CN116089563B

CN116089563B - Log processing method and related device

Info

Publication number: CN116089563B
Application number: CN202210899465.XA
Authority: CN
Inventors: 路来承
Original assignee: Honor Device Co Ltd
Current assignee: Honor Device Co Ltd
Priority date: 2022-07-28
Filing date: 2022-07-28
Publication date: 2024-03-26
Anticipated expiration: 2042-07-28
Also published as: CN116089563A

Abstract

The application provides a log processing method and a related device, and relates to the technical field of terminals. The log processing method comprises the following steps: acquiring log data to be processed uploaded by a terminal device, wherein the log data to be processed comprises a plurality of rows of logs; according to preset key characters, extracting abnormal log data in log data to be processed, wherein the abnormal log data comprise relevant data of a process operated by terminal equipment when abnormality occurs, and the relevant data comprise: the method comprises the steps that logs belonging to the same row with hardware identifiers in log data to be processed, logs belonging to the same row with kernel offset identifiers in the log data to be processed, and a plurality of rows of exception logs identified by exception identifiers in the log data to be processed, wherein the exception logs of the plurality of rows represent exception reasons of hardware corresponding to the hardware identifiers; the exception log data is converted into a core dump file for visualization tool load analysis. The method and the device can improve the analysis efficiency of the abnormality reasons of the terminal equipment and reduce the analysis difficulty.

Description

Log processing method and related device

Technical Field

The present disclosure relates to the field of terminal technologies, and in particular, to a log processing method and a related device.

Background

Various abnormal problems can occur in the use process of the terminal equipment, such as the problem of dead halt and restarting, the abnormal problems that data cannot be transmitted, a screen is black and the like. When the terminal equipment is abnormal, log data generated in the last running process of the kernel are stored, and the log data can be sent to the back-end equipment for related personnel to analyze the reasons of the abnormality through the back-end equipment.

In the related art, log data stored in the terminal device is a multi-line log in a text format. Therefore, when the related person analyzes the cause of the abnormality from the log data, the analysis is required line by line, and there is a problem in that the analysis efficiency is low.

Disclosure of Invention

The embodiment of the application provides a log processing method and a related device, which can improve the analysis efficiency of a log generated when a terminal device is abnormal.

In a first aspect, an embodiment of the present application provides a log processing method, where the method includes: acquiring log data to be processed uploaded by a terminal device, wherein the log data to be processed comprises a plurality of rows of logs; extracting abnormal log data in log data to be processed according to preset key characters, wherein the preset key characters comprise: hardware identification, kernel offset identification and exception identification, wherein the exception log data comprises relevant data of a process operated by the terminal equipment when an exception occurs, and the relevant data comprises: the method comprises the steps that logs belonging to the same row with hardware identifiers in log data to be processed, logs belonging to the same row with kernel offset identifiers in the log data to be processed, and a plurality of rows of exception logs identified by exception identifiers in the log data to be processed, wherein the exception logs of the plurality of rows represent exception reasons of hardware corresponding to the hardware identifiers; the exception log data is converted into a core dump file for visualization tool load analysis.

Therefore, the abnormal log in the log data to be processed can be converted into the core dump file, and the core dump file is loaded and analyzed through the visualization tool, so that the analysis efficiency of the abnormal reasons of the terminal equipment can be improved, and the analysis difficulty is reduced.

In a possible implementation manner, extracting abnormal log data in log data to be processed according to preset key characters includes: according to a preset core dump identifier, filtering log data to be processed to obtain first intermediate log data, wherein each row of log in the first intermediate log data comprises: core dump identification; and extracting abnormal log data in the first intermediate log data according to the preset key characters.

Thus, the log data to be processed can be primarily filtered, the accuracy of the subsequently obtained abnormal log data is realized, and the interference of other logs on the analysis of the abnormal log data is avoided.

In a possible implementation manner, extracting abnormal log data in the first intermediate log data according to preset key characters includes: zero padding is carried out on empty characters in the first intermediate log data, so that second intermediate log data are obtained; and extracting abnormal log data in the second intermediate log data according to the preset key characters.

Therefore, the abnormal log data can be more complete, and the data with zero characters does not need to be acquired during the preliminary filtering, so that the filtering efficiency is improved.

In a possible implementation, the log belonging to the same row as the exception identifier includes: a starting position of the multi-line exception log and a data length of the multi-line exception log, the multi-line exception log comprising: the second intermediate log data includes a log of the data length from the start position.

Thus, a more complete log indicating the cause of the abnormality of the terminal equipment can be obtained.

In one possible implementation, converting exception log data into a core dump file includes: the exception log data is converted from a text format to a core dump file in a binary executable format and a core dump file in a loadable script format.

In this way, obtaining the core dump file in binary executable format and the core dump file in loadable script format enables the visualization tool to load and analyze and display to the analyst.

In one possible implementation, the hardware identification includes: at least one of a register identification, a memory identification, a stack identification, a central processor identification, a process identification, and a lock state identification.

Thus, the abnormality generated by various hardware of the terminal device can be analyzed respectively.

In one possible implementation, the visualization tool includes: trace32 analysis tool.

Therefore, the trace32 analysis tool can perform visual analysis on the core dump file, so that the analysis efficiency is improved, and the analysis difficulty is reduced.

In a second aspect, an embodiment of the present application provides a log processing method, where the method includes: acquiring a core dump file, wherein the core dump file is obtained according to the log processing method of any one of the first aspect; the core dump file is analyzed using a visualization tool load.

Therefore, the core dump file obtained in the first aspect can be loaded and analyzed, so that the analysis efficiency is improved, and the analysis difficulty is reduced.

In a third aspect, an embodiment of the present application provides a log processing method, applied to a terminal device, where the method includes: in case of abnormality of the terminal device, determining a target abnormality type of the terminal device, the target abnormality type including: at least one of data anomalies, hang-ups, external anomalies; determining at least one target hardware corresponding to the target abnormal type according to the corresponding relation between the pre-stored abnormal type and the hardware; determining the log data of the target hardware as log data to be processed; and sending the log data to be processed to the back-end equipment.

Thus, log data of various hardware can be comprehensively obtained, log data to be processed is generated, and further the back-end equipment analyzes and processes the log data to be processed.

In a fourth aspect, an embodiment of the present application provides a log processing apparatus, where the log processing apparatus may be a terminal device, or may be a chip or a chip system in the terminal device. The log processing device may include a display unit, a processing unit, and an integrated circuit IC. When the log processing means is a terminal device, the display unit may be a display screen. The display unit is configured to perform the step of displaying, so that the terminal device implements the first aspect or any one of the possible implementation manners of the first aspect, or the display-related method described in the second aspect and the third aspect, and the processing unit is configured to implement the first aspect or any one of the possible implementation manners of the first aspect or any one of the method related to processing in the second aspect and the third aspect. When the log processing means is a terminal device, the processing unit may be a processor. The log processing device may further include a storage unit, which may be a memory. The storage unit is configured to store instructions, and the processing unit executes the instructions stored in the storage unit, so that the terminal device implements the first aspect or any one of possible implementation manners of the first aspect, or a method described in the second aspect and the third aspect. When the log processing means is a chip or a system of chips within the terminal device, the processing unit may be a processor. The processing unit executes the instructions stored by the storage unit to cause the terminal device to implement the first aspect or any one of the possible implementation manners of the first aspect or a method described in the second aspect and the third aspect. The memory unit may be a memory unit (e.g., a register, a cache, etc.) in the chip, or a memory unit (e.g., a read-only memory, a random access memory, etc.) located outside the chip in the terminal device.

Wherein the main body performing the first aspect or any one of the possible implementation manners of the first aspect and the method of the second aspect is a back-end device, and the back-end device may also be a terminal device.

The processing unit is used for obtaining log data to be processed, which is uploaded by the terminal equipment, wherein the log data to be processed comprises a plurality of rows of logs; extracting abnormal log data in log data to be processed according to preset key characters, wherein the preset key characters comprise: hardware identification, kernel offset identification and exception identification, wherein the exception log data comprises relevant data of a process operated by the terminal equipment when an exception occurs, and the relevant data comprises: the method comprises the steps that logs belonging to the same row with hardware identifiers in log data to be processed, logs belonging to the same row with kernel offset identifiers in the log data to be processed, and a plurality of rows of exception logs identified by exception identifiers in the log data to be processed, wherein the exception logs of the plurality of rows represent exception reasons of hardware corresponding to the hardware identifiers; the exception log data is converted into a core dump file for visualization tool load analysis.

In a possible implementation manner, the processing unit is specifically configured to: according to a preset core dump identifier, filtering log data to be processed to obtain first intermediate log data, wherein each row of log in the first intermediate log data comprises: core dump identification; and extracting abnormal log data in the first intermediate log data according to the preset key characters.

In a possible implementation manner, the processing unit is specifically configured to: zero padding is carried out on empty characters in the first intermediate log data, so that second intermediate log data are obtained; and extracting abnormal log data in the second intermediate log data according to the preset key characters.

In a possible implementation manner, the processing unit is specifically configured to: the exception log data is converted from a text format to a core dump file in a binary executable format and a core dump file in a loadable script format.

Illustratively, the processing unit is configured to obtain a core dump file, where the core dump file is obtained according to the log processing method of any one of claims 1 to 7; the core dump file is analyzed using a visualization tool load.

The processing unit is configured to determine, in the case of an abnormality of the terminal device, a target abnormality type of the terminal device, where the target abnormality type includes: at least one of data anomalies, hang-ups, external anomalies; determining at least one target hardware corresponding to the target abnormal type according to the corresponding relation between the pre-stored abnormal type and the hardware; determining the log data of the target hardware as log data to be processed; and sending the log data to be processed to the back-end equipment.

In a fifth aspect, embodiments of the present application provide an electronic device, including a processor and a memory, the memory being configured to store code instructions, the processor being configured to execute the code instructions to perform the first aspect or any one of the possible implementations of the first aspect or the methods described in the second and third aspects.

In a sixth aspect, embodiments of the present application provide a computer readable storage medium, in which a computer program or instructions are stored which, when run on a computer, cause the computer to perform the first aspect or any one of the possible implementations of the first aspect or the log processing method described in the second and third aspects.

In a seventh aspect, embodiments of the present application provide a computer program product comprising a computer program which, when run on a computer, causes the computer to perform the log processing method described in the first aspect or any one of the possible implementations of the first aspect or the second aspect, the third aspect.

In an eighth aspect, the present application provides a chip or chip system comprising at least one processor and a communication interface, the communication interface and the at least one processor being interconnected by wires, the at least one processor being for running a computer program or instructions to perform the log processing method described in the first aspect or any one of the possible implementations of the first aspect or the second aspect, the third aspect. The communication interface in the chip can be an input/output interface, a pin, a circuit or the like.

In one possible implementation, the chip or chip system described above in the present application further includes at least one memory, where the at least one memory has instructions stored therein. The memory may be a memory unit within the chip, such as a register, a cache, etc., or may be a memory unit of the chip (e.g., a read-only memory, a random access memory, etc.).

It should be understood that, the fourth to eighth aspects of the present application correspond to the technical solutions of the first to third aspects of the present application, and the advantages obtained by each aspect and the corresponding possible embodiments are similar, and are not repeated.

Drawings

FIG. 1 is a schematic view of a scene to which the embodiments of the present application are applied;

fig. 2 is a schematic diagram of a method for implementing log processing according to an embodiment of the present application;

fig. 3 is a schematic structural diagram of an electronic device according to an embodiment of the present application;

FIG. 4 is a flowchart illustrating steps of a log processing method according to an embodiment of the present disclosure;

FIG. 5 is a schematic diagram of log data to be processed according to an embodiment of the present disclosure;

FIG. 6 is a schematic diagram of an exception log data according to an embodiment of the present disclosure;

FIG. 7 is a schematic diagram of first intermediate log data according to an embodiment of the present disclosure;

FIG. 8 is a schematic diagram of obtaining exception log data from second intermediate log data according to an embodiment of the present disclosure;

FIG. 9 is a flowchart illustrating steps of another log processing method according to an embodiment of the present disclosure;

FIG. 10 is a flowchart illustrating steps of a log processing method according to an embodiment of the present disclosure;

fig. 11 is a schematic structural diagram of a chip according to an embodiment of the present application.

Detailed Description

In order to facilitate the clear description of the technical solutions of the embodiments of the present application, the following simply describes some terms and techniques related to the embodiments of the present application:

1. log (log): is a record of the processing of a system or hardware when executing a software program, in text format (TXT).

2. Core dump file (coredump file): recording state data of the program of the terminal equipment when writing abnormality occurs, and loading and analyzing the state data by a trace32 analysis tool.

3. trace32 analysis tool: the system simulator is a truly integrated and universal system simulator which can be combined into various schemes, can support a network scheme, a laboratory single machine scheme, a remote optical fiber scheme and the like, has a fully modularized and building block structure, can support JTAG interfaces ((Joint Test Action Group, joint test working group)) and BDM (Background Debugging Mode Chinese name background debugging mode) interfaces and all CPUs (central processing unit, central processing units) and can provide software analysis, port analysis, waveform analysis, software test and the like.

4. MICRO-DUMP: a custom identification in log data to be processed.

5. And (2) elf: is a file format of binary files, executable files, object codes, shared libraries and core dump format files.

6. Script: is an executable file written according to a certain format using a specific descriptive language.

7. Other terms

In the embodiments of the present application, the words "first," "second," and the like are used to distinguish between identical or similar items that have substantially the same function and effect. For example, the first chip and the second chip are merely for distinguishing different chips, and the order of the different chips is not limited. It will be appreciated by those of skill in the art that the words "first," "second," and the like do not limit the amount and order of execution, and that the words "first," "second," and the like do not necessarily differ.

It should be noted that, in the embodiments of the present application, words such as "exemplary" or "such as" are used to mean serving as an example, instance, or illustration. Any embodiment or design described herein as "exemplary" or "for example" should not be construed as preferred or advantageous over other embodiments or designs. Rather, the use of words such as "exemplary" or "such as" is intended to present related concepts in a concrete fashion.

In the embodiments of the present application, "at least one" means one or more, and "a plurality" means two or more. "and/or", describes an association relationship of an association object, and indicates that there may be three relationships, for example, a and/or B, and may indicate: a alone, a and B together, and B alone, wherein a, B may be singular or plural. The character "/" generally indicates that the context-dependent object is an "or" relationship. "at least one of" or the like means any combination of these items, including any combination of single item(s) or plural items(s). For example, at least one (one) of a, b, or c may represent: a, b, c, a-b, a-c, b-c, or a-b-c, wherein a, b, c may be single or plural.

With the development of terminal equipment technology, the functions of the terminal equipment are more and more powerful, so that various anomalies such as data anomalies, active loopholes, hanging-up and external anomalies and the like can occur in the use process of the terminal equipment. To analyze the substantial cause of these anomalies, it is necessary to call the process running when the anomaly occurs, but the state of the running process is recorded in a log manner in the related art. If an analyst analyzes the cause of the abnormality through the log, the log needs to be analyzed row by row, and the problem of low analysis efficiency and high analysis difficulty exists. Applications (APP) are becoming increasingly abundant in variety and in number. With the use of the application.

By way of example, FIG. 1 shows an application scenario diagram of a log processing method. For example, when the user uses the terminal device 11, the terminal device 11 is abnormal, such as when the user clicks an icon on the desktop of the terminal device, no feedback is provided, that is, a crash occurs. When the terminal device 11 returns to normal, the log when the abnormality occurs is used as log data to be processed to the back-end device 12, the back-end device 12 processes the log data to be processed to obtain a core dump file, and the core dump file is loaded and analyzed by adopting a visualization tool and displayed, wherein the core dump file is loaded and analyzed in a plurality of areas at the back-end device. The back-end device 12 can interact with an analyst, so that the analyst can efficiently and quickly analyze the reasons of the abnormality.

In one implementation, as shown in fig. 2, a back-end device includes: the system comprises a communication module, a conversion module and a visual analysis module. The communication module may be a wireless communication module, such as a wireless local area network (wirelesslocal area networks, WLAN), and the communication module is responsible for receiving the log data to be processed uploaded by the terminal device, and the conversion module is responsible for converting the log data to be processed into a core dump file, whereas the chemical analysis module is responsible for loading and analyzing the core dump file. The conversion module is used for carrying out preliminary filtration on log data to be processed, carrying out extraction on abnormal daily data on vacancy supplement and preset key characters to obtain abnormal log data, and then converting the abnormal log data into a core dump file.

Based on the application scenario and the technical problems, the embodiment of the application provides a log processing method, which is used for obtaining abnormal log data by carrying out preliminary filtration on log data to be processed uploaded by terminal equipment and extracting abnormal daily data by vacancy retrieval and preset key characters, and then converting the abnormal log data into a core dump file for loading analysis of a visualization tool, so that the analysis efficiency is improved, and the analysis difficulty is reduced.

The terminal device in the embodiment of the present application may also be any form of electronic device, for example, the electronic device may include a handheld device with an image processing function, an in-vehicle device, and the like. For example, some electronic devices are: a mobile phone, tablet, palm, notebook, mobile internet device (mobile internet device, MID), wearable device, virtual Reality (VR) device, augmented reality (augmented reality, AR) device, wireless terminal in industrial control (industrial control), wireless terminal in unmanned (self driving), wireless terminal in teleoperation (remote medical surgery), wireless terminal in smart grid (smart grid), wireless terminal in transportation security (transportation safety), wireless terminal in smart city (smart city), wireless terminal in smart home (smart home), cellular phone, cordless phone, session initiation protocol (session initiation protocol, SIP) phone, wireless local loop (wireless local loop, WLL) station, personal digital assistant (personal digital assistant, PDA), handheld device with wireless communication function, public computing device or other processing device connected to wireless modem, vehicle-mounted device, wearable device, terminal device in 5G network or evolving land mobile terminal (public land mobile network), and the like, without limiting the examples of this.

By way of example, and not limitation, in embodiments of the present application, the electronic device may also be a wearable device. The wearable device can also be called as a wearable intelligent device, and is a generic name for intelligently designing daily wear by applying wearable technology and developing wearable devices, such as glasses, gloves, watches, clothes, shoes and the like. The wearable device is a portable device that is worn directly on the body or integrated into the clothing or accessories of the user. The wearable device is not only a hardware device, but also can realize a powerful function through software support, data interaction and cloud interaction. The generalized wearable intelligent device includes full functionality, large size, and may not rely on the smart phone to implement complete or partial functionality, such as: smart watches or smart glasses, etc., and focus on only certain types of application functions, and need to be used in combination with other devices, such as smart phones, for example, various smart bracelets, smart jewelry, etc. for physical sign monitoring.

In addition, in the embodiment of the application, the electronic device may also be a terminal device in an internet of things (internet of things, ioT) system, and the IoT is an important component of future information technology development, and the main technical characteristic of the IoT is that the article is connected with a network through a communication technology, so that man-machine interconnection and an intelligent network for internet of things are realized.

The electronic device in the embodiment of the application may also be referred to as: a terminal device, a User Equipment (UE), a Mobile Station (MS), a Mobile Terminal (MT), an access terminal, a subscriber unit, a subscriber station, a mobile station, a remote terminal, a mobile device, a user terminal, a wireless communication device, a user agent, a user equipment, or the like.

In an embodiment of the present application, the electronic device or each network device includes a hardware layer, an operating system layer running above the hardware layer, and an application layer running above the operating system layer. The hardware layer includes hardware such as a central processing unit (central processing unit, CPU), a memory management unit (memory management unit, MMU), and a memory (also referred to as a main memory). The operating system may be any one or more computer operating systems that implement business processes through processes (processes), such as a Linux operating system, a Unix operating system, an Android operating system, an iOS operating system, or a windows operating system. The application layer comprises applications such as a browser, an address book, word processing software, instant messaging software and the like.

By way of example, fig. 3 shows a schematic structural diagram of the electronic device 100.

The electronic device 100 may include a processor 110, an external memory interface 120, an internal memory 121, a universal serial bus (universal serial bus, USB) interface 130, a charge management module 140, a power management module 141, a battery 142, an antenna 1, an antenna 2, a mobile communication module 150, a wireless communication module 160, an audio module 170, a speaker 170A, a receiver 170B, a microphone 170C, an earphone interface 170D, a sensor module 180, keys 190, a motor 191, an indicator 192, a camera 193, a display 194, and a subscriber identity module (subscriber identification module, SIM) card interface 195, etc. The sensor module 180 may include a pressure sensor 180A, a gyro sensor 180B, an air pressure sensor 180C, a magnetic sensor 180D, an acceleration sensor 180E, a distance sensor 180F, a proximity sensor 180G, a fingerprint sensor 180H, a temperature sensor 180J, a touch sensor 180K, an ambient light sensor 180L, a bone conduction sensor 180M, and the like.

It should be understood that the illustrated structure of the embodiment of the present invention does not constitute a specific limitation on the electronic device 100. In other embodiments of the present application, electronic device 100 may include more or fewer components than shown, or certain components may be combined, or certain components may be split, or different arrangements of components. The illustrated components may be implemented in hardware, software, or a combination of software and hardware.

The processor 110 may include one or more processing units, such as: the processor 110 may include an application processor (application processor, AP), a modem processor, a graphics processor (graphics processing unit, GPU), an image signal processor (image signal processor, ISP), a controller, a video codec, a digital signal processor (digital signal processor, DSP), a baseband processor, and/or a neural network processor (neural-network processing unit, NPU), etc. Wherein the different processing units may be separate devices or may be integrated in one or more processors.

The controller can generate operation control signals according to the instruction operation codes and the time sequence signals to finish the control of instruction fetching and instruction execution.

A memory may also be provided in the processor 110 for storing instructions and data. In some embodiments, the memory in the processor 110 is a cache memory. The memory may hold instructions or data that the processor 110 has just used or recycled. If the processor 110 needs to reuse the instruction or data, it may be called directly from memory. Repeated accesses are avoided and the latency of the processor 110 is reduced, thereby improving the efficiency of the system.

In some embodiments, the processor 110 may include one or more interfaces. The interfaces may include an integrated circuit (inter-integrated circuit, I2C) interface, an integrated circuit built-in audio (inter-integrated circuit sound, I2S) interface, a pulse code modulation (pulse code modulation, PCM) interface, a universal asynchronous receiver transmitter (universal asynchronous receiver/transmitter, UART) interface, a mobile industry processor interface (mobile industry processor interface, MIPI), a general-purpose input/output (GPIO) interface, a subscriber identity module (subscriber identity module, SIM) interface, and/or a universal serial bus (universal serial bus, USB) interface, among others.

It should be understood that the interfacing relationship between the modules illustrated in the embodiments of the present invention is only illustrative, and is not meant to limit the structure of the electronic device 100. In other embodiments of the present application, the electronic device 100 may also use different interfacing manners, or a combination of multiple interfacing manners in the foregoing embodiments.

The electronic device 100 implements display functions through a GPU, a display screen 194, an application processor, and the like. The GPU is a microprocessor for image processing, and is connected to the display 194 and the application processor. The GPU is used to perform mathematical and geometric calculations for graphics rendering. Processor 110 may include one or more GPUs that execute program instructions to generate or change display information.

The display screen 194 is used to display images, videos, and the like. The display 194 includes a display panel. The display panel may employ a liquid crystal display (liquid crystal display, LCD), an organic light-emitting diode (OLED), an active-matrix or active-matrix organic light-emitting diode (AMOLED), a flexible light-emitting diode (flex), a mini, micro led, micro-OLED, quantum dot light-emitting diode (quantum dot lightemitting diodes, QLED), a low-temperature polycrystalline oxide (low temperature polycrystalline oxide, LTPO), or the like. In some embodiments, the electronic device 100 may include 1 or N display screens 194, N being a positive integer greater than 1.

The electronic device 100 may implement photographing functions through an ISP, a camera 193, a video codec, a GPU, a display screen 194, an application processor, and the like.

The external memory interface 120 may be used to connect an external memory card, such as a Micro SD card, to enable expansion of the memory capabilities of the electronic device 100. The external memory card communicates with the processor 110 through an external memory interface 120 to implement data storage functions. For example, files such as music, video, etc. are stored in an external memory card.

The internal memory 121 may be used to store computer-executable program code that includes instructions. The internal memory 121 may include a storage program area and a storage data area. The storage program area may store an application program (such as a sound playing function, an image playing function, etc.) required for at least one function of the operating system, etc. The storage data area may store data created during use of the electronic device 100 (e.g., audio data, phonebook, etc.), and so on. In addition, the internal memory 121 may include a high-speed random access memory, and may further include a nonvolatile memory such as at least one magnetic disk storage device, a flash memory device, a universal flash memory (universal flash storage, UFS), and the like. The processor 110 performs various functional applications of the electronic device 100 and data processing by executing instructions stored in the internal memory 121 and/or instructions stored in a memory provided in the processor. The electronic device may further comprise an IC chip (not shown in the figures) for driving the display of the display screen.

The log processing method of the embodiment of the present application is described in detail below by means of specific embodiments. The following embodiments may be combined with each other or implemented independently, and the same or similar concepts or processes may not be described in detail in some embodiments.

Referring to fig. 4, S401 to S403 exemplarily illustrate a log processing method in the embodiment of the present application, which is applied to a back-end device, where the back-end device may interact with an analyst to analyze an abnormality cause of a terminal device. The specific log processing method comprises the following steps:

s401: and acquiring log data to be processed uploaded by the terminal equipment.

Wherein the log data to be processed comprises a multi-line log. The log data to be processed is a file in a text format, and can be opened by using a notepad and the content in the log data can be checked.

Specifically, the log data to be processed may be generated when the user uses the terminal device, or may be generated when the developer tests the terminal device. The log data to be processed can be sent to the back-end equipment by a user through triggering a preset control of the terminal equipment, or can be sent to the back-end equipment at intervals of a preset time period, and the terminal equipment uploads the log in the preset time period as the log data to be processed.

Wherein, the log data to be processed comprises: log data corresponding to a plurality of hardware. Such as registers, memory, stacks, processes, locks, and log data for the CPU.

Illustratively, the log data to be processed is referred to in fig. 5, which includes N-line logs, each including format information and other contents. The format information includes process information, source program information, time stamp, and the like. For example, the "to" in the first row may represent "call trace", and the "to" in the second row may represent "dump_backtrace. Cfi_jt+0x0/0x8".

Further, [ MICRO_DUMP ] is a core DUMP identifier, and data following [ MICRO_DUMP ] is data required for exception cause analysis.

S402: and extracting abnormal log data in the log data to be processed according to the preset key characters.

The preset key characters comprise: hardware identification, kernel offset identification and exception identification, wherein the exception log data comprises relevant data of a process operated by the terminal equipment when an exception occurs, and the relevant data comprises: the method comprises the steps that logs belonging to the same row with hardware identification in log data to be processed, logs belonging to the same row with kernel offset identification in the log data to be processed, and a plurality of rows of exception logs identified by exception identification in the log data to be processed, wherein the plurality of rows of exception logs represent exception reasons of hardware corresponding to the hardware identification.

Wherein, the hardware identification includes: at least one of a register identification, a memory identification, a stack identification, a central processor identification, a process identification, and a lock state identification. Specifically, the stack identifier is stack, the register identifier is register, the memory identifier is memory, the process identifier is process, the lock state identifier is synchronized, and the central processor identifier is CPU. Wherein, each hardware can run corresponding software program to realize corresponding functions.

In addition, the kernel offset is identified as: kernel offset. The anomaly is identified as dump. And extracting the log data to be processed according to the hardware identifier, the kernel offset and the exception identifier to obtain exception log data.

Illustratively, referring to fig. 6, the log data to be processed shown in fig. 5 is processed, and the obtained abnormal log data is obtained. The exception log data includes: the kernel offset identifies the log of the row to which the kernel offset belongs (the 5 th row log in fig. 5), the log of the row to which the hardware identifier belongs (the 9 th row log in fig. 5), and the multi-row exception log identified by the exception identifier (the 10 th to nth row logs in fig. 5), wherein the data content in the 11 th to 12 th row logs in fig. 5 can represent the reason that the hardware corresponding to the hardware identifier has an exception.

For example, the log belonging to the same row as the hardware identifier in the log data to be processed, where if the hardware identifier is a register, the log belonging to the same row as the register identifier further includes: physical address information and corresponding memory information. For example: register:0000000000000010memory index. Wherein 0000000000000010 refers to the physical address of the register, and memory invalid represents the corresponding memory information. If the hardware identifier is a stack, the log belonging to the same row as the stack identifier further includes: stack pointer position, stack start position, stack length, etc.

In an alternative embodiment, extracting abnormal log data in log data to be processed according to preset key characters includes: according to a preset core dump identifier, filtering log data to be processed to obtain first intermediate log data, wherein each row of log in the first intermediate log data comprises: core dump identification; and extracting abnormal log data in the first intermediate log data according to the preset key characters.

The core DUMP identifier is shown as [ MICRO_DUMP ] in FIG. 5, and is used for primarily filtering the log data to be processed, so that the extraction efficiency of the subsequent abnormal log data can be improved.

Illustratively, referring to FIG. 7, there is first intermediate log data, wherein each row log of the first intermediate log data includes [ MICRO_DUMP ]. The method and the device can extract the abnormal log data from the first intermediate log data.

In this embodiment of the present application, when the core dump identifier is used to filter the log data to be processed, the data content with the character of 0 of the log data to be processed is filtered to be a null, specifically referring to the 8 th line log in fig. 7, the 14 th line log in fig. 5, and the data content "000000" in the 14 th line log in fig. 5 is filtered to be a "null".

Further, extracting the abnormal log data in the first intermediate log data according to the preset key character includes: zero padding is carried out on empty characters in the first intermediate log data, so that second intermediate log data are obtained; and extracting abnormal log data in the second intermediate log data according to the preset key characters.

It can be appreciated that after the first intermediate log data is obtained by the preliminary filtering, the empty character may be supplemented with 0, so that the second intermediate log data is complete, and then the abnormal log data may be obtained by filtering the second intermediate log data.

Illustratively, referring to fig. 8, the null character in the first intermediate log data shown in fig. 7 is complemented with 0 to obtain second intermediate log data, and then the second intermediate log data is extracted according to a preset key character to obtain abnormal log data.

Further, the log belonging to the same row as the anomaly identification includes: a starting position of the multi-line exception log and a data length of the multi-line exception log, the multi-line exception log comprising: the second intermediate log data includes a log of the data length from the start position.

Illustratively, referring to FIG. 5, the log belonging to the same row as the exception identifier DUMP includes, in addition to the format information, a core DUMP identifier [ MICRO_DUMP ], also: a start position, such as ffffffdd12368000, a data length, such as 4086. The starting position of the 11 th row log in fig. 5 may be 8000, the identification position of the 12 th row is 8080, and the identification position of the N th row is 8000+4086. The data length of the 11 th line to the nth line is 4098, and the data length refers to the length of the sum of the data contents in the multi-line exception log.

In an alternative embodiment, if the kernel offset identifier cannot be extracted from the first intermediate log data, the kernel offset identifier may be extracted from the log data to be processed, and the log of the row to which the kernel offset identifier belongs. For example, the log data to be processed has a line of log "format information kernel offset:0x1cfdc00000 from 0xffffffc010000000", where 0x1cfdc00000 from 0xffffffc010000000 represents the core specific offset.

S403, converting the abnormal log data into a core dump file for the visualization tool to load and analyze.

The method for converting the exception log data into the core dump file comprises the following steps: the exception log data is converted from a text format to a core dump file in a binary executable format and a core dump file in a loadable script format.

The core dump file coredump file includes a core dump file in a binary executable format, such as a microdump.elf file, and a core dump file in a loadable script format, such as a microdump.cmm file. These two files are sent to the visual analysis tool trace32 for load analysis.

Further, the backend device may display the core dump file after the loading analysis through trace32, and after the loading analysis, may analyze the call relationship between the programs, etc. And further, an analyst can quickly and efficiently determine the cause of the abnormality. The abnormal reasons include code running errors or code logic errors and the like.

In the embodiment of the application, a conversion tool is provided substantially, the log data to be processed in the text format is processed to obtain the abnormal log data, and the abnormal log data is converted into the core dump file, so that the core dump file can be used for loading and analyzing the visualization tool.

Referring to fig. 9, S901-S902 illustrate another log processing method in the embodiment of the present application, where the log processing method is also performed by a back-end device, specifically, the back-end device uses a visualization tool, and the log processing method specifically includes the following steps:

s901, a core dump file is acquired.

The core dump file is obtained according to the log processing method of any one of the above.

S902, loading and analyzing a core dump file by adopting a visualization tool.

In the embodiment of the application, the visualization tool performs a loading analysis processing on the data content in the core dump file, and the data subjected to the loading analysis processing can obtain the abnormal data of each hardware and the relationship between the abnormal data, so that an analyst can conveniently, accurately and quickly analyze the cause of the abnormality.

Referring to fig. 10, S101-S104 illustrate another log processing method according to the embodiment of the present application, applied to a terminal device that has been abnormal, the log processing method including:

S101, determining a target abnormality type of the terminal equipment under the condition that the terminal equipment is abnormal.

Wherein the target exception types include: at least one of data anomalies, hang deaths, external anomalies. In addition, the target abnormality types further include: active loopholes or undefined instructions, etc.

Specifically, the data exception is at least one of a null pointer, a read-only page, a data unreadable, a data unmapped, a data misaligned, or an execution disallowed for the running data. The active vulnerability refers to the exception of the operation of the terminal equipment caused by the vulnerability of the code. The hanging-up refers to the problem that the terminal equipment is dead or automatically restarted. Undefined instruction means that the hardware itself is abnormal and not the program executed by the hardware is abnormal. The external anomaly refers to an anomaly in data transmission caused by an anomaly in an external network, and the like.

In the embodiment of the application, when the terminal equipment is abnormal, the terminal equipment determines the target abnormal type of the terminal equipment. For example, if the terminal device crashes and restarts, the terminal device determines that the target exception type is a hang-up type.

S102, determining at least one target hardware corresponding to the target abnormal type according to the corresponding relation between the pre-stored abnormal type and the hardware.

Wherein, the hardware includes: registers, memory, stacks, central processing units, processes, and lock states. The correspondence of the abnormality type and the hardware may be established in advance. For example, it is determined that the data exception corresponds to a memory. The hang corresponds to the stack, central processor, process, and lock state. External exceptions correspond to registers and stacks. Then the target hardware is stack, cpu, process and lock state when the target exception type is hang. When the target exception type is data exception and is suspended, the target hardware is memory, stack, central processing unit, process and lock state.

S103, determining the log data of the target hardware as the log data to be processed.

After determining the target hardware, analyzing the log data of the target hardware to obtain the log data to be processed. Wherein the log data to be processed may include log data of at least one target hardware. The log data may include an exception log corresponding to the target hardware.

Further, in the embodiment of the application, log data of various hardware such as a register, a memory, a stack, a central processing unit, a process, a lock state and the like can be obtained, so that the data volume of the log data can be increased, and further, the subsequent exception analysis can be more accurate.

In addition, the log data to be processed may further include: shadow stack, page information, address type, etc.

S104, sending the log data to be processed to the back-end equipment.

Wherein, the backend device executes S401 to S403 and S901 to S902 after receiving log data to be processed.

In the embodiment of the application, more hardware log data can be obtained, the enhancement of the abnormal log is realized, and then an analyst locates the cause of the abnormal problem based on the log data to be processed, so that the locating accuracy and efficiency are improved, and the quality of the terminal equipment is further improved.

The foregoing description of the solution provided in the embodiments of the present application has been mainly presented in terms of a method. To achieve the above functions, it includes corresponding hardware structures and/or software modules that perform the respective functions. Those of skill in the art will readily appreciate that the various illustrative method steps described in connection with the embodiments disclosed herein may be implemented as hardware or a combination of hardware and computer software. Whether a function is implemented as hardware or computer software driven hardware depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.

According to the embodiment of the application, the device for realizing the log processing method can be divided into the functional modules according to the method example, for example, each functional module can be divided corresponding to each function, and two or more functions can be integrated into one processing module. The integrated modules may be implemented in hardware or in software functional modules. It should be noted that, in the embodiment of the present application, the division of the modules is schematic, which is merely a logic function division, and other division manners may be implemented in actual implementation.

Fig. 11 is a schematic structural diagram of a chip according to an embodiment of the present application. Chip 1100 includes one or more (including two) processors 1101, communication lines 1102, a communication interface 1103, and a memory 1104.

In some implementations, the memory 1104 stores the following elements: executable modules or data structures, or a subset thereof, or an extended set thereof.

The method described in the embodiments of the present application may be applied to the processor 1101 or implemented by the processor 1101. The processor 1101 may be an integrated circuit chip having signal processing capabilities. In implementation, the steps of the above method may be performed by integrated logic circuitry in hardware in the processor 1101 or instructions in software. The processor 1201 may be a general purpose processor (e.g., a microprocessor or a conventional processor), a digital signal processor (digital signal processing, DSP), an application specific integrated circuit (application specific integrated circuit, ASIC), an off-the-shelf programmable gate array (field-programmable gate array, FPGA) or other programmable logic device, discrete gates, transistor logic, or discrete hardware components, and the processor 1101 may implement or perform the methods, steps, and logic blocks related to the processes disclosed in the embodiments of the present application.

The steps of a method disclosed in connection with the embodiments of the present application may be embodied directly in hardware, in a decoded processor, or in a combination of hardware and software modules in a decoded processor. The software modules may be located in a state-of-the-art storage medium such as random access memory, read-only memory, programmable read-only memory, or charged erasable programmable memory (electrically erasable programmable read only memory, EEPROM). The storage medium is located in the memory 1104, and the processor 1101 reads information in the memory 1104 and performs the steps of the above method in combination with its hardware.

The processor 1101, the memory 1104, and the communication interface 1103 may communicate with each other via a communication line 1102.

In the above embodiments, the instructions stored by the memory for execution by the processor may be implemented in the form of a computer program product. The computer program product may be written in the memory in advance, or may be downloaded in the form of software and installed in the memory.

Embodiments of the present application also provide a computer program product comprising one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the processes or functions in accordance with embodiments of the present application are produced in whole or in part. The computer may be a general purpose computer, a special purpose computer, a computer network, or other programmable apparatus. The computer instructions may be stored in a computer-readable storage medium or transmitted from one computer-readable storage medium to another computer-readable storage medium, for example, the computer instructions may be transmitted from one website, computer, server, or data center to another website, computer, server, or data center by wired (e.g., coaxial cable, fiber optic, digital subscriber line (digital subscriber line, DSL), or wireless (e.g., infrared, wireless, microwave, etc.), or semiconductor medium (e.g., solid state disk, SSD)) or the like.

Embodiments of the present application also provide a computer-readable storage medium. The methods described in the above embodiments may be implemented in whole or in part by software, hardware, firmware, or any combination thereof. Computer readable media can include computer storage media and communication media and can include any medium that can transfer a computer program from one place to another. The storage media may be any target media that is accessible by a computer.

As one possible design, the computer-readable medium may include compact disk read-only memory (CD-ROM), RAM, ROM, EEPROM, or other optical disk memory; the computer readable medium may include disk storage or other disk storage devices. Moreover, any connection is properly termed a computer-readable medium. For example, if the software is transmitted from a website, server, or other remote source using a coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave, then the coaxial cable, fiber optic cable, twisted pair, DSL, or wireless technologies such as infrared, radio, and microwave are included in the definition of medium. Disk and disc, as used herein, includes Compact Disc (CD), laser disc, optical disc, digital versatile disc (digital versatile disc, DVD), floppy disk and blu-ray disc where disks usually reproduce data magnetically, while discs reproduce data optically with lasers.

Embodiments of the present application are described with reference to flowchart illustrations and/or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the application. It will be understood that each flow and/or block of the flowchart illustrations and/or block diagrams, and combinations of flows and/or blocks in the flowchart illustrations and/or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processing unit of a general purpose computer, special purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processing unit of the computer or other programmable data processing apparatus, create means for implementing the functions specified in the flowchart flow or flows and/or block diagram block or blocks.

Claims

1. A log processing method, comprising:

acquiring log data to be processed uploaded by a terminal device, wherein the log data to be processed comprises a plurality of rows of logs; wherein the log data to be processed includes: log data corresponding to a plurality of hardware;

filtering the log data to be processed according to a preset core dump identifier to obtain first intermediate log data, wherein each row of log in the first intermediate log data comprises: the core dump identifier; zero padding is carried out on the empty characters in the first intermediate log data, so that second intermediate log data are obtained; extracting abnormal log data in the second intermediate log data according to preset key characters; the preset key characters comprise: the hardware identification, the kernel offset identification and the exception identification, wherein the exception log data comprise related data of a process operated by the terminal equipment when an exception occurs, and the related data comprise: the log belonging to the same row with the hardware identifier in the log data to be processed, the log belonging to the same row with the kernel offset identifier in the log data to be processed, and the multi-row abnormal log identified by the abnormal identifier in the log data to be processed, wherein the multi-row abnormal log represents the abnormal reason of the hardware identifier corresponding to the hardware;

And converting the abnormal log data from a text format to a core dump file in a binary executable format and a core dump file in a loadable script format for loading analysis by a visualization tool to obtain abnormal data of each hardware and the relation between the abnormal data.

2. The log processing method according to claim 1, wherein the log belonging to the same line as the abnormality identification includes: a starting position of the multi-row exception log and a data length of the multi-row exception log, the multi-row exception log comprising: and the second intermediate log data comprises the log of the data length from the starting position.

3. The log processing method according to claim 1 or 2, wherein the hardware identification includes: at least one of a register identification, a memory identification, a stack identification, a central processor identification, a process identification, and a lock state identification.

4. The log processing method according to claim 1 or 2, characterized in that the visualization tool includes: trace32 analysis tool.

5. A log processing method, comprising:

acquiring a core dump file, wherein the core dump file is obtained according to the log processing method of any one of claims 1-4;

And loading and analyzing the core dump file by adopting a visualization tool.

6. A log processing method, applied to a terminal device, the method comprising:

in the case that the terminal equipment is abnormal, determining a target abnormality type of the terminal equipment, wherein the target abnormality type comprises: at least one of data anomalies, hang-ups, external anomalies;

determining at least one target hardware corresponding to the target abnormal type according to the corresponding relation between the pre-stored abnormal type and the hardware;

determining the log data of the target hardware as log data to be processed;

transmitting the log data to be processed to a back-end device, so that the back-end device executes the log processing method according to any one of claims 1 to 4.

7. An electronic device, comprising: a memory for storing a computer program and a processor for executing the computer program to perform the log processing method as claimed in any one of claims 1 to 6.

8. A computer readable storage medium storing instructions that, when executed, cause a computer to perform the log processing method of any of claims 1-6.