CN113064807A - Log diagnosis method and device - Google Patents
Log diagnosis method and device Download PDFInfo
- Publication number
- CN113064807A CN113064807A CN202110434454.XA CN202110434454A CN113064807A CN 113064807 A CN113064807 A CN 113064807A CN 202110434454 A CN202110434454 A CN 202110434454A CN 113064807 A CN113064807 A CN 113064807A
- Authority
- CN
- China
- Prior art keywords
- log
- diagnosis
- log file
- time
- diagnostic
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Pending
Links
- 238000003745 diagnosis Methods 0.000 title claims abstract description 185
- 238000000034 method Methods 0.000 title claims abstract description 40
- 230000015654 memory Effects 0.000 claims description 29
- 238000004590 computer program Methods 0.000 claims description 12
- 230000014509 gene expression Effects 0.000 claims description 12
- 230000002159 abnormal effect Effects 0.000 claims description 9
- 238000002405 diagnostic procedure Methods 0.000 claims description 6
- 230000000694 effects Effects 0.000 abstract description 3
- 238000004519 manufacturing process Methods 0.000 abstract description 3
- 238000010586 diagram Methods 0.000 description 6
- 238000004458 analytical method Methods 0.000 description 4
- 230000008569 process Effects 0.000 description 4
- 238000012423 maintenance Methods 0.000 description 3
- 238000012545 processing Methods 0.000 description 3
- 238000012216 screening Methods 0.000 description 3
- 238000004891 communication Methods 0.000 description 2
- 230000006870 function Effects 0.000 description 2
- 230000003993 interaction Effects 0.000 description 2
- 238000012986 modification Methods 0.000 description 2
- 230000004048 modification Effects 0.000 description 2
- 230000003287 optical effect Effects 0.000 description 2
- 239000007787 solid Substances 0.000 description 2
- 230000005856 abnormality Effects 0.000 description 1
- 238000003491 array Methods 0.000 description 1
- 230000009286 beneficial effect Effects 0.000 description 1
- 230000006872 improvement Effects 0.000 description 1
- 238000010295 mobile communication Methods 0.000 description 1
- 238000007781 pre-processing Methods 0.000 description 1
- 238000012795 verification Methods 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F11/00—Error detection; Error correction; Monitoring
- G06F11/30—Monitoring
- G06F11/34—Recording or statistical evaluation of computer activity, e.g. of down time, of input/output operation ; Recording or statistical evaluation of user activity, e.g. usability assessment
- G06F11/3466—Performance evaluation by tracing or monitoring
- G06F11/3476—Data logging
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/10—File systems; File servers
- G06F16/14—Details of searching files based on file metadata
- G06F16/148—File search processing
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/10—File systems; File servers
- G06F16/18—File system types
- G06F16/1805—Append-only file systems, e.g. using logs or journals to store data
- G06F16/1815—Journaling file systems
Abstract
The invention discloses a log diagnosis method and a log diagnosis device, which can be used in the financial field or other technical fields, and the method comprises the following steps: acquiring log diagnosis configuration information set by a user, wherein the log diagnosis configuration information comprises: log file path, diagnostic time range, and diagnostic rules; acquiring a log file under the log file path, and storing the acquired log file to the local; determining a log file corresponding to the diagnosis time range from locally stored log files; and diagnosing the log file corresponding to the diagnosis time range according to the diagnosis rule to obtain a diagnosis result. The invention realizes the effect of flexibly diagnosing and solving the log files in the preset time period, realizes the flexible and effective problem diagnosis capability and effectively improves the efficiency of problem positioning in production emergency.
Description
Technical Field
The invention relates to the technical field of log diagnosis, in particular to a log diagnosis method and device.
Background
In the software industry, log files have very important values for problem analysis and positioning. For many traditional applications at present, log file analysis depends on a text editing tool, log file content is analyzed for traditional log file keyword diagnosis, the log file content is matched according to keywords, if the log file content is consistent with expectations, diagnosis is considered to be successful, and otherwise diagnosis is considered to be failed. The prior art scheme is simple, lacks the commonality, does not support to the log analysis in a certain time period, can't satisfy the application to the time interval log diagnosis demand after the input.
Disclosure of Invention
The present invention provides a log diagnosis method and apparatus to solve the technical problems in the background art.
In order to achieve the above object, according to an aspect of the present invention, there is provided a log diagnosis method including:
acquiring log diagnosis configuration information set by a user, wherein the log diagnosis configuration information comprises: log file path, diagnostic time range, and diagnostic rules;
acquiring a log file under the log file path, and storing the acquired log file to the local;
determining a log file corresponding to the diagnosis time range from locally stored log files;
and diagnosing the log file corresponding to the diagnosis time range according to the diagnosis rule to obtain a diagnosis result.
Optionally, the diagnosis time range includes a diagnosis start time and a diagnosis end time;
the determining, from the locally stored log files, the log file corresponding to the diagnosis time range specifically includes:
acquiring the log time of each log file stored locally;
respectively inquiring log files with log time closest to the diagnosis starting time and the diagnosis ending time;
and determining all log files with the log time within the log time of the two queried log files.
Optionally, the diagnostic rule includes: keywords or regular expressions for diagnostics and expected number of matches;
the diagnosing the log file corresponding to the diagnosis time range according to the diagnosis rule specifically includes:
and matching the log content of the log file corresponding to the diagnosis time range with the keywords or the regular expression, determining that the diagnosis result is abnormal if the matching times reach the expected matching number, and determining that the diagnosis result is normal if the matching times do not reach the expected matching number.
Optionally, after the storing the obtained log file locally, the method further includes:
and acquiring a file encoding format of the log file, and converting the log content of the log file into a file byte stream according to the file encoding format.
Optionally, the diagnosing the log file corresponding to the diagnosis time range according to the diagnosis rule specifically includes:
loading the log file corresponding to the diagnosis time range into a local memory;
converting the log content of the log file in the local memory into a file byte stream according to the file encoding format of the log file;
and diagnosing the log file in the local memory according to the diagnosis rule.
Optionally, the log diagnosis configuration information further includes: an early warning notification address;
the log diagnosis method further comprises the following steps:
and if the diagnosis result is that the diagnosis is abnormal, sending early warning information to the early warning notification address.
In order to achieve the above object, according to another aspect of the present invention, there is provided a log diagnosis apparatus including:
the log diagnosis configuration information acquisition module is used for acquiring log diagnosis configuration information set by a user, wherein the log diagnosis configuration information comprises: log file path, diagnostic time range, and diagnostic rules;
the log file acquisition module is used for acquiring the log file under the log file path and storing the acquired log file to the local;
the corresponding log file determining module is used for determining a log file corresponding to the diagnosis time range from locally stored log files;
and the log diagnosis module is used for diagnosing the log file corresponding to the diagnosis time range according to the diagnosis rule to obtain a diagnosis result.
Optionally, the diagnosis time range includes a diagnosis start time and a diagnosis end time;
the corresponding log file determination module specifically includes:
a log time acquiring unit for acquiring the log time of each log file stored locally;
the query unit is used for respectively querying the log files with the log time closest to the diagnosis starting time and the diagnosis ending time;
and the determining unit is used for determining all log files with the log time within the log time of the two queried log files.
Optionally, the diagnostic rule includes: keywords or regular expressions for diagnostics and expected number of matches;
the log diagnosis module is specifically configured to match log contents of the log file corresponding to the diagnosis time range with the keywords or the regular expression, determine that the diagnosis result is abnormal if the number of matching times reaches the expected number of matching times, and determine that the diagnosis result is normal if the number of matching times does not reach the expected number of matching times.
In order to achieve the above object, according to another aspect of the present invention, there is also provided a computer device including a memory, a processor, and a computer program stored on the memory and executable on the processor, the processor implementing the steps in the log diagnosis method when executing the computer program.
In order to achieve the above object, according to another aspect of the present invention, there is also provided a computer-readable storage medium storing a computer program which, when executed in a computer processor, implements the steps in the log diagnosis method described above.
The invention has the beneficial effects that: according to the embodiment of the invention, the log file under the log file path is obtained, the obtained log file is stored locally, the log file corresponding to the diagnosis time range is determined from the locally stored log file, and finally the log file corresponding to the diagnosis time range is diagnosed according to the diagnosis rule to obtain the diagnosis result, so that the effect of flexibly diagnosing and solving the log file in the preset time period is realized, the flexible and effective problem diagnosis capability is realized, and the efficiency of problem positioning in production emergency is effectively improved.
Drawings
In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below, and it is obvious that the drawings in the following description are some embodiments of the present invention, and for those skilled in the art, other drawings can be obtained according to these drawings without creative efforts. In the drawings:
FIG. 1 is a flow chart of a log diagnostic method according to an embodiment of the invention;
FIG. 2 is a flow diagram of determining a log file corresponding to a diagnostic time range according to an embodiment of the present invention;
FIG. 3 is a flow chart of log file diagnostics according to diagnostic rules in accordance with an embodiment of the present invention;
FIG. 4 is a block diagram of a log diagnosis apparatus according to an embodiment of the present invention;
FIG. 5 is a schematic diagram of a log file determination module according to an embodiment of the present invention;
FIG. 6 is a schematic diagram of a computer device according to an embodiment of the present invention.
Detailed Description
In order to make the technical solutions of the present invention better understood, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the drawings in the embodiments of the present invention, and it is obvious that the described embodiments are only a part of the embodiments of the present invention, and not all of the embodiments. All other embodiments, which can be derived by a person skilled in the art from the embodiments given herein without making any creative effort, shall fall within the protection scope of the present invention.
As will be appreciated by one skilled in the art, embodiments of the present invention may be provided as a method, system, or computer program product. Accordingly, the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment or an embodiment combining software and hardware aspects. Furthermore, the present invention may take the form of a computer program product embodied on one or more computer-usable storage media (including, but not limited to, disk storage, CD-ROM, optical storage, and the like) having computer-usable program code embodied therein.
It should be noted that the terms "comprises" and "comprising," and any variations thereof, in the description and claims of the present invention and the above-described drawings, are intended to cover a non-exclusive inclusion, such that a process, method, system, article, or apparatus that comprises a list of steps or elements is not necessarily limited to those steps or elements expressly listed, but may include other steps or elements not expressly listed or inherent to such process, method, article, or apparatus.
It should be noted that the embodiments and features of the embodiments may be combined with each other without conflict. The present invention will be described in detail below with reference to the embodiments with reference to the attached drawings.
The invention provides a log diagnosis method, which aims to solve the problem analysis and positioning requirements of the traditional application through log files, support the real-time diagnosis of log contents according to a time range, and improve the automatic operation and maintenance level and the problem diagnosis capability. According to the invention, the server log file is automatically acquired and analyzed, logs in a predefined time range are screened out, diagnosis is carried out according to a predefined strategy, and the diagnosed problems are timely reported to an alarm, so that flexible and effective problem diagnosis capability is realized, and the problem positioning efficiency in production emergency is effectively improved.
Fig. 1 is a flowchart of a log diagnosis method according to an embodiment of the present invention, and as shown in fig. 1, the log diagnosis method according to the present invention includes steps S101 to S104.
Step S101, obtaining log diagnosis configuration information set by a user, wherein the log diagnosis configuration information comprises: log file path, diagnostic time range, and diagnostic rules.
In an embodiment of the present invention, the log diagnosis configuration information specifically includes: server information of the log file, log file path, diagnosis time range, log time format, diagnosis rule, early warning notification address information and the like. In an embodiment of the present invention, a user may input the log diagnosis configuration information in a foreground interaction device, and perform operations such as adding, deleting, modifying, checking, and the like on the log diagnosis configuration information.
And step S102, acquiring the log file under the log file path, and storing the acquired log file to the local.
In an embodiment of the invention, the invention can use an ansable operation and maintenance tool to establish connection with a plurality of servers through ssh password-free login, further obtain the log file under the designated log file path according to the server information and the log file path of the log file in the log diagnosis configuration information, and then store the log file to the local.
In one embodiment of the invention, storing locally may refer to storing in a local server or database.
Step S103, determining a log file corresponding to the diagnosis time range from the locally stored log files.
In the embodiment of the invention, the locally stored log files are screened according to the preset diagnosis time range, and the log files corresponding to the diagnosis time range, namely the log files to be diagnosed, are screened out. The method comprises the steps of obtaining a diagnosis time range, wherein the diagnosis time range comprises diagnosis starting time and diagnosis ending time, each log file corresponds to one log time, and the step is carried out screening according to the log time of each log file.
And step S104, diagnosing the log file corresponding to the diagnosis time range according to the diagnosis rule to obtain a diagnosis result.
In one embodiment of the invention, the diagnostic rules include: keywords or regular expressions for diagnostics and expected number of matches.
In an embodiment of the present invention, the diagnosing, according to the diagnostic rule, the log file corresponding to the diagnostic time range in step S104 specifically includes:
and matching the log content of the log file corresponding to the diagnosis time range with the keywords or the regular expression, determining that the diagnosis result is abnormal if the matching times reach the expected matching number, and determining that the diagnosis result is normal if the matching times do not reach the expected matching number.
Fig. 2 is a flowchart of determining a log file corresponding to a diagnosis time range according to an embodiment of the present invention, and as shown in fig. 2, in an embodiment of the present invention, the determining, in step S103, a log file corresponding to the diagnosis time range from a locally stored log file specifically includes steps S201 to S203.
Step S201, acquiring the log time of each log file stored locally.
Step S202, respectively inquiring the log file with the log time closest to the diagnosis starting time and the diagnosis ending time.
In step S203, all log files with log time within the log time of the two queried log files are determined.
The invention screens the log files according to the diagnosis start/end time and the log time format set by the user. When the log time is discontinuous and the diagnosis start/end time is not matched, the invention can acquire the time point of the log time closest to the diagnosis start/end time in the log as the start/end time of the log content screening. Finally, the log content from the start time to the end time of the log is screened out as a diagnosis object through a command.
In one embodiment of the invention, if the log diagnostic start/end times do not match in the log file (log content may not be continuous), then the matches are removed from the date, hour, minute, and second steps. And if the time points of a certain level are not matched, acquiring all matched time points according to the time points of the previous level, and then taking the time point closest to the diagnosis start/end time of the current log as the start and end time points of log screening. The algorithm eventually calculates the most accurate log diagnostic start and end times that match back in the log.
In an embodiment of the present invention, after the step S102 stores the acquired log file locally, the method of the present invention further includes: and acquiring a file encoding format of the log file, and converting the log content of the log file into a file byte stream according to the file encoding format.
In the embodiment of the present invention, after the log file is stored locally, the log file needs to be preprocessed. Specifically, the log file is analyzed through initialization, information such as the file encoding format of the log file, the size of the log file and the like is obtained, the limit is given to the log file when the log file is overlarge, and the influence on the system performance is avoided. The log content is then converted to a file byte stream in a file encoding format (which may be GBK or UTF-8).
Fig. 3 is a flowchart of performing log file diagnosis according to a diagnosis rule in an embodiment of the present invention, and as shown in fig. 3, in an embodiment of the present invention, the diagnosing of the log file corresponding to the diagnosis time range according to the diagnosis rule in step S104 specifically includes steps S301 to S303.
Step S301, loading the log file corresponding to the diagnosis time range into a local memory.
Step S302, converting the log content of the log file in the local memory into a file byte stream according to the file encoding format of the log file.
Step S303, diagnosing the log file in the local memory according to the diagnostic rule.
In an embodiment of the present invention, the log diagnostic configuration information further includes: and warning the notification address. The log diagnosis method of the present invention further includes: and if the diagnosis result is that the diagnosis is abnormal, sending early warning information to the early warning notification address.
In an embodiment of the invention, the invention can also update and display the diagnosis result to the foreground in real time, so that the user can check the diagnosis result information in real time.
In another embodiment of the present invention, the overall flow of the log diagnosis method of the present invention may include the following steps S1 to S7.
Step S1: the user sets the log diagnostic configuration information and starts to start the diagnostic task.
Step S2: and pulling the log file of the remote server to the local and preprocessing the log file.
Step S3: it is judged whether the diagnosis start and end times match in the log file, and if the matching succeeds, the step S5 is processed directly, and if the matching fails, the step S4 is processed first.
Step S4: calculating a closest log to the diagnostic start/end time may match the time point.
Step S5: and intercepting the log content according to the starting time and the ending time and loading the log content into a memory.
Step S6: and analyzing the log according to the diagnosis rule, and sending early warning information when abnormality is found in diagnosis.
Step S7: and after the diagnosis is finished, displaying the task execution result on the foreground through the foreground interaction device 1.
The embodiment can show that the invention solves the problem of intercepting log intervals caused by discontinuous log time, and supports the application of a specified time range to diagnose according to a certain rule and early warn in time. The invention considers the compatibility of Chinese coding format and the matching of log time format, and has certain universality for the verification of traditional log files. The invention can effectively improve the problem diagnosis efficiency and the automatic operation and maintenance level and the emergency processing capability.
It should be noted that the steps illustrated in the flowcharts of the figures may be performed in a computer system such as a set of computer-executable instructions and that, although a logical order is illustrated in the flowcharts, in some cases, the steps illustrated or described may be performed in an order different than presented herein.
Based on the same inventive concept, an embodiment of the present invention further provides a log diagnosis apparatus, which can be used to implement the log diagnosis method described in the foregoing embodiment, as described in the following embodiment. Because the principle of the log diagnosis device for solving the problems is similar to the log diagnosis method, the embodiment of the log diagnosis device can be referred to the embodiment of the log diagnosis method, and repeated parts are not described again. As used hereinafter, the term "unit" or "module" may be a combination of software and/or hardware that implements a predetermined function. Although the means described in the embodiments below are preferably implemented in software, an implementation in hardware, or a combination of software and hardware is also possible and contemplated.
Fig. 4 is a block diagram of a log diagnosis apparatus according to an embodiment of the present invention, and as shown in fig. 4, the log diagnosis apparatus according to the embodiment of the present invention includes:
a log diagnosis configuration information obtaining module 1, configured to obtain log diagnosis configuration information set by a user, where the log diagnosis configuration information includes: log file path, diagnostic time range, and diagnostic rules;
the log file acquisition module 2 is used for acquiring the log file under the log file path and storing the acquired log file to the local;
the corresponding log file determining module 3 is used for determining a log file corresponding to the diagnosis time range from locally stored log files;
and the log diagnosis module 4 is used for diagnosing the log file corresponding to the diagnosis time range according to the diagnosis rule to obtain a diagnosis result.
In one embodiment of the present invention, the diagnosis time range includes a diagnosis start time and a diagnosis end time.
Fig. 5 is a schematic diagram of a corresponding log file determining module according to an embodiment of the present invention, and as shown in fig. 5, in an embodiment of the present invention, a corresponding log file determining module 3 specifically includes:
a log time acquiring unit 301, configured to acquire log times of locally stored log files;
an inquiring unit 302, configured to respectively inquire out a log file whose log time is closest to the diagnosis start time and the diagnosis end time;
a determining unit 303, configured to determine all log files whose log times are within the log times of the two queried log files.
In one embodiment of the invention, the diagnostic rules include: keywords or regular expressions for diagnostics and expected number of matches;
the log diagnosis module is specifically configured to match log contents of the log file corresponding to the diagnosis time range with the keywords or the regular expression, determine that the diagnosis result is abnormal if the number of matching times reaches the expected number of matching times, and determine that the diagnosis result is normal if the number of matching times does not reach the expected number of matching times.
To achieve the above object, according to another aspect of the present application, there is also provided a computer apparatus. As shown in fig. 6, the computer device comprises a memory, a processor, a communication interface and a communication bus, wherein a computer program that can be run on the processor is stored in the memory, and the steps of the method of the above embodiment are realized when the processor executes the computer program.
The processor may be a Central Processing Unit (CPU). The Processor may also be other general purpose processors, Digital Signal Processors (DSPs), Application Specific Integrated Circuits (ASICs), Field Programmable Gate Arrays (FPGAs) or other Programmable logic devices, discrete Gate or transistor logic devices, discrete hardware components, or a combination thereof.
The memory, which is a non-transitory computer readable storage medium, may be used to store non-transitory software programs, non-transitory computer executable programs, and units, such as the corresponding program units in the above-described method embodiments of the present invention. The processor executes various functional applications of the processor and the processing of the work data by executing the non-transitory software programs, instructions and modules stored in the memory, that is, the method in the above method embodiment is realized.
The memory may include a storage program area and a storage data area, wherein the storage program area may store an operating system, an application program required for at least one function; the storage data area may store data created by the processor, and the like. Further, the memory may include high speed random access memory, and may also include non-transitory memory, such as at least one disk storage device, flash memory device, or other non-transitory solid state storage device. In some embodiments, the memory optionally includes memory located remotely from the processor, and such remote memory may be coupled to the processor via a network. Examples of such networks include, but are not limited to, the internet, intranets, local area networks, mobile communication networks, and combinations thereof.
The one or more units are stored in the memory and when executed by the processor perform the method of the above embodiments.
The specific details of the computer device may be understood by referring to the corresponding related descriptions and effects in the above embodiments, and are not described herein again.
In order to achieve the above object, according to another aspect of the present application, there is also provided a computer-readable storage medium storing a computer program which, when executed in a computer processor, implements the steps in the log diagnosis method described above. It will be understood by those skilled in the art that all or part of the processes of the methods of the embodiments described above can be implemented by a computer program, which can be stored in a computer-readable storage medium, and when executed, can include the processes of the embodiments of the methods described above. The storage medium may be a magnetic Disk, an optical Disk, a Read-Only Memory (ROM), a Random Access Memory (RAM), a Flash Memory (Flash Memory), a Hard Disk (Hard Disk Drive, abbreviated as HDD) or a Solid State Drive (SSD), etc.; the storage medium may also comprise a combination of memories of the kind described above.
It will be apparent to those skilled in the art that the modules or steps of the present invention described above may be implemented by a general purpose computing device, they may be centralized on a single computing device or distributed across a network of multiple computing devices, and they may alternatively be implemented by program code executable by a computing device, such that they may be stored in a storage device and executed by a computing device, or fabricated separately as individual integrated circuit modules, or fabricated as a single integrated circuit module from multiple modules or steps. Thus, the present invention is not limited to any specific combination of hardware and software.
The above description is only a preferred embodiment of the present invention and is not intended to limit the present invention, and various modifications and changes may be made by those skilled in the art. Any modification, equivalent replacement, or improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.
Claims (11)
1. A log diagnostic method, comprising:
acquiring log diagnosis configuration information set by a user, wherein the log diagnosis configuration information comprises: log file path, diagnostic time range, and diagnostic rules;
acquiring a log file under the log file path, and storing the acquired log file to the local;
determining a log file corresponding to the diagnosis time range from locally stored log files;
and diagnosing the log file corresponding to the diagnosis time range according to the diagnosis rule to obtain a diagnosis result.
2. The log diagnostic method of claim 1, wherein the diagnostic time range includes a diagnostic start time and a diagnostic end time;
the determining, from the locally stored log files, the log file corresponding to the diagnosis time range specifically includes:
acquiring the log time of each log file stored locally;
respectively inquiring log files with log time closest to the diagnosis starting time and the diagnosis ending time;
and determining all log files with the log time within the log time of the two queried log files.
3. The log diagnostic method of claim 1, wherein the diagnostic rules comprise: keywords or regular expressions for diagnostics and expected number of matches;
the diagnosing the log file corresponding to the diagnosis time range according to the diagnosis rule specifically includes:
and matching the log content of the log file corresponding to the diagnosis time range with the keywords or the regular expression, determining that the diagnosis result is abnormal if the matching times reach the expected matching number, and determining that the diagnosis result is normal if the matching times do not reach the expected matching number.
4. The log diagnostic method of claim 1, further comprising, after storing the obtained log file locally:
and acquiring a file encoding format of the log file, and converting the log content of the log file into a file byte stream according to the file encoding format.
5. The log diagnosis method according to claim 1, wherein the diagnosing the log file corresponding to the diagnosis time range according to the diagnosis rule specifically includes:
loading the log file corresponding to the diagnosis time range into a local memory;
converting the log content of the log file in the local memory into a file byte stream according to the file encoding format of the log file;
and diagnosing the log file in the local memory according to the diagnosis rule.
6. The log diagnostic method of claim 1, wherein the log diagnostic configuration information further comprises: an early warning notification address;
the log diagnosis method further comprises the following steps:
and if the diagnosis result is that the diagnosis is abnormal, sending early warning information to the early warning notification address.
7. A log diagnostic apparatus, comprising:
the log diagnosis configuration information acquisition module is used for acquiring log diagnosis configuration information set by a user, wherein the log diagnosis configuration information comprises: log file path, diagnostic time range, and diagnostic rules;
the log file acquisition module is used for acquiring the log file under the log file path and storing the acquired log file to the local;
the corresponding log file determining module is used for determining a log file corresponding to the diagnosis time range from locally stored log files;
and the log diagnosis module is used for diagnosing the log file corresponding to the diagnosis time range according to the diagnosis rule to obtain a diagnosis result.
8. The log diagnostic device of claim 7, wherein the diagnostic time range includes a diagnostic start time and a diagnostic end time;
the corresponding log file determination module specifically includes:
a log time acquiring unit for acquiring the log time of each log file stored locally;
the query unit is used for respectively querying the log files with the log time closest to the diagnosis starting time and the diagnosis ending time;
and the determining unit is used for determining all log files with the log time within the log time of the two queried log files.
9. The log diagnostic device of claim 7, wherein the diagnostic rules comprise: keywords or regular expressions for diagnostics and expected number of matches;
the log diagnosis module is specifically configured to match log contents of the log file corresponding to the diagnosis time range with the keywords or the regular expression, determine that the diagnosis result is abnormal if the number of matching times reaches the expected number of matching times, and determine that the diagnosis result is normal if the number of matching times does not reach the expected number of matching times.
10. A computer device comprising a memory, a processor and a computer program stored on the memory and executable on the processor, characterized in that the processor implements the method of any of claims 1 to 6 when executing the computer program.
11. A computer-readable storage medium, in which a computer program is stored which, when executed in a computer processor, implements the method of any one of claims 1 to 6.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110434454.XA CN113064807A (en) | 2021-04-22 | 2021-04-22 | Log diagnosis method and device |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110434454.XA CN113064807A (en) | 2021-04-22 | 2021-04-22 | Log diagnosis method and device |
Publications (1)
| Publication Number | Publication Date |
|---|---|
| CN113064807A true CN113064807A (en) | 2021-07-02 |
Family
ID=76567382
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110434454.XA Pending CN113064807A (en) | 2021-04-22 | 2021-04-22 | Log diagnosis method and device |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113064807A (en) |
Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105205144A (en) * | 2015-09-18 | 2015-12-30 | 北京百度网讯科技有限公司 | Method and system used for data diagnosis and optimization |
| CN109614469A (en) * | 2018-12-03 | 2019-04-12 | 郑州云海信息技术有限公司 | A kind of log analysis method and device |
| CN109857714A (en) * | 2018-12-24 | 2019-06-07 | 浪潮电子信息产业股份有限公司 | Journal obtaining method, device, electronic equipment and computer readable storage medium |
| CN110309032A (en) * | 2019-07-05 | 2019-10-08 | 上海富欣智能交通控制有限公司 | Data managing method, device and electronic equipment |
| CN110569214A (en) * | 2019-08-02 | 2019-12-13 | 杭州云纪网络科技有限公司 | Index construction method and device for log file and electronic equipment |
| CN110737531A (en) * | 2019-09-27 | 2020-01-31 | 山东英信计算机技术有限公司 | fault diagnosis method, device, equipment and medium |
-
2021
- 2021-04-22 CN CN202110434454.XA patent/CN113064807A/en active Pending
Patent Citations (6)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105205144A (en) * | 2015-09-18 | 2015-12-30 | 北京百度网讯科技有限公司 | Method and system used for data diagnosis and optimization |
| CN109614469A (en) * | 2018-12-03 | 2019-04-12 | 郑州云海信息技术有限公司 | A kind of log analysis method and device |
| CN109857714A (en) * | 2018-12-24 | 2019-06-07 | 浪潮电子信息产业股份有限公司 | Journal obtaining method, device, electronic equipment and computer readable storage medium |
| CN110309032A (en) * | 2019-07-05 | 2019-10-08 | 上海富欣智能交通控制有限公司 | Data managing method, device and electronic equipment |
| CN110569214A (en) * | 2019-08-02 | 2019-12-13 | 杭州云纪网络科技有限公司 | Index construction method and device for log file and electronic equipment |
| CN110737531A (en) * | 2019-09-27 | 2020-01-31 | 山东英信计算机技术有限公司 | fault diagnosis method, device, equipment and medium |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN108829560B (en) | Data monitoring method and device, computer equipment and storage medium | |
| EP3031216A1 (en) | Dynamic collection analysis and reporting of telemetry data | |
| WO2016048283A1 (en) | Event log analysis | |
| US9706005B2 (en) | Providing automatable units for infrastructure support | |
| US11897527B2 (en) | Automated positive train control event data extraction and analysis engine and method therefor | |
| CN113656503A (en) | Data synchronization method, device and system and computer readable storage medium | |
| CN111339118A (en) | Kubernetes-based resource change history recording method and device | |
| CN115392501A (en) | Data acquisition method and device, electronic equipment and storage medium | |
| CN108595685B (en) | Data processing method and device | |
| CN112256548B (en) | Abnormal data monitoring method and device, server and storage medium | |
| CN114647548A (en) | Log generation method and device | |
| CN110011845B (en) | Log collection method and system | |
| CN110442439B (en) | Task process processing method and device and computer equipment | |
| CN112346775A (en) | General index data processing method, electronic device and storage medium | |
| CN111176987A (en) | Method and device for uniformly outputting front-end log, computer equipment and storage medium | |
| US10860781B2 (en) | Event detection based on text streams | |
| CN113064807A (en) | Log diagnosis method and device | |
| CN115525392A (en) | Container monitoring method and device, electronic equipment and storage medium | |
| CN112988776B (en) | Method, device and equipment for updating text parsing rule and readable storage medium | |
| CN113918204A (en) | Metadata script management method and device, electronic equipment and storage medium | |
| WO2022106881A1 (en) | Computerized systems and methods for processing high-volume log files from virtual servers | |
| CN111444057A (en) | Page performance data acquisition method and device and computing equipment | |
| CN115858325B (en) | Project log adjusting method, device, equipment and storage medium | |
| CN112653567B (en) | Monitoring method, monitoring device, computer equipment and storage medium | |
| CN110837469B (en) | Data testing method and device, testing server and storage medium |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination |