time period to obtain candidate abnormal log information;
the monitoring extraction module 303 is configured to send a monitoring extraction instruction to a preset full-text search engine-based log management system, so that the full-text search engine-based log management system monitors and extracts candidate abnormal log information in the log file acquisition system in real time according to the monitoring extraction instruction to obtain abnormal log information to be processed;
the exception handling module 304 is configured to filter, index create, and fragment the exception log information to be handled to obtain target exception log information;
the generation and sending module 305 is configured to receive a retrieval instruction sent by a preset visual user interface, perform query and report generation on target abnormal log information based on the retrieval instruction, obtain a statistical analysis report, and send the statistical analysis report to the visual user interface.
Optionally, the exception intercepting module 301 may be further specifically configured to:
sending an exception interception instruction to a preset section-oriented programming system, so that the section-oriented programming system calls a pre-configured interceptor chain according to the exception interception instruction, and performs exception detection and exception information reading on system application log information applied by each system to obtain initial exception log information;
classifying the types of the initial abnormal log information to obtain classified log information, and acquiring a target error log file corresponding to the classification type of the classified log information;
and writing the initial abnormal log information into a target error log file according to a preset writing time interval to obtain an abnormal log file.
Optionally, the monitoring extraction module 303 may be further specifically configured to:
sending a monitoring extraction instruction to a preset log management system based on a full-text search engine, so that the log management system based on the full-text search engine monitors and analyzes increment, reading time and storage time of candidate abnormal log information in a log file acquisition system according to the monitoring extraction instruction and based on a preset monitoring mechanism to obtain abnormal log information meeting preset monitoring conditions;
and extracting the abnormal log information meeting the preset monitoring conditions from the log file acquisition system to a full-text search engine corresponding to a pre-configured cluster service address to obtain the abnormal log information to be processed.
Optionally, the exception handling module 304 may be further specifically configured to:
performing information matching, information extraction and key word extraction on abnormal log information to be processed through a full-text search engine and a preset log key information decision tree to obtain filtered abnormal log information and target key words corresponding to the filtered abnormal log information;
creating a cluster index according to the filtering abnormal log information and the target key words, and carrying out fragment processing on data in the cluster index to obtain fragment index data;
and storing the fragment index data to a preset storage space according to a preset storage strategy to obtain target abnormal log information.
Optionally, the monitoring and collecting module 302 may be further specifically configured to:
sending a monitoring acquisition instruction to a preset log file acquisition system so that the log file acquisition system reads abnormal information in an abnormal log file according to the monitoring acquisition instruction and a preset time period;
acquiring historical reading position information and target position offset information of the abnormal log file, wherein the historical position is used for indicating the position offset information of the abnormal log file read before the starting time of the preset time period, and the target position offset information is used for indicating the position offset information read at the ending time of the preset time period;
judging whether the historical reading position information is consistent with the target position offset information or not;
and if the historical reading position information is inconsistent with the target position offset information, writing the abnormal information, the historical reading position information and the target position offset information into a registration file of a preset storage space to obtain candidate abnormal log information.
Optionally, the generating and sending module 305 may be further specifically configured to:
receiving a retrieval instruction sent by a preset visual user interface, retrieving and filtering target abnormal log information through a preset routing algorithm and a genetic algorithm based on the retrieval instruction, and obtaining target retrieval information;
and performing statistical analysis on the target retrieval information to obtain statistical analysis information, generating a statistical analysis report according to the statistical analysis information, and sending the statistical analysis report to a visual user interface.
The function implementation of each module and each unit in the processing device of the abnormal log information corresponds to each step in the processing method embodiment of the abnormal log information, and the function and implementation process are not described in detail herein.
In the embodiment of the invention, the problems of long starting time and low efficiency of acquiring the abnormal log information are solved, the accuracy and the efficiency of generating the abnormal log file are improved, the subsequent query and positioning are convenient, the log collection performance and the application decoupling are improved, the distributed operations of acquiring, analyzing and retrieving the abnormal log information are simplified and facilitated, thereby improving the processing efficiency of the distributed abnormal log information, obtaining a statistical analysis report by inquiring the target abnormal log information and generating the report, and sends the statistical analysis report to the visual user interface, thereby realizing automatic retrieval, automatic analysis and display of distributed abnormal log information, improving the accuracy and efficiency of generating the statistical analysis report, therefore, the processing efficiency of the distributed abnormal log information is improved, and the processing automation of the distributed abnormal log information is increased.
Fig. 3 and fig. 4 above describe the processing apparatus of the exception log information in the embodiment of the present invention in detail from the perspective of the modular functional entity, and the following describes the processing apparatus of the exception log information in the embodiment of the present invention in detail from the perspective of hardware processing.
Fig. 5 is a schematic structural diagram of an exception log information processing apparatus 500 according to an embodiment of the present invention, which may generate a relatively large difference due to different configurations or performances, and may include one or more processors (CPUs) 510 (e.g., one or more processors) and a memory 520, and one or more storage media 530 (e.g., one or more mass storage devices) for storing applications 533 or data 532. Memory 520 and storage media 530 may be, among other things, transient or persistent storage. The program stored on the storage medium 530 may include one or more modules (not shown), each of which may include a series of instruction operations in the processing device 500 for exception log information. Still further, the processor 510 may be configured to communicate with the storage medium 530, and execute a series of instruction operations in the storage medium 530 on the processing device 500 of the exception log information.
The exception log information processing apparatus 500 may also include one or more power supplies 540, one or more wired or wireless network interfaces 550, one or more input-output interfaces 560, and/or one or more operating systems 531, such as Windows Server, Mac OS X, Unix, Linux, FreeBSD, and the like. It will be understood by those skilled in the art that the configuration of the apparatus for processing the abnormality log information shown in fig. 5 does not constitute a limitation to the apparatus for processing the abnormality log information, and may include more or less components than those shown, or some components may be combined, or a different arrangement of components may be provided.
The present invention also provides a computer-readable storage medium, which may be a non-volatile computer-readable storage medium, and which may also be a volatile computer-readable storage medium, having stored therein instructions, which, when executed on a computer, cause the computer to perform the steps of the method for processing the abnormality log information.
Further, the computer-readable storage medium may mainly include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program required for at least one function, and the like; the storage data area may store data created according to the use of the blockchain node, and the like.
The block chain is a novel application mode of computer technologies such as distributed data storage, point-to-point transmission, a consensus mechanism, an encryption algorithm and the like. A block chain (Blockchain), which is essentially a decentralized database, is a series of data blocks associated by using a cryptographic method, and each data block contains information of a batch of network transactions, so as to verify the validity (anti-counterfeiting) of the information and generate a next block. The blockchain may include a blockchain underlying platform, a platform product service layer, an application service layer, and the like.
It is clear to those skilled in the art that, for convenience and brevity of description, the specific working processes of the above-described systems, apparatuses and units may refer to the corresponding processes in the foregoing method embodiments, and are not described herein again.
The integrated unit, if implemented in the form of a software functional unit and sold or used as a stand-alone product, may be stored in a computer readable storage medium. Based on such understanding, the technical solution of the present invention may be embodied in the form of a software product, which is stored in a storage medium and includes instructions for causing a computer device (which may be a personal computer, a server, or a network device) to execute all or part of the steps of the method according to the embodiments of the present invention. And the aforementioned storage medium includes: various media capable of storing program codes, such as a usb disk, a removable hard disk, a read-only memory (ROM), a Random Access Memory (RAM), a magnetic disk, or an optical disk.
The above embodiments are only used to illustrate the technical solution of the present invention, and not to limit the same; although the present invention has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical solutions described in the foregoing embodiments may still be modified, or some technical features may be equivalently replaced; and such modifications or substitutions do not depart from the spirit and scope of the corresponding technical solutions of the embodiments of the present invention.
Claims (10)
1. A processing method of abnormal log information is characterized in that the processing method of the abnormal log information comprises the following steps:
sending an abnormal interception instruction to a preset section-oriented programming system, so that the section-oriented programming system performs abnormal detection, reading and file writing on system application log information applied by each system according to the abnormal interception instruction to obtain an abnormal log file;
sending a monitoring acquisition instruction to a preset log file acquisition system, so that the log file acquisition system reads and stores abnormal information in the abnormal log file according to the monitoring acquisition instruction and a preset time period to obtain candidate abnormal log information;
sending a monitoring and extracting instruction to a preset log management system based on a full-text search engine, so that the log management system based on the full-text search engine carries out real-time monitoring and extraction on candidate abnormal log information in the log file acquisition system according to the monitoring and extracting instruction to obtain abnormal log information to be processed;
and filtering, index creating and fragment processing are carried out on the abnormal log information to be processed to obtain target abnormal log information.
2. The method for processing the exception log information according to claim 1, wherein the sending of the exception intercepting instruction to a preset section-oriented programming system so that the section-oriented programming system performs exception detection, reading, and file writing on the system application log information applied by each system according to the exception intercepting instruction to obtain an exception log file comprises:
sending an abnormal interception instruction to a preset section-oriented programming system, so that the section-oriented programming system calls a pre-configured interceptor chain according to the abnormal interception instruction, and performs abnormal detection and abnormal information reading on system application log information applied by each system to obtain initial abnormal log information;
classifying the types of the initial abnormal log information to obtain classified log information, and acquiring a target error log file corresponding to the classification type of the classified log information;
and writing the initial abnormal log information into the target error log file according to a preset writing time interval to obtain an abnormal log file.
3. The method for processing abnormal log information according to claim 1, wherein the sending of the monitoring and extracting instruction to a preset log management system based on a full-text search engine is performed, so that the log management system based on the full-text search engine performs real-time monitoring and extraction on candidate abnormal log information in the log file collection system according to the monitoring and extracting instruction to obtain abnormal log information to be processed, and the method includes:
sending a monitoring extraction instruction to a preset full-text search engine-based log management system, so that the full-text search engine-based log management system monitors and analyzes increment, reading time and storage time of candidate abnormal log information in the log file acquisition system based on a preset monitoring mechanism according to the monitoring extraction instruction to obtain abnormal log information meeting preset monitoring conditions;
and extracting the abnormal log information meeting the preset monitoring conditions from the log file acquisition system to a full-text search engine corresponding to a pre-configured cluster service address to obtain the abnormal log information to be processed.
4. The method for processing the abnormal log information according to claim 3, wherein the filtering, index creating and fragment processing the abnormal log information to be processed to obtain the target abnormal log information includes:
performing information matching, information extraction and key word extraction on the abnormal log information to be processed through the full-text search engine and a preset log key information decision tree to obtain filtered abnormal log information and a target key word corresponding to the filtered abnormal log information;
creating a cluster index according to the filtering abnormal log information and the target key words, and carrying out fragment processing on data in the cluster index to obtain fragment index data;
and storing the fragment index data to a preset storage space according to a preset storage strategy to obtain target abnormal log information.
5. The method for processing the abnormal log information according to claim 1, wherein the sending of the monitoring acquisition instruction to a preset log file acquisition system so that the log file acquisition system reads and stores the abnormal information in the abnormal log file according to the monitoring acquisition instruction and according to a preset time period to obtain candidate abnormal log information comprises:
sending a monitoring acquisition instruction to a preset log file acquisition system so that the log file acquisition system reads abnormal information in the abnormal log file according to the monitoring acquisition instruction and a preset time period;
acquiring historical reading position information and target position offset information of the abnormal log file, wherein the historical position is used for indicating the position offset information of the abnormal log file read before the starting time of the preset time period, and the target position offset information is used for indicating the position offset information read at the ending time of the preset time period;
judging whether the historical reading position information is consistent with the target position offset information or not;
and if the historical reading position information is inconsistent with the target position offset information, writing the abnormal information, the historical reading position information and the target position offset information into a registration file of a preset storage space to obtain candidate abnormal log information.
6. The method for processing exception log information according to any one of claims 1 to 5, wherein after filtering, index creating, and slicing the exception log information to be processed to obtain target exception log information, the method further comprises:
receiving a retrieval instruction sent by a preset visual user interface, inquiring the target abnormal log information and generating a report based on the retrieval instruction to obtain a statistical analysis report, and sending the statistical analysis report to the visual user interface.
7. The method for processing the abnormal log information according to claim 6, wherein the receiving a retrieval instruction sent by a preset visual user interface, querying the target abnormal log information and generating a statistical analysis report based on the retrieval instruction, and sending the statistical analysis report to the visual user interface comprises:
receiving a retrieval instruction sent by a preset visual user interface, and retrieving and filtering the target abnormal log information through a preset routing algorithm and a genetic algorithm based on the retrieval instruction to obtain target retrieval information;
and performing statistical analysis on the target retrieval information to obtain statistical analysis information, generating a statistical analysis report according to the statistical analysis information, and sending the statistical analysis report to the visual user interface.
8. An apparatus for processing exception log information, the apparatus comprising:
the system comprises an exception interception module, a section-oriented programming system and an exception processing module, wherein the exception interception module is used for sending an exception interception instruction to the preset section-oriented programming system so that the section-oriented programming system performs exception detection, reading and file writing on system application log information applied by each system according to the exception interception instruction to obtain an exception log file;
the monitoring acquisition module is used for sending a monitoring acquisition instruction to a preset log file acquisition system so that the log file acquisition system reads and stores abnormal information in the abnormal log file according to the monitoring acquisition instruction and a preset time interval to obtain candidate abnormal log information;
the monitoring extraction module is used for sending a monitoring extraction instruction to a preset full-text search engine-based log management system so that the full-text search engine-based log management system can monitor and extract candidate abnormal log information in the log file acquisition system in real time according to the monitoring extraction instruction to obtain abnormal log information to be processed;
and the exception handling module is used for filtering, index creating and fragment processing the exception log information to be processed to obtain target exception log information.
9. An apparatus for processing abnormality log information, characterized by comprising: a memory and at least one processor, the memory having instructions stored therein;
the at least one processor calls the instruction in the memory to cause the processing device of the exception log information to execute the processing method of the exception log information according to any one of claims 1 to 7.
10. A computer-readable storage medium having instructions stored thereon, wherein the instructions, when executed by a processor, implement a method for processing exception log information according to any one of claims 1 to 7.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011611184.7A CN112711520A (en) | 2020-12-30 | 2020-12-30 | Method, device and equipment for processing abnormal log information and storage medium |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202011611184.7A CN112711520A (en) | 2020-12-30 | 2020-12-30 | Method, device and equipment for processing abnormal log information and storage medium |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN112711520A true CN112711520A (en) | 2021-04-27 |
Family
ID=75547217
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202011611184.7A Pending CN112711520A (en) | 2020-12-30 | 2020-12-30 | Method, device and equipment for processing abnormal log information and storage medium |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN112711520A (en) |
Cited By (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113220540A (en) * | 2021-06-07 | 2021-08-06 | 深圳华锐金融技术股份有限公司 | Service management method, device, computer equipment and storage medium |
| CN113792820A (en) * | 2021-11-15 | 2021-12-14 | 航天宏康智能科技(北京)有限公司 | Countermeasure training method and device for user behavior log anomaly detection model |
| CN113792019A (en) * | 2021-08-03 | 2021-12-14 | RealMe重庆移动通信有限公司 | Analysis method, electronic device and computer storage medium |
| CN114490779A (en) * | 2022-02-21 | 2022-05-13 | 中航信移动科技有限公司 | Server |
| CN116366308A (en) * | 2023-03-10 | 2023-06-30 | 广东堡塔安全技术有限公司 | Cloud computing-based server security monitoring system |
-
2020
- 2020-12-30 CN CN202011611184.7A patent/CN112711520A/en active Pending
Cited By (8)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN113220540A (en) * | 2021-06-07 | 2021-08-06 | 深圳华锐金融技术股份有限公司 | Service management method, device, computer equipment and storage medium |
| CN113220540B (en) * | 2021-06-07 | 2023-04-25 | 深圳华锐分布式技术股份有限公司 | Service management method, device, computer equipment and storage medium |
| CN113792019A (en) * | 2021-08-03 | 2021-12-14 | RealMe重庆移动通信有限公司 | Analysis method, electronic device and computer storage medium |
| CN113792019B (en) * | 2021-08-03 | 2023-08-18 | RealMe重庆移动通信有限公司 | Analysis method, electronic equipment and computer storage medium |
| CN113792820A (en) * | 2021-11-15 | 2021-12-14 | 航天宏康智能科技(北京)有限公司 | Countermeasure training method and device for user behavior log anomaly detection model |
| CN114490779A (en) * | 2022-02-21 | 2022-05-13 | 中航信移动科技有限公司 | Server |
| CN116366308A (en) * | 2023-03-10 | 2023-06-30 | 广东堡塔安全技术有限公司 | Cloud computing-based server security monitoring system |
| CN116366308B (en) * | 2023-03-10 | 2023-11-03 | 广东堡塔安全技术有限公司 | Cloud computing-based server security monitoring system |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN112711520A (en) | Method, device and equipment for processing abnormal log information and storage medium | |
| US7421621B1 (en) | Application integration testing | |
| CN109240886B (en) | Exception handling method, exception handling device, computer equipment and storage medium | |
| JP4318643B2 (en) | Operation management method, operation management apparatus, and operation management program | |
| CN107123047B (en) | Data acquisition system based on bond transaction and data acquisition method thereof | |
| US8799923B2 (en) | Determining relationship data associated with application programs | |
| JP5353540B2 (en) | Operation history collection device, operation history collection method, and program | |
| CN104067281A (en) | Clustering event data by multiple time dimensions | |
| CN111046011A (en) | Log collection method, system, node, electronic device and readable storage medium | |
| CN110764980A (en) | Log processing method and device | |
| CN110932918A (en) | Log data acquisition method and device and storage medium | |
| CN111274218A (en) | Multi-source log data processing method for power information system | |
| CN113791586A (en) | Novel industrial APP and identification registration analysis integration method | |
| CN112528279A (en) | Method and device for establishing intrusion detection model | |
| CN110245059B (en) | Data processing method, device and storage medium | |
| CN113626241B (en) | Abnormality processing method, device, equipment and storage medium for application program | |
| CN112068981B (en) | Knowledge base-based fault scanning recovery method and system in Linux operating system | |
| Harding et al. | Sequence-RTG: efficient and production-ready pattern mining in system log messages | |
| CN113704203A (en) | Log file processing method and device | |
| CN110011845B (en) | Log collection method and system | |
| US11822578B2 (en) | Matching machine generated data entries to pattern clusters | |
| CN112765010A (en) | Method, device, equipment and storage medium for centralized management of service parameters | |
| CN113138906A (en) | Call chain data acquisition method, device, equipment and storage medium | |
| CN111858658A (en) | Data acquisition method, device, equipment and storage medium | |
| CN116846863B (en) | Memory mapping method and device for optical fiber reflection memory network and computing equipment |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |