CN114528845A - Abnormal log analysis method and device and electronic equipment - Google Patents

Abstract

The invention discloses an abnormal log analysis method and device and electronic equipment. Relates to the field of artificial intelligence, and the method comprises the following steps: acquiring a log to be processed which is generated when the system is abnormal; inputting the abnormal logs to be processed into a target language model obtained through pre-training to obtain a plurality of first-dimension vectors; determining a target first-dimension vector with the maximum similarity probability from the plurality of first-dimension vectors, and extracting a target label explanation text from a sentence pair corresponding to the target first-dimension vector; and taking the target label interpretation text as an analysis result of the exception log to be processed. The invention solves the technical problem of poor analysis efficiency caused by the dependence on manual analysis of the log file in the prior art.

Description

Analysis method, device and electronic device for abnormal log

technical field

The present invention relates to the field of artificial intelligence, and in particular, to a method, device and electronic device for analyzing abnormal logs.

Background technique

The system often generates a lot of logs when it is running. Under the background of today's diverse and complex enterprise-level WEB services and big data services, not only various service frameworks are integrated, but there are also various ways to record logs. The log mainly contains two main contents: logical description of system operation and state description of system operation. The logical description of system operation is expressed in natural language that humans can understand. When the system has an error, it describes the events that the system cannot continue to execute, such as what kind of error occurs when calling a module, or when accessing an external interface. Description of what kind of errors, exhaustion of system resources, etc. The state description when the system is running is represented by a set of structured data, such as the timestamps submitted by each job when the system is running, resource usage, data throughput, and job execution time. This series of parameters quantitatively describes the state of the system when it reaches a specific stage.

In the prior art, when an abnormality occurs in the system, the staff in charge of system operation and maintenance usually manually extracts the system log, and manually analyzes the logic description and state description of the system when an error occurs to find the cause of the system abnormality, thereby causing Analysis of poor efficiency.

For the above problems, no effective solution has been proposed yet.

SUMMARY OF THE INVENTION

Embodiments of the present invention provide an abnormal log analysis method, device, and electronic device, so as to at least solve the technical problem of poor analysis efficiency caused by relying on manual analysis of log files in the prior art.

According to an aspect of the embodiments of the present invention, a method for analyzing an exception log is provided, including: acquiring a pending exception log generated when an exception occurs in a system; inputting the pending exception log into a pre-trained target language model, Obtain multiple first-dimensional vectors, where each first-dimensional vector represents the similarity probability of each sentence pair corresponding to the pending exception log and the pending exception log, and each sentence pair is explained by the pending exception log and a label The text combination is generated, and the label explanation text includes at least the abnormal details and/or the abnormal solution of the preset abnormal type label; the target first-dimensional vector with the highest similarity probability is determined from the multiple first-dimensional vectors, and the target first-dimensional vector is determined from the target first-dimensional vector. Extract the target label interpretation text from the sentence pair corresponding to the vector; take the target label interpretation text as the analysis result of the abnormal log to be processed.

Further, each first-dimension vector in the plurality of first-dimension vectors corresponds to a second-dimension vector, wherein the second-dimension vector represents the difference between the to-be-processed exception log and each sentence pair corresponding to the to-be-processed exception log. Similar probability.

Further, the method for analyzing the abnormal log further includes: before inputting the abnormal log to be processed into the target language model obtained by pre-training, acquiring a plurality of historical abnormal logs, wherein each historical abnormal log contains at least a description of the system logic Text, wherein the description text of the system logic includes at least description information of the event that caused the system to occur abnormally; vectorize each historical exception log according to the description text of the system logic, and obtain the semantic vector corresponding to each historical exception log.

Further, the method for analyzing abnormal logs also includes: the first frequency of each word appearing in each historical abnormal log in the description text of the statistical system logic and the second frequency of each word appearing in all historical abnormal logs; according to The first frequency and the second frequency are calculated to obtain the weight value of each word in each historical abnormal log; in each historical abnormal log, the weight value of each word and the word semantic vector of each word are weighted and summed , get the semantic vector corresponding to each historical exception log.

Further, the analysis method of the abnormal log further includes: after performing vectorization processing on each historical abnormal log according to the description text of the system logic to obtain the semantic vector corresponding to each historical abnormal log, the semantic vector corresponding to each historical abnormal log is analyzed. The vector is clustered to obtain the abnormality type corresponding to each historical abnormality log, wherein each abnormality type corresponds to at least one historical abnormality log; obtain the preset abnormality type label corresponding to each abnormality type, and assign the preset abnormality type label Annotated on the corresponding historical abnormal log, the marked historical abnormal log is obtained, wherein one abnormal type corresponds to a preset abnormal type label; the target language model is obtained by training according to the marked historical abnormal log.

Further, the analysis method of the abnormal log also includes: performing text expansion on the marked historical abnormal log to obtain the expanded historical abnormal log, wherein the expanded historical abnormal log at least includes: a description text of the system logic, a description of the system state. Descriptive text and label explanation text with preset exception type labels; train the initial language model based on the expanded historical exception log to obtain the target language model.

Further, the method for analyzing the exception log further includes: obtaining label interpretation texts of preset exception type labels, wherein each preset exception type label corresponds to at least one label interpretation text; When the label explanation text corresponds to each label explanation text, each label explanation text is added to each marked historical anomaly log corresponding to the corresponding preset anomaly type label to obtain a plurality of expanded historical anomaly logs.

Further, the exception log to be processed includes at least a description text of the system logic and a description text of the system state, and the analysis method of the exception log further includes: controlling the target language model to obtain at least one label interpretation text corresponding to each preset exception type label. A label explanation text to be combined, and a preset separator is inserted between the description text of the system logic, the description text of the system state, and the label explanation text to be combined to obtain the target text, and insert the preset at the beginning of the sentence of the target text. Sentence start labels, obtain sentence pairs corresponding to each preset exception type label, and generate multiple first-dimensional vectors based on the sentence pairs corresponding to each preset exception type label.

According to another aspect of the embodiments of the present invention, there is also provided an abnormal log analysis device, including: an acquisition module for acquiring pending exception logs generated when an exception occurs in the system; an input module for The log is input into the target language model obtained by pre-training, and a plurality of first-dimensional vectors are obtained, wherein each first-dimensional vector represents the similarity probability of each sentence pair corresponding to the abnormal log to be processed and the abnormal log to be processed. Sentence pairs are generated by combining the exception log to be processed and a label interpretation text, and the label interpretation text includes at least the exception details information and/or exception solution of the preset exception type label; the first determination module is used for analyzing multiple first dimensions. Determine the target first-dimension vector with the largest similarity probability among the vectors, and extract the target label explanation text from the sentence pair corresponding to the target first-dimension vector; the second determination module is used to analyze the target label explanation text as the abnormal log to be processed result.

According to another aspect of the embodiments of the present invention, a computer-readable storage medium is also provided, where the computer-readable storage medium includes a stored program, wherein when the program is run, the device where the computer-readable storage medium is located is controlled to execute the above exception log method of analysis.

According to another aspect of the embodiments of the present invention, an electronic device is also provided, including a memory and a processor, where a computer program is stored in the memory, and the processor is configured to run the computer program to execute the above-mentioned abnormal log analysis method.

In the embodiment of the present invention, the method of locating the abnormal problem of the abnormal log to be processed based on the target language model is adopted, and the abnormal log to be processed generated when an abnormality occurs in the system is obtained, and then the abnormal log to be processed is input to the target obtained by pre-training In the language model, multiple first-dimensional vectors are obtained, and then the target first-dimensional vector with the highest similarity probability is determined from the multiple first-dimensional vectors, and the target label explanation text is extracted from the sentence pair corresponding to the target first-dimensional vector. Thus, the target label interpretation text is used as the analysis result of the exception log to be processed. Among them, each first-dimensional vector represents the similarity probability of each sentence pair corresponding to the exception log to be processed and the exception log to be processed. Exception details and/or exception solutions including pre-set exception type labels.

In the above process, since the label interpretation text in each sentence pair corresponds to different preset exception type labels, and each preset exception type label corresponds to an exception type, therefore, based on the target language model, the The similarity probability of each sentence pair corresponding to the abnormal log and the abnormal log to be processed realizes the similarity judgment of the abnormal type corresponding to the abnormal log to be processed and the abnormal type corresponding to each sentence pair. Further, the target label explanation text is extracted from the sentence pair with the highest similarity probability among multiple sentence pairs, and it is used as the analysis result of the abnormal log to be processed. The abnormal log is analyzed manually, so that the operator can quickly obtain the cause of the abnormal log, and then quickly solve the abnormal problem, which improves the analysis efficiency of the abnormal log and the problem solving efficiency.

It can be seen that the solution provided by the present application achieves the purpose of locating the abnormal problem of the abnormal log to be processed based on the target language model, thereby achieving the technical effect of improving the analysis efficiency of the abnormal log, and solving the problem of relying on the existing technology. The technical problem of poor analysis efficiency caused by manual analysis of log files.

Description of drawings

The accompanying drawings described herein are used to provide a further understanding of the present invention and constitute a part of the present application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the attached image:

1 is a schematic diagram of an optional abnormal log analysis method according to an embodiment of the present invention;

2 is a schematic diagram of an optional training target language model according to an embodiment of the present invention;

3 is a schematic diagram of an optional text expansion of annotated historical exception logs according to an embodiment of the present invention;

4 is a schematic diagram of an optional abnormal log analysis device according to an embodiment of the present invention;

FIG. 5 is a schematic diagram of an optional electronic device according to an embodiment of the present invention.

Detailed ways

In order to make those skilled in the art better understand the solutions of the present invention, the technical solutions in the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only Embodiments are part of the present invention, but not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by persons of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

It should be noted that the terms "first", "second" and the like in the description and claims of the present invention and the above drawings are used to distinguish similar objects, and are not necessarily used to describe a specific sequence or sequence. It is to be understood that the data so used may be interchanged under appropriate circumstances such that the embodiments of the invention described herein can be practiced in sequences other than those illustrated or described herein. Furthermore, the terms "comprising" and "having" and any variations thereof, are intended to cover non-exclusive inclusion, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those expressly listed Rather, those steps or units may include other steps or units not expressly listed or inherent to these processes, methods, products or devices.

It should be noted that the user information (including but not limited to user equipment information, user personal information, etc.) and data (including but not limited to display data, analysis data, etc.) involved in this disclosure are all authorized by the user or information and data fully authorized by the parties.

Example 1

According to an embodiment of the present invention, an embodiment of a method for analyzing an exception log is provided. It should be noted that the steps shown in the flowchart of the accompanying drawing may be executed in a computer system such as a set of computer-executable instructions, and , although a logical order is shown in the flowcharts, in some cases steps shown or described may be performed in an order different from that herein.

FIG. 1 is a schematic diagram of an optional abnormal log analysis method according to an embodiment of the present invention. As shown in FIG. 1 , the method includes the following steps:

Step S101 , acquiring a pending exception log generated when an exception occurs in the system.

In step S101, the pending exception log generated when the system is abnormal can be obtained through an application system, a processor, an electronic device, etc. In this embodiment, the aforementioned pending exception log is obtained through a data analysis system. Optionally, the data analysis system can directly read the newly generated exception log from the system where the exception occurred, or the relevant operator, or the system where the exception occurred, or other systems can input the pending exception log to the data analysis system. , for the data analysis system to obtain.

The to-be-processed exception log includes at least a description text of the system logic and a description text of the system state. The description text of the system logic is expressed in natural language that humans can understand. When the system fails, it describes the events that the system cannot continue to execute, such as what kind of error occurs when calling a module, or when accessing an external interface. Description of errors, system resource exhaustion, etc.; the description text of system status is represented as a set of structured data, such as timestamps submitted by each job when the system is running, resource usage, data throughput, job execution time, etc. This series of parameters quantitatively describes the state of the system when it reaches a specific stage.

It should be noted that, by acquiring the pending exception log generated when an exception occurs in the system, the subsequent analysis of the pending exception log is facilitated.

Step S102, input the pending exception log into the target language model obtained by pre-training, and obtain a plurality of first-dimensional vectors, wherein each first-dimensional vector represents the pending exception log and each corresponding to the pending exception log. The similarity probability of sentence pairs, each sentence pair is generated by combining the pending exception log with a label explanation text. The label explanation text includes at least the exception details and/or exception solutions of the preset exception type labels.

In step S102, the data analysis system may input the aforementioned abnormal log to be processed into the target language model obtained by pre-training. In this embodiment, the target language model obtained by pre-training may be BERT (Bidirectional Encoder Representations from Transformers). model, which is a classic large-scale pre-trained language model that aims to pre-train deep bidirectional representations of text by jointly conditioning the context of all layers in the model.

Optionally, the data analysis system can control the target language model to combine the to-be-processed exception log with multiple label interpretation texts to generate a sentence pair composed of the to-be-processed exception log and a label interpretation text, and interpret the to-be-processed sentence pair. The similarity probability between the abnormal log and the label interpretation text is calculated, so as to output the first dimension vector corresponding to each sentence pair, that is, the similarity probability between the abnormal log to be processed and the label interpretation text. Wherein, each label interpretation text is in the form of natural language, which corresponds to a preset exception type label, and each preset exception type label corresponds to an exception type. Each tag text can be a detailed description of the exception type corresponding to the preset exception type tag, or an explanation (ie, solution) of the exception type corresponding to the preset exception type tag, or a description of the preset exception type tag. The detailed description and explanation of the exception type corresponding to the exception type label are combined.

It should be noted that, because the label interpretation text in each sentence pair corresponds to different preset exception type labels, and each preset exception type label corresponds to an exception type, therefore, based on the target language model, the The similarity probability of each sentence pair corresponding to the abnormal log and the abnormal log to be processed realizes the similarity judgment of the abnormal type corresponding to the abnormal log to be processed and the abnormal type corresponding to each sentence pair, so as to facilitate the subsequent positioning of the abnormal log The problem.

Step S103: Determine the target first-dimensional vector with the highest similarity probability from the plurality of first-dimensional vectors, and extract the target label explanation text from the sentence pair corresponding to the target first-dimensional vector.

In step S103, when the similarity probability between the abnormal log to be processed and the sentence pair is higher, the abnormal type of the abnormal log to be processed is more similar to the abnormal type corresponding to the sentence pair, and the first dimension vector is larger or closer to some value. Therefore, the data analysis system can determine the target first-dimension vector with the highest similarity probability from the first-dimension vectors based on the value of the first-dimension vector, and extract the target label explanation text from the sentence pair corresponding to the target first-dimension vector. , the target label explanation text is the relatively optimal explanation for the abnormal cause corresponding to the abnormal log to be processed.

It should be noted that by determining the target first-dimension vector with the highest similarity probability, and extracting the target label interpretation text corresponding to the target first-dimension vector, a relatively optimal interpretation of the abnormal cause corresponding to the abnormal log to be processed is achieved. Determined, that is, the exception problem location of the exception log to be processed is realized.

Step S104, the target label interpretation text is used as the analysis result of the abnormal log to be processed.

In step S104, the data analysis system can use the above-determined target label interpretation text as the analysis result of the abnormal log to be processed, and display the analysis result to the operator through the human-computer interaction interface, so that the operator can know the analysis result and based on the analysis result The analysis result maintains the system that generates the exception log to be processed.

It should be noted that by using the target label interpretation text as the analysis result of the pending exception log, the manual analysis of the exception log is avoided, so that the operator can quickly obtain the cause of the exception log, and explain it based on the target label. The exception solution in the text quickly solves the exception problem, improving the efficiency of exception analysis and problem solving.

Based on the solutions defined in the above steps S101 to S104, it can be known that, in the embodiment of the present invention, the method of locating the abnormal problem of the abnormal log to be processed based on the target language model is adopted, and the abnormal problem to be processed generated when an abnormality occurs in the system is obtained by acquiring the abnormality to be processed. log, and then input the abnormal log to be processed into the target language model obtained by pre-training to obtain multiple first-dimensional vectors, and then determine the target first-dimensional vector with the highest similarity probability from the multiple first-dimensional vectors, and obtain the target first-dimensional vector from the target The target label interpretation text is extracted from the sentence pair corresponding to the first dimension vector, so that the target label interpretation text is used as the analysis result of the abnormal log to be processed. Among them, each first-dimensional vector represents the similarity probability of each sentence pair corresponding to the exception log to be processed and the exception log to be processed. Exception details and/or exception solutions including pre-set exception type labels.

It is easy to notice that in the above process, since the label explanation text in each sentence pair corresponds to different preset exception type labels, and each preset exception type label corresponds to an exception type, therefore, based on The target language model obtains the similarity probability of the abnormal log to be processed and each sentence pair corresponding to the abnormal log to be processed, and realizes the similarity judgment between the abnormal type corresponding to the abnormal log to be processed and the abnormal type corresponding to each sentence pair. Further, the target label explanation text is extracted from the sentence pair with the highest similarity probability among multiple sentence pairs, and it is used as the analysis result of the abnormal log to be processed. The abnormal log is analyzed manually, so that the operator can quickly obtain the cause of the abnormal log, and then quickly solve the abnormal problem, which improves the analysis efficiency of the abnormal log and the problem solving efficiency.

It can be seen that the solution provided by the present application achieves the purpose of locating the abnormal problem of the abnormal log to be processed based on the target language model, thereby achieving the technical effect of improving the analysis efficiency of the abnormal log, and solving the problem of relying on the existing technology. The technical problem of poor analysis efficiency caused by manual analysis of log files.

In an optional embodiment, in the process of inputting the abnormal log to be processed into the target language model obtained by pre-training to obtain multiple first-dimensional vectors, the data analysis module can control the target language model to perform Suppose that a tag interpretation text to be combined is obtained from at least one tag interpretation text corresponding to the exception type tag, and a preset separator is inserted between the description text of the system logic, the description text of the system state, and the tag interpretation text to be combined to obtain In the target text, a preset sentence-heading tag is inserted at the sentence-heading position of the target text to obtain a sentence pair corresponding to each preset exception type tag, and based on the sentence pair corresponding to each preset exception type tag, multiple first sentence pairs are generated. dimensional vector.

Optionally, each preset exception type label and at least one corresponding label explanation text may be stored in a preset storage area, which may specifically be a storage area such as a database and a cloud server. After the data analysis module inputs the log to be processed into the pre-trained target language model, the data analysis module can control the target language model to obtain a label interpretation text corresponding to each preset abnormal type label from the preset storage area , and interpret the text as the label to be combined, where the target language model is the BERT model. For example, when there are ten preset exception type tags in the preset storage area, the data analysis module controls the target language model to obtain one tag interpretation text among the multiple tag interpretation texts corresponding to each preset exception type tag, thereby Ten tag interpretation texts to be combined are obtained, and each tag interpretation text to be combined corresponds to a preset exception type tag respectively.

Further, the data analysis module can control the target language model to perform text processing on the abnormal log to be processed. During text processing, the target language model can convert the character sequence <w1,...,wi,...wn> of the input text into <CLS,w1,...,wi,...wn,SEP> , where "CLS" is the specified sequence starter, that is, the preset sentence start label, and has no other language meaning, and "SEP" is the specified sequence terminator or separator, that is, the preset separator. When the input text When the character sequence of contains multiple sentences, the corresponding number of "SEP" can be used.

Specifically, in this embodiment, the target language model can extract the description text of the system logic and the description text of the system state of the exception log to be processed, and combine the description text of the system logic, the description text of the system state, and each of the foregoing The label interpretation text to be combined is converted into <CLS, description text of system logic, SEP, description text of system state, SEP, label interpretation text, SEP> or <CLS, description text of system logic, SEP, description text of system state , SEP, preset exception type label/label explanation text, SEP>, so as to obtain the sentence pair corresponding to each preset exception type label. Among them, in the BERT model, the vector corresponding to "CLS" is usually used to express the vector of the character sequence of the entire input text.

Further, after obtaining the sentence pairs corresponding to each preset abnormal type label, the data analysis system can control the target language model to perform text representation processing on each sentence pair to generate multiple first-dimensional vectors. Specifically, in the BERT model, a multi-head self-attention mechanism module is constructed. The basic calculation formula of each multi-head self-attention mechanism module is as follows:

分别表示不同的权重矩阵。具体地，在单个抽头r中，句子对对应的向量矩阵会被分成Q_r、K_r、V_r三个部分，之后Q_r、K_r、V_r三个矩阵经过不同的权重矩阵

分别做线性映射并计算相似度，再基于相似度确定权重值，将V矩阵中的各个向量做相应的加权求和，从而得到H_r，即单个抽头r所输出的结果。Among them, Softmax() represents the normalization processing function, Q _r , K _r , V _r represent the three parts into which the vector matrix corresponding to the sentence pair is divided,

respectively represent different weight matrices. Specifically, in a single tap r, the vector matrix corresponding to the sentence pair will be divided into three parts Q _r , K _r , and V _r , and then the three matrices Q _r , K _r , and V _r will pass through different weight matrices.

Do a linear mapping and calculate the similarity, and then determine the weight value based on the similarity, and perform the corresponding weighted summation of each vector in the V matrix to obtain H _r , that is, the result output by a single tap r.

After that, for all the different taps r, after splicing them and performing linear transformation of the original vector scale, they are added to the original input to obtain the text representation corresponding to the input text. The formula is as follows:

X'=HW ^H +X=[H ₁ ,...,H _r ,...,H _R ]W ^H +X

Among them, X' represents the text representation corresponding to the input text, which takes into account and builds the relationship between the description text of the system logic, the description text of the system state, and the label explanation text to be combined, [H ₁ , . .., H _r ,..., H _R ] represent individual _taps , X represents the input text, _ie , sentence pairs, W ^H _represents the original Linear transformation of vector scale.

Further, the generated text representation vector is passed through the fully connected layer MLP() to extract and compress the relationship between different dimensions in the high-dimensional vector, and the vector dimension is reduced to suit the overall classification task. After the text processing of the abnormal log to be processed, the task is transformed into a binary classification problem in which the model judges whether the text pair is similar. Therefore, the final output of the fully connected layer MLP is a two-dimensional vector to represent the abnormal log to be processed and the abnormal log to be processed. The corresponding probability of similarity for each sentence pair. Finally, in order to represent the probability more intuitively, the data analysis system can control the target language model to use the softmax function to normalize the two-dimensional vector, and convert all variables in it to decimals in the range of [0,1]. The formula looks like this:

P=Softmax(MLP(X′ _CLS ))

Among them, Softmax() represents the normalization processing function, MLP(X′ _CLS ) represents the output of the fully connected layer MLP(), and P represents the input sentence pair corresponding to the pending exception log, which is divided into the label explanation in the sentence pair The probability vector of the abnormal type corresponding to the text, the P vector is a two-dimensional vector, and at least includes the first-dimensional vector, thereby realizing the acquisition of the first-dimensional vector.

It should be noted that, by controlling the target language model to generate sentence pairs, and generating multiple first-dimensional vectors based on the sentence pairs, it is possible to accurately determine the similarity between the exception log to be processed and each exception type.

In an optional embodiment, each first-dimensional vector in the plurality of first-dimensional vectors corresponds to a second-dimensional vector, wherein the second-dimensional vector represents the exception log to be processed and the exception log to be processed corresponds to The dissimilarity probability for each sentence pair of .

Optionally, the aforementioned P vector also includes a second-dimensional vector, and the data analysis system can combine the value of the first-dimensional vector and the value of the second-dimensional vector to determine the target first-dimensional vector with the largest similarity probability from the plurality of first-dimensional vectors. vector. Thus, the more accurate judgment of the target first-dimensional vector is improved, and the analysis accuracy is further improved.

In an optional embodiment, before inputting the to-be-processed exception log into the target language model obtained by pre-training, the data analysis system may acquire multiple historical exception logs, and then analyze each historical exception log according to the description text of the system logic. The exception log is vectorized, and the semantic vector corresponding to each historical exception log is obtained. Wherein, each historical exception log contains at least a description text of the system logic, wherein the description text of the system logic at least includes description information of an event that causes an exception to occur in the system.

Optionally, as shown in FIG. 2 , the data analysis system may acquire a plurality of historical exception logs based on manually input data, or may directly read from a related system or a storage device such as a memory. After acquiring multiple historical abnormal data, the data analysis system can extract the description text of the system logic in each historical abnormal data, and perform vectorization processing on the description text of the system logic in each historical abnormal data to obtain The semantic vector corresponding to this historical exception log.

It should be noted that the target language model is obtained by obtaining the semantic vector corresponding to each historical abnormal log, so as to subsequently train the initial language model based on each historical abnormal log.

In an optional embodiment, in the process of vectorizing each historical exception log according to the description text of the system logic, the data analysis system can count the number of words in the description text of the system logic in each historical exception log. The first frequency that appears in the log and the second frequency that each word appears in all historical abnormal logs, and then the weight value of each word in each historical abnormal log is calculated according to the first frequency and the second frequency, so that each In each historical abnormal log, the weight value of each word and the word semantic vector of each word are weighted and summed to obtain the semantic vector corresponding to each historical abnormal log.

Optionally, the data analysis system may perform vectorization processing on the description text of the system logic based on term frequency-inverse document frequency (TF-IDF, term frequency-inverse document frequency). Among them, TF-IDF is a technique for extracting keywords in natural language paragraphs. The frequency of occurrence of a word in a paragraph is multiplied by the inverse document frequency of the word in the overall natural language corpus, which is the TF-IDF score. The higher the TF-IDF score, the higher the weight of the corresponding word in its paragraph, which means that the word has a higher contribution to the semantics of the entire paragraph.

Specifically, taking any historical exception log among multiple historical exception logs as an example, the data analysis system can obtain the frequency of each word in the description text of the system logic appearing in the exception log, that is, the first frequency, and obtain the frequency of each word in the description text of the system logic. A logical description of the probability that each word in the text appears in all historical daily logs, ie the second frequency. Therefore, the TF-IDF method is used to calculate the TF-IDF weight of each word for the historical abnormal log based on the first frequency and the second frequency. Further, based on the aforementioned TF-IDF weight of each word, the word semantic vectors of all the words in the historical abnormal log are weighted and summed, so that the semantic vector corresponding to the historical abnormal log can be obtained.

It should be noted that, by calculating the first frequency and the second frequency of each word in the description text of the system logic corresponding to each historical abnormal log, and based on the first frequency and the second rating rate, each historical abnormal log is evaluated. The corresponding semantic vector is calculated, which realizes the accurate determination of the semantic vector corresponding to each historical exception log, and further realizes the accurate extraction of the natural language semantics contained in the historical exception log.

In an optional embodiment, after performing vectorization processing on each historical exception log according to the description text of the system logic to obtain a semantic vector corresponding to each historical exception log, the data analysis system can The corresponding semantic vector is clustered to obtain the exception type corresponding to each historical exception log, and then the preset exception type label corresponding to each exception type is obtained, and the preset exception type label is marked on the corresponding historical exception log. The marked historical abnormal log is obtained, and then the target language model is obtained by training according to the marked historical abnormal log. Wherein, each exception type corresponds to at least one historical exception log, and each exception type corresponds to a preset exception type label.

Optionally, as shown in Figure 2, the operator can use the development manual written by the system in the development phase and the problem summary and related experience of the system in the operation phase to determine the initial cluster number of the abnormal log of the system, or it can be determined by the data. The analysis system determines the initial cluster number of the system abnormal log based on the preset value, and the data analysis system can also calculate the initial cluster number of the system abnormal log based on a related algorithm. After the initial number of clusters is determined, the data analysis system can use the K-means clustering algorithm to perform multiple clustering calculations on the semantic vectors corresponding to multiple historical abnormal logs based on the initial number of clusters. , to obtain a clustering result of semantic vectors corresponding to multiple historical anomaly logs, so as to determine an anomaly type corresponding to each historical anomaly log based on the clustering result.

Further, after determining the abnormality type corresponding to each historical abnormality log, as shown in Figure 2, the data analysis system can obtain the preset abnormality type label corresponding to each abnormality type, and mark the preset abnormality type label in the corresponding to obtain the marked historical exception log, wherein the marked historical exception file includes at least the preset exception type label, the description text of the system logic and the description text of the system state. The preset exception type label can be Numbers, letters or other identifiers can also be directly taken as the name of the exception type.

Furthermore, after obtaining the marked historical abnormal logs, the data analysis system uses the marked historical abnormal logs as training samples to train the language model to be trained to obtain the target language model.

It should be noted that by determining the abnormal type corresponding to each historical abnormal log, and labeling each historical abnormal log based on the abnormal type, the acquisition of training samples is realized, so that the initial language model can be effectively trained, and then the The target language model for accurate judgment.

In an optional embodiment, in the process of obtaining the target language model by training according to the marked historical abnormal logs, the data analysis system may perform text expansion on the marked historical abnormal logs to obtain the expanded historical abnormal logs, Thus, the initial language model is trained based on the expanded historical exception logs, and the target language model is obtained. The expanded historical exception log includes at least: description text of system logic, description text of system state, and label explanation text of preset exception type label.

Optionally, as shown in FIG. 2 , in order to deal with the unbalanced distribution among system exception types, in this application, the aforementioned training samples (that is, the marked historical exception logs) can be text-extended to Enrich the training samples to make the distribution of abnormal types of each system more uniform. In the process of text expansion, as shown in Figure 3, the data analysis system can extract the description text of the system logic from the annotated historical exception logs, and extract the effective description text of the system state based on manual screening, and create tags at the same time Interpret text or get label explanation text from preset storage area. Then, based on the relationship between historical exception logs, exception types and labels, the multi-classification task can be converted into a sentence pair task, that is, sentence pairs corresponding to each historical exception file are generated based on the historical exception logs, exception types, and label interpretation texts, and then Transform sentence pairs for text augmentation.

Further, after the text expansion of the historical abnormal log, the data analysis system can train the initial language model based on the expanded historical abnormal log to obtain the target language model. Among them, in this embodiment, the method provided by this application can be implemented in python language, the version is python 3.7, and the PyTorch framework can be used as the support library of the deep learning model, and the open source HuggingFace can be used as the PyTorch-based BERT pre-training model (ie the initial language model) training framework, the BERT pre-training model can use the BERT-Base version released by Google, which contains a total of 110M parameters.

It should be noted that, in general, the types of abnormal logs are not evenly distributed. On the one hand, an imbalanced dataset will make the language model tend to predict categories with a dominant data distribution, resulting in the model tending to fail in the prediction of some more severe but not-dominant anomalous categories. On the other hand, the data volume of the abnormal log may not be enough to train a usable and effective model. Therefore, by text expansion of the marked historical abnormal log, the training data can be effectively expanded and the problem location of the abnormal log can be improved. robustness.

In an optional embodiment, in the process of performing text expansion on the marked historical abnormality log to obtain the expanded historical abnormality log, the data analysis system may obtain the label explanation text of the preset abnormality type label, and in the process of obtaining the expanded historical abnormality log When a preset exception type label corresponds to multiple label interpretation texts, each label interpretation text is added to each marked historical exception log corresponding to the corresponding preset exception type label, so as to obtain multiple labels. An expanded historical exception log. Wherein, each preset exception type label corresponds to at least one label explanation text.

Specifically, in conventional applications, the data set format of a typical multi-classification task (text classification) is: <sentence, label>, and the data set in this format is directly multi-classified to predict, because the related system or model tries to Labels are directly mapped from the input text, so no additional information is used. In this application, since each abnormality type has a set of abnormality resolution mechanism, the data set format of the above-mentioned typical multi-classification task can be converted into the description text of the system logic and the description text of the system state of the historical exception log , sentence_2, label (0, 1)>, where the content of sentence_2 is the label interpretation text, and label (0, 1) represents the preset exception type label corresponding to the label interpretation text in each sentence_2 .

Further, after obtaining the sentence pair corresponding to each historical exception log, as shown in FIG. 3 , the data analysis system can obtain at least one tag interpretation text corresponding to each preset exception type tag, and generate an interpretation dictionary. The format of each pair of entries in the interpretation dictionary is as follows:

{

"label": [Explanation 1, ···, Explanation N],

"Label Coping": [Coping 1, ..., Coping M]

}

Among them, [Explanation 1,...,Explanation N] indicates the exception detail information of the corresponding preset exception type label in the label explanation text, [Response 1,...,Response M] indicates the corresponding preset in the label explanation text An exception solution for exception type labels. When there are only explanations or only labels in the label explanation text, M+N label explanation texts can be generated. When there are only explanations and labels in the label explanation text, it can be generated. M*N pieces of label explanation text, when the label explanation text can have only explanation or only label, or only explanation and label, M*N+M+N pieces of label explanation text can be generated.

After that, based on the interpretation dictionary, the content corresponding to sentence_2 in the aforementioned sentence pair is expanded. That is, for any historical abnormal log, if the abnormal type in the corresponding sentence pair corresponds to a variety of the aforementioned label interpretation texts, a sentence pair corresponding to the historical abnormal log can be generated based on each label interpretation text, so that the A historical anomaly log has multiple corresponding sentence pairs belonging to the same anomaly type, thereby realizing text expansion. It should be noted that, in the process of the aforementioned text expansion, the data analysis system can, based on the actual situation and the amount of data of each abnormal type, level the unbalanced data distribution, that is, in the final obtained multiple expanded historical abnormal logs. (that is, sentence pairs), the amount of data of each abnormal type is uniformly distributed.

It should be noted that, by expanding the historical abnormal log based on at least one label explanation text corresponding to each preset abnormal type label, the effective expansion of the historical abnormal log is realized, and the data distribution in the training data is avoided. Improve the robustness of the target language model.

It should be noted that, in this application, on the one hand, based on the description text of the system logic in the exception log, the TF-IDF algorithm is used to carry out the text vectorized representation, and the K-Means clustering algorithm is used to realize a large-scale and fast Exceptions and errors are automatically induced, on the other hand. Based on the BERT model, the description text of the system logic in the exception log and the description text of the system state are combined for modeling, which can comprehensively expose the relationship between the status and logical hidden dangers in the exception log, and automatically locate the problem. On the other hand, Converting the multi-classification task into a sentence pair similarity judgment task and expanding the data can effectively improve the robustness of the abnormal log problem localization method.

It can be seen that the solution provided by the present application achieves the purpose of locating the abnormal problem of the abnormal log to be processed based on the target language model, thereby achieving the technical effect of improving the analysis efficiency of the abnormal log, and solving the problem of relying on the existing technology. The technical problem of poor analysis efficiency caused by manual analysis of log files.

Example 2

According to an embodiment of the present invention, an embodiment of an abnormal log analysis apparatus is provided, wherein FIG. 4 is a schematic diagram of an optional abnormal log analysis apparatus according to an embodiment of the present invention. As shown in FIG. 4 , the The device includes:

An acquisition module 401, configured to acquire a pending exception log generated when an exception occurs in the system;

The input module 402 is used to input the to-be-processed exception log into the target language model obtained by pre-training to obtain a plurality of first-dimensional vectors, wherein each first-dimensional vector represents the to-be-processed exception log and the to-be-processed exception log corresponding The similarity probability of each sentence pair of , each sentence pair is generated by the combination of the pending exception log and a label interpretation text, and the label interpretation text includes at least the exception details and/or exception solutions of the preset exception type labels;

The first determination module 403 is used to determine the target first-dimension vector with the largest similarity probability from the plurality of first-dimension vectors, and extract the target label explanation text from the sentence pair corresponding to the target first-dimension vector;

The second determination module 404 is configured to use the target tag interpretation text as the analysis result of the exception log to be processed.

It should be noted that the acquisition module 401 , the input module 402 , the first determination module 403 and the second determination module 404 correspond to steps S101 to S104 in the above embodiment, and the examples and The application scenarios are the same, but are not limited to the content disclosed in the above Embodiment 1.

Optionally, each first-dimension vector in the plurality of first-dimension vectors corresponds to a second-dimension vector respectively, wherein the second-dimension vector represents the difference between the to-be-processed exception log and each sentence pair corresponding to the to-be-processed exception log. dissimilarity probability.

Optionally, the abnormal log analysis device further includes: a first sub-acquisition module for acquiring a plurality of historical abnormal logs, wherein each historical abnormal log contains at least a description text of the system logic, wherein the description text of the system logic It includes at least description information of the event that causes an exception to occur in the system; the first processing module is used to perform vectorized processing on each historical exception log according to the description text of the system logic, and obtain a semantic vector corresponding to each historical exception log.

Optionally, the first processing module further includes: a statistics module for counting the first frequency of each word appearing in each historical exception log in the description text of the system logic and the occurrence rate of each word in all historical exception logs. the second frequency; the first calculation module is used for calculating the weight value of each word in each historical abnormal log according to the first frequency and the second frequency; the second calculation module is used for, in each historical abnormal log, The weight value of each word and the word semantic vector of each word are weighted and summed to obtain the semantic vector corresponding to each historical abnormal log.

Optionally, the abnormal log analysis device further includes: a second processing module, configured to perform clustering processing on semantic vectors corresponding to multiple historical abnormal logs, to obtain the abnormal type corresponding to each historical abnormal log, wherein each abnormal The type corresponds to at least one historical exception log; the second sub-acquisition module is used to obtain the preset exception type label corresponding to each exception type, and mark the preset exception type label on the corresponding historical exception log to obtain the marked history An exception log, wherein one exception type corresponds to a preset exception type label; the third processing module is used to train a target language model according to the marked historical exception log.

Optionally, the third processing module further includes: a text expansion module, which is used to perform text expansion on the marked historical abnormal log to obtain the expanded historical abnormal log, wherein the expanded historical abnormal log includes at least: system logic; The description text, the description text of the system state, and the label interpretation text of the preset exception type label; the fourth processing module is used for training the initial language model based on the expanded historical exception log to obtain the target language model.

Optionally, the text expansion module further includes: a third sub-acquisition module for acquiring the label interpretation text of the preset exception type labels, wherein each preset exception type label corresponds to at least one label interpretation text; the fifth processing module , which is used to add each label interpretation text to each annotated historical exception log corresponding to the corresponding preset exception type label when one preset exception type label corresponds to multiple label interpretation texts , to get multiple expanded historical exception logs.

Optionally, the exception log to be processed includes at least a description text of the system logic and a description text of the system state, and the input module further includes: a sixth processing module, which is used to control the target language model in at least one corresponding to each preset exception type label. Obtain a tag interpretation text to be combined from the tag interpretation text, and insert a preset separator between the description text of the system logic, the description text of the system state, and the tag interpretation text to be combined to obtain the target text. A preset sentence head tag is inserted at the first position to obtain a sentence pair corresponding to each preset exception type tag, and a plurality of first-dimensional vectors are generated based on the sentence pair corresponding to each preset exception type tag.

Example 3

According to another aspect of the embodiments of the present invention, a computer-readable storage medium is also provided, where the computer-readable storage medium includes a stored program, wherein when the program is run, the device where the computer-readable storage medium is located is controlled to execute the above exception log method of analysis.

Example 4

According to another aspect of the embodiment of the present invention, an electronic device is also provided, wherein FIG. 5 is a schematic diagram of an optional electronic device according to an embodiment of the present invention. As shown in FIG. 5 , the electronic device includes a memory and a The processor has a computer program stored in the memory, and the processor is configured to run the computer program to execute the above-mentioned method for analyzing the abnormal log.

The above-mentioned serial numbers of the embodiments of the present invention are only for description, and do not represent the advantages or disadvantages of the embodiments.

In the above-mentioned embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference may be made to related descriptions of other embodiments.

In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. The device embodiments described above are only illustrative, for example, the division of units may be a logical function division, and there may be other division methods in actual implementation, for example, multiple units or components may be combined or integrated into Another system, or some features can be ignored, or not implemented. On the other hand, the shown or discussed mutual coupling or direct coupling or communication connection may be through some interfaces, indirect coupling or communication connection of units or modules, and may be in electrical or other forms.

Units described as separate components may or may not be physically separated, and components shown as units may or may not be physical units, that is, may be located in one place, or may be distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution in this embodiment.

In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically alone, or two or more units may be integrated into one unit. The above-mentioned integrated units may be implemented in the form of hardware, or may be implemented in the form of software functional units.

The integrated unit, if implemented as a software functional unit and sold or used as a stand-alone product, may be stored in a computer-readable storage medium. Based on such understanding, the technical solution of the present invention is essentially or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium , including several instructions for causing a computer device (which may be a personal computer, a server, or a network device, etc.) to execute all or part of the steps of the methods of the various embodiments of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes .

The above are only the preferred embodiments of the present invention. It should be pointed out that for those skilled in the art, some improvements and modifications can be made without departing from the principles of the present invention, and these improvements and modifications should also be regarded as It is the protection scope of the present invention.

Claims (11)

1. an analysis method of abnormal log, is characterized in that, comprises: Obtain the pending exception log generated when an exception occurs in the system; Input the to-be-processed exception log into the target language model obtained by pre-training to obtain a plurality of first-dimensional vectors, wherein each first-dimensional vector represents the to-be-processed exception log corresponding to the to-be-processed exception log The similarity probability of each sentence pair of the solution; Determine the target first-dimensional vector with the largest similarity probability from the plurality of first-dimensional vectors, and extract the target label explanation text from the sentence pair corresponding to the target first-dimensional vector; The target label interpretation text is used as the analysis result of the exception log to be processed. 2 . The method according to claim 1 , wherein each first-dimensional vector in the plurality of first-dimensional vectors corresponds to a second-dimensional vector, wherein the second-dimensional vector represents the The dissimilarity probability of each sentence pair corresponding to the exception log to be processed and the exception log to be processed. 3. The method according to claim 1, characterized in that, before inputting the to-be-processed exception log into the target language model obtained by pre-training, the method further comprises: Acquiring a plurality of historical exception logs, wherein each historical exception log contains at least a description text of the system logic, wherein the description text of the system logic at least includes description information of the event that caused the abnormality of the system; Perform vectorization processing on each historical exception log according to the description text of the system logic to obtain a semantic vector corresponding to each historical exception log. 4. The method according to claim 3, characterized in that, performing vectorization processing on each historical exception log according to the description text of the system logic to obtain a semantic vector corresponding to each historical exception log, comprising: : Counting the first frequency of each word in the description text of the system logic appearing in each of the historical abnormal logs and the second frequency of each word appearing in all historical abnormal logs; Calculate the weight value of each word in each historical abnormal log according to the first frequency and the second frequency; In each historical abnormal log, weighted summation is performed on the weight value of each word and the word semantic vector of each word to obtain a semantic vector corresponding to each historical abnormal log. 5. The method according to claim 3, characterized in that, after performing vectorization processing on each historical exception log according to the description text of the system logic to obtain a semantic vector corresponding to each historical exception log , the method also includes: Perform clustering processing on the semantic vectors corresponding to the plurality of historical abnormal logs to obtain the abnormal type corresponding to each historical abnormal log, wherein each abnormal type corresponds to at least one historical abnormal log; Obtain the preset abnormality type label corresponding to each abnormality type, and mark the preset abnormality type label on the corresponding historical abnormality log to obtain the marked historical abnormality log, wherein one abnormality type is associated with a predetermined abnormality type. Set the exception type label to correspond; The target language model is obtained by training according to the marked historical abnormal log. 6. The method according to claim 5, wherein the target language model is obtained by training according to the marked historical abnormal log, comprising: Perform text expansion on the marked historical abnormal log to obtain the expanded historical abnormal log, wherein the expanded historical abnormal log at least includes: the description text of the system logic, the description text of the system state, and the description text of the system state. The label explanation text of the preset exception type label; An initial language model is trained based on the expanded historical exception log to obtain the target language model. 7. The method according to claim 6, wherein the marked historical abnormal log is subjected to text expansion to obtain the expanded historical abnormal log, comprising: Obtain the label interpretation text of the preset exception type label, wherein each preset exception type label corresponds to at least one label interpretation text; In the case where one preset exception type label corresponds to multiple label explanation texts, each label explanation text is added to each marked historical exception log corresponding to the corresponding preset exception type label, and multiple labels are obtained. An expanded historical exception log. 8. The method according to claim 1, wherein the exception log to be processed comprises at least a description text of the system logic and a description text of the system state, wherein the exception log to be processed is input into a pre-trained In the target language model, multiple first-dimensional vectors are obtained, including: The target language model is controlled to obtain a tag interpretation text to be combined from at least one tag interpretation text corresponding to each preset exception type tag, and the description text of the system logic, the description text of the system state, and all Insert a preset separator between the label interpretation texts to be combined to obtain the target text, insert a preset sentence start label at the sentence start position of the target text, and obtain the sentence pair corresponding to each preset abnormal type label, based on The plurality of first-dimensional vectors are generated for the sentence pairs corresponding to each of the preset abnormality type labels. 9. A device for analyzing abnormal logs, wherein the device comprises: The acquisition module is used to acquire the pending exception log generated when an exception occurs in the system; The input module is used to input the pending exception log into the target language model obtained by pre-training, and obtain a plurality of first-dimensional vectors, wherein each first-dimensional vector represents the pending exception log and the pending exception log. Similar probability of each sentence pair corresponding to the processing exception log, each sentence pair is generated by combining the pending exception log and a label interpretation text, the label interpretation text at least includes the exception details of the preset exception type label Information and/or exception resolution; a first determination module, configured to determine the target first-dimensional vector with the largest similarity probability from the plurality of first-dimensional vectors, and extract the target label explanation text from the sentence pair corresponding to the target first-dimensional vector; The second determination module is configured to use the target label interpretation text as the analysis result of the exception log to be processed. 10. A computer-readable storage medium, characterized in that the computer-readable storage medium comprises a stored program, wherein when the program is run, a device where the computer-readable storage medium is located is controlled to execute claims 1 to 8 The analysis method of the abnormal log described in any one of the above. 11. An electronic device comprising a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the computer program to execute the computer program according to any one of claims 1 to 8. The analysis method of the exception log described above.

Images