CN117971634A

CN117971634A - Log classification rule configuration method and device

Info

Publication number: CN117971634A
Application number: CN202211308802.XA
Authority: CN
Inventors: 刘喜临; 梁思聪
Original assignee: Huawei Cloud Computing Technologies Co Ltd
Current assignee: Huawei Cloud Computing Technologies Co Ltd
Priority date: 2022-10-25
Filing date: 2022-10-25
Publication date: 2024-05-03

Abstract

The application provides a configuration method, a configuration device, a computing device cluster, a computer program product and a computer readable storage medium of log classification rules, and relates to the field of automatic testing. By the method, a more accurate classification rule base can be obtained, and the interference of the classification rule with poor accuracy in the classification rule base to log classification is avoided, so that the accuracy of log classification can be improved.

Description

Log classification rule configuration method and device

Technical Field

The present application relates to the field of automated testing, and in particular to a method, apparatus, cluster of computing devices, computer program product, and computer readable storage medium for configuring log classification rules.

Background

With the rapid development of the software industry, in order to achieve high quality and rapid iteration of software products, more and more companies employ automated testing to shorten the test period. In automated testing, root cause analysis of a log of failures is important. The traditional root cause analysis method is based on an expert pre-defined experience mode, the classification rule of the log is configured, the log is classified according to the classification rule, different classification results correspond to different failure root causes, and therefore automatic testing of software products is achieved. However, as the number of software increases and the iteration cycle of the software product continues to increase, the content of the log becomes more and more complex, and the classification result corresponding to the log also changes frequently, which makes it difficult to maintain good accuracy for the pre-configured classification rule.

Disclosure of Invention

The application provides a configuration method, a configuration device, a computing device cluster, a computer program product and a computer readable storage medium of log classification rules.

In a first aspect, a method for configuring a log classification rule is provided, including: acquiring a second classification result of the first log, wherein the second classification result is used for indicating the real root cause of the first log; determining a first classification result of the first log according to the first log and a first classification rule, wherein the first classification rule comprises a corresponding relation between a first log template and the first classification result, the first log corresponds to the first log template, and the first classification result is used for indicating a prediction root cause of the first log; and processing the first classification rule according to the second classification result and the first classification result.

Because of the high quality and rapid iteration of the software product, the classification rules are relatively accurate at an early stage and then gradually decrease in accuracy. According to the embodiment of the application, the classification rule is processed according to the second classification result and the first classification result, so that a more accurate classification rule is obtained, and the condition that the classification rule with poor accuracy interferes with log classification is avoided, thereby improving the accuracy of log classification.

With reference to the first aspect, in certain implementation manners of the first aspect, processing the first classification rule includes: the first classification rule is removed from the classification rule base or the first classification rule does not join the classification rule base.

Because of the high quality and rapid iteration of the software product, the classification rules are relatively accurate at an early stage and then gradually decrease in accuracy. According to the embodiment of the application, the first classification rule is not in the classification rule base according to the second classification result and the first classification result, so that a more accurate classification rule base is obtained, and the accuracy of log classification can be improved.

With reference to the first aspect, in certain implementation manners of the first aspect, processing the first classification rule includes: and adding the first classification rule into a classification rule base.

According to the embodiment of the application, the corresponding first classification rule is added into the classification rule base according to the second classification result and the first classification result, so that a more accurate classification rule base is obtained, and the accuracy of log classification can be improved.

With reference to the first aspect, in certain implementation manners of the first aspect, processing the first classification rule includes: the first classification rule is marked for manual review.

Because of the high quality and rapid iteration of the software product, the classification rule is accurate at the initial stage, and then the accuracy rate is gradually reduced. According to the embodiment of the application, the first classification rule is marked, so that a tester is assisted to perform manual inspection and make a decision, a more accurate classification rule base can be obtained, the classification rule with lower accuracy in the classification rule base is prevented from interfering with log classification, and the accuracy of log classification is improved.

With reference to the first aspect, in certain implementation manners of the first aspect, processing the first classification rule according to the second classification result and the first classification result includes: scoring the first classification rule according to the second classification result and the first classification result to obtain the score of the first classification rule, and processing the first classification rule according to the score of the first classification rule.

Because of the high quality and rapid iteration of the software product, the classification rules are relatively accurate at an early stage and then gradually decrease in accuracy. According to the embodiment of the application, the score of the first classification rule is determined according to the second classification result and the first classification result, and the first classification rule is processed according to the score of the first classification rule, so that a more accurate classification rule base is obtained, and the accuracy of log classification can be improved.

With reference to the first aspect, in certain implementations of the first aspect, the method further includes: when the score of the first classification rule is below a first threshold, the first classification rule is removed from the classification rule base or the first classification rule does not join the classification rule base.

In the embodiment of the application, when the score of the first classification rule is lower than the first threshold value, the first classification rule is not included in the classification rule base, so that a more accurate classification rule base can be obtained, the condition that the classification rule with poor accuracy in the classification rule base interferes with the log classification process is avoided, and the accuracy of log classification can be improved.

With reference to the first aspect, in certain implementations of the first aspect, the method further includes: and adding the first classification rule into the classification rule base when the score of the first classification rule is higher than a second threshold value.

In the embodiment of the application, when the score of the first classification rule is higher than the second threshold value, the first classification rule is added into the classification rule base, so that a more accurate classification rule base can be obtained, and the accuracy of log classification can be improved.

With reference to the first aspect, in certain implementations of the first aspect, the method further includes: the first classification rule is marked for manual inspection when the score of the first classification rule is between a second threshold and a first threshold.

Because of the high quality and rapid iteration of the software product, the classification rule is accurate at the initial stage, and then the accuracy rate is gradually reduced. The embodiment of the application marks the first classification rule with the score between the second threshold value and the first threshold value, can assist a tester to perform manual inspection and make decisions, can obtain a more accurate classification rule base, avoids the classification rule with lower accuracy in the classification rule base from interfering with log classification, and improves the accuracy of log classification.

With reference to the first aspect, in certain implementation manners of the first aspect, determining a first classification result of the first log according to the first log and the first classification rule includes: and determining the classification result of the first log as the first classification result according to the first log and the correspondence of the first log template.

With reference to the first aspect, in certain implementation manners of the first aspect, acquiring a second classification result of the first log includes: acquiring a label of the first log, wherein the label is used for indicating the second classification result; and obtaining a second classification result of the first log according to the label.

With reference to the first aspect, in certain implementations of the first aspect, the method further includes: acquiring source information of the first log; and acquiring the first classification rule according to the source information.

According to the embodiment of the application, the first classification rule is obtained according to the source information of the first log, so that the migration or recommendation of the classification rule is realized, and the cold start cost of log classification is reduced.

With reference to the first aspect, in certain implementations of the first aspect, the method further includes: acquiring a second log; determining a classification result of the second log according to the second log and the classification rule base; and outputting the classification result of the second log.

Based on the classification rule base configured by the embodiment of the application, log classification can be more accurately performed, so that root cause analysis can be more accurately performed on the failure log, and the efficiency of automatic test can be improved.

In a second aspect, a configuration device of log classification rules is provided, including: the acquisition module is used for acquiring a second classification result of the first log, wherein the second classification result is used for indicating the real root cause of the first log; the matching module is used for determining a first classification result of the first log according to the first log and a first classification rule, wherein the first classification rule comprises a corresponding relation between a first log template and the first classification result, the first log corresponds to the first log template, and the first classification result is used for indicating a prediction root cause of the first log; and the processing module is used for processing the first classification rule according to the second classification result and the first classification result.

With reference to the second aspect, in certain implementations of the second aspect, the processing module is specifically configured to remove the first classification rule from the classification rule base or the first classification rule does not join the classification rule base.

With reference to the second aspect, in some implementations of the second aspect, the processing module is specifically configured to add the first classification rule to a classification rule base.

With reference to the second aspect, in some implementations of the second aspect, the processing module is specifically configured to flag the first classification rule for manual inspection.

With reference to the second aspect, in some implementations of the second aspect, the processing module is specifically configured to score the first classification rule according to the second classification result and the first classification result, so as to obtain a score of the first classification rule, and process the first classification rule according to the score of the first classification rule.

With reference to the second aspect, in certain implementations of the second aspect, the processing module is further configured to remove the first classification rule from the classification rule base or the first classification rule does not join the classification rule base when the score of the first classification rule is below a first threshold.

With reference to the second aspect, in certain implementations of the second aspect, the processing module is further configured to add the first classification rule to the classification rule base when the score of the first classification rule is above a second threshold.

With reference to the second aspect, in certain implementations of the second aspect, the processing module is further configured to flag the first classification rule for manual inspection when a score of the first classification rule is between a second threshold and a first threshold.

With reference to the second aspect, in some implementations of the second aspect, the processing module is specifically configured to determine, according to the first log and the first log template correspond, a classification result of the first log as the first classification result.

With reference to the second aspect, in some implementations of the second aspect, the obtaining module is specifically configured to obtain a label of the first log, where the label is used to indicate the second classification result; and obtaining a second classification result of the first log according to the label.

With reference to the second aspect, in some implementations of the second aspect, the obtaining module is further configured to obtain source information of the first log; and acquiring the first classification rule according to the source information.

With reference to the second aspect, in certain implementations of the second aspect, the obtaining module is further configured to obtain a second log; the matching module is also used for determining the classification result of the second log according to the second log and the classification rule base; the device also comprises an output module for outputting the classification result of the second log.

In a third aspect, a computing device is provided, comprising a processor and a memory, the processor configured to execute instructions stored in the memory, to cause the computing device to perform the method of configuring log classification rules of the first aspect or any implementation thereof.

In a fourth aspect, a cluster of computing devices is provided, comprising at least one computing device, each computing device comprising a processor and a memory; the processor of the at least one computing device is configured to execute instructions stored in the memory of the at least one computing device to cause the cluster of computing devices to perform the configuration method of the log classification rules of the first aspect or any implementation thereof.

In a fifth aspect, there is provided a computer program product comprising instructions which, when executed by a computing device, cause the computing device to perform the method of configuring log classification rules of the first aspect or any implementation thereof.

In a sixth aspect, there is provided a computer program product comprising instructions which, when executed by a cluster of computing devices, cause the cluster of computing devices to perform the configuration method of the log classification rules of the first aspect or any implementation thereof.

In a seventh aspect, a computer readable storage medium is provided, comprising computer program instructions which, when executed by a computing device, perform the configuration method of the log classification rules of the first aspect or any implementation thereof.

In an eighth aspect, a computer readable storage medium is provided, comprising computer program instructions which, when executed by a cluster of computing devices, perform the configuration method of the log classification rules of the first aspect or any implementation thereof.

Drawings

FIG. 1 is a schematic flow chart of an automated test method based on log classification according to an embodiment of the present application.

Fig. 2 is a schematic flowchart of a method for configuring a log classification rule according to an embodiment of the present application.

Fig. 3 is a schematic block diagram of a configuration apparatus for log classification rules according to an embodiment of the present application.

Fig. 4 is a schematic architecture diagram of a computing device 400 according to an embodiment of the present application.

Fig. 5 is a schematic architecture diagram of a computing device cluster according to an embodiment of the present application.

FIG. 6 is a schematic diagram of a connection between computing devices 400A and 400B over a network provided by an embodiment of the present application.

Detailed Description

The technical scheme of the application will be described below with reference to the accompanying drawings.

The present application will present various aspects, embodiments, or features about a system comprising a plurality of devices, components, modules, etc. It is to be understood and appreciated that the various systems may include additional devices, components, modules, etc. and/or may not include all of the devices, components, modules etc. discussed in connection with the figures. Furthermore, combinations of these schemes may also be used.

In addition, in the embodiments of the present application, words such as "exemplary," "for example," and the like are used to indicate an example, instance, or illustration. Any embodiment or design described herein as "exemplary" is not necessarily to be construed as preferred or advantageous over other embodiments or designs. Rather, the term use of an example is intended to present concepts in a concrete fashion.

The service scenario described in the embodiment of the present application is to more clearly illustrate the technical solution of the embodiment of the present application, and does not constitute a limitation on the technical solution provided by the embodiment of the present application, and as a person of ordinary skill in the art can know that, with the evolution of the network architecture and the appearance of a new service scenario, the technical solution provided by the embodiment of the present application is equally applicable to similar technical problems.

The first, second, etc. descriptions in the embodiments of the present application are only used for illustration and distinction of description objects, and no order division is provided, nor is the number of the descriptions in the embodiments of the present application to be construed as any limitation of the embodiments of the present application.

It should be understood that, in various embodiments of the present application, the sequence number of each process does not mean that the execution sequence of each process should be determined by its functions and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

With the rapid development of the software industry, in order to achieve high quality and rapid iteration of software products, more and more companies employ automated testing to shorten the test period. In automated testing, root cause analysis of a log of failures is important. The traditional root cause analysis method is based on an expert pre-defined experience mode, classification rules of the logs are configured, the classification rules form a classification rule base, and the logs are classified according to the classification rule base. Wherein, different classification results correspond to different failure root causes, so that the automatic test of the software product can be realized.

FIG. 1 is a schematic flow diagram of an automated test method 100 based on log classification. As shown in FIG. 1, the method 100 may include steps 110-170. The following is a detailed description.

Step 110, a test case is obtained.

A test case is a set of cases composed of test objectives, execution conditions, and expected results, formulated for a particular business objective, for testing the logical path or functional effects of a computer program. The embodiment of the application does not limit the types of the test cases, and the test cases can be used for white box test, black box test, gray box test and the like. In automated testing, test cases may be in a computer-readable format.

The test cases may be preset based on expert experience patterns, or may be automatically generated by a computer program, which is not limited in the present application.

And 130, automatically testing the system to be tested according to the test case, and generating a log.

The system to be tested is a system operated by the test case, and may be a terminal, such as a mobile phone, a tablet computer, a personal digital assistant, an intelligent wearable device, etc., or a base station, a server, etc., which is not limited in the present application.

The automatic test of the embodiment of the application can comprise application scenes of various automatic tests. For example, application scenarios may include module testing, performance testing, interface testing, protocol testing, functional testing, compatibility testing, online monitoring testing, and so forth. The above tests may be subdivided, for example, the module test may include a test for function call of each functional module, that is, a test at a function level, and may also include a code coverage test; the performance tests may in turn include stress tests, stability tests, throughput tests, etc., and the functional tests may in turn include business demand tests, regression tests, etc. In addition, the above-mentioned test categories of each subdivision may be further subdivided, which is not limited in the present application.

During testing, the information such as the testing time, the testing script, the testing condition, the intermediate result of the testing, the final error reporting result and the like at the time need to be recorded, so that a log is formed. The log of the embodiment of the application can be generated in any application scene, such as module test, performance test and the like. The log of the embodiment of the application can be generated at any end, such as a test end, a base station end, a terminal and the like, and the application is not limited to the above.

Step 150, determining the log as a failure log, obtaining a classification rule base, and classifying the log according to the classification rule base to obtain a first classification result of the log.

The classification rule base is a set of rule bases for distinguishing classification results of different logs. The classification rule base may include at least one classification rule, e.g., the classification rule base may include a first classification rule that may map a log template with classification results. It should be appreciated that the plurality of classification rules in the classification rule base may be preconfigured based on expert experience or may be preconfigured based on some logs as samples. The classification rule may include a classification condition and a classification result, and in the embodiment of the present application, the classification condition may include a first log template, etc., and the classification result may include a version defect, an environmental problem, a compiling problem, a script problem, a tool problem, etc., which is not limited in this application.

Step 170, outputting the first classification result of the log.

The classification result of the log may indicate the failure root cause of the log, and for clarity of description, the classification result determined according to the classification rule is referred to as a first classification result in the embodiment of the present application, where the first classification result may indicate the predicted root cause of the log. The embodiment of the application refers to a preset classification result of the log as a second classification result, and the second classification result can indicate the real root cause of the log. It should be understood that the actual root cause may be preset by a tester based on expert experience, and the actual root cause is often a relatively accurate failure root cause of the log, and those skilled in the art want to configure an appropriate classification rule so that the first classification result of the log obtained according to the classification rule is the same as or similar to the second classification result, that is, the predicted root cause is the same as or similar to the actual root cause. If the true root cause itself does not reflect the more accurate root cause of the failure of the log due to errors in the experience of the tester or expert, it is still within the scope of embodiments of the present application.

In short, after the log is obtained, if the log is a failed log, the problem needs to be analyzed, that is, the log is classified, and then the classification result of the log is output, so that the root cause of the test failure can be found, and the developer can find and solve the problem.

The conventional classification rules are preset according to the expert's experience patterns and there is no exit mechanism. However, as the number of software increases and the iteration cycle of the software product continues to increase, the log becomes more and more complex and the classification results change frequently, which makes it difficult to maintain good accuracy for pre-configured classification rules.

In view of this, the embodiment of the application provides a configuration method of log classification rules, which optimizes a classification rule base and improves the accuracy of the log classification rules.

Fig. 2is a schematic diagram of a method 200 for configuring a log classification rule according to an embodiment of the present application. As shown in fig. 2, the method 200 may be applied to a cloud platform, and the method 200 may include steps 210-250. The following detailed description is made respectively.

Step 210, obtaining a second classification result of the first log, where the second classification result is used to indicate a true root cause of the first log.

The first log in the embodiment of the application can be used for generating, testing or evaluating the classification rule.

The method for obtaining the second classification result of the first log is not limited in the embodiment of the application. For example, a first log may carry a tag that may be used to indicate a second classification result for the first log. For another example, a mapping table of a plurality of logs and the second classification result may be obtained, and the second classification result corresponding to the first log is queried according to the mapping table, thereby obtaining the second classification result of the first log. For another example, the second classification result of the first log may be directly obtained.

The classification result of the log may indicate the failure root cause of the log, and for clarity of description, the preset classification result of the log is referred to as a second classification result in the embodiment of the present application, where the second classification result may be used to indicate the actual root cause of the log. The embodiment of the application refers to a classification result determined according to the classification rule as a first classification result, and the first classification result can be used for indicating the predicted root cause of the log.

It should be understood that the second classification result may be preset by the tester based on expert experience, and the second classification result may be used to indicate the true root cause of the log, where the true root cause is often the more accurate failure root cause of the log, and those skilled in the art want to configure an appropriate classification rule so that the first classification result of the log obtained according to the classification rule is the same as or similar to the preset second classification result, that is, the predicted root cause is the same as or similar to the true root cause. If the true root cause itself does not reflect the more accurate root cause of the failure of the log due to errors in the experience of the tester or expert, it is still within the scope of embodiments of the present application.

It should be appreciated that the second classification result may be determined from analyzing the log directly or indirectly. For example, the first classification result may be directly determined by the tester according to an empirical mode predefined by the expert, or may be indirectly determined by the tester according to the results of other test cases by using the empirical mode predefined by the expert. The first classification result is often the more correct classification result of the log, i.e. the more correct root cause of the failure of the log.

Step 230, determining a first classification result of the first log according to the first log and a first classification rule, where the first classification rule includes a correspondence between a first log template and the first classification result, the first log corresponds to the first log template, and the first classification result is used to indicate a predicted root cause of the first log.

It should be understood that the execution sequence of step 210 and step 230 is not limited in the embodiment of the present application, step 210 may be executed first, step 230 may be executed later, step 230 may be executed first, step 210 may be executed later, and step 210 and step 230 may be executed simultaneously.

The first classification rule may include a mapping of a first log template to a first classification result, e.g., the first log template includes "new on-device exception information", the first classification result of the first log template mapping being "version defect".

The first classification rule according to the embodiment of the present application may be included in the classification rule base, or may be included in another location, for example, in the classification rule preparation base.

It should be appreciated that the classification rules contained in the classification rule base will be enabled in the log classification, and the classification rule preparation base may include classification rules to be enabled, that is, the classification rules in the classification rule preparation base may or may not be enabled in the log classification. The classification rule preparation library according to the embodiment of the application can be a logic category, and a person skilled in the art can have a plurality of classification rule preparation libraries for storing classification rules to be enabled.

The classification rule base may comprise at least one classification rule. The embodiment of the application refers to a classification result determined according to the classification rule as a first classification result, and the first classification result can be used for indicating the predicted root cause of the log. The classification rule base may further comprise a plurality of classification rules, and in general the classification rule base may comprise a plurality of first log templates and a mapping of at least one classification result.

As an example, a regular expression may be generated from the first log template and the first classification result, the regular expression being performed on the first log to obtain the first classification result.

Specifically, the first log template may be matched with the first log according to the regular expression, and after the matching is successful, the first classification result may be obtained. For example, if the first log includes "newly added exception information on device," the first classification result of the log may be "version defect" which may be used to indicate the predicted root cause of the first log.

Regular expressions, also known as regular expressions, are a type of text pattern that includes both common characters and special characters. Regular expressions use a single string to describe, match a series of strings that match a certain syntactic rule, and are typically used to retrieve, replace, text that matches a certain pattern.

Step 250, processing the first classification rule according to the second classification result and the first classification result.

The embodiment of the application can score according to the difference degree of the second classification result and the first classification result, acquire the score of the first classification rule, and process the first classification rule according to the score of the first classification rule. The embodiment of the application can also acquire the order of the first classification rule in the classification rule base according to the coincidence degree of the second classification result and the first classification result, and process the first classification rule according to the order. The application is not limited in this regard.

The embodiment of the application can have various processing methods for the first classification rule, and the application is not limited to this. For example, when the second classification result has a larger difference or smaller coincidence degree with the first classification result, the first classification rule can be automatically marked, so that the first classification rule can be conveniently inspected and decided by a tester manually. For another example, the first classification rule may be restricted when the second classification result differs significantly or conforms to the first classification result to a very small extent, such as by deleting the first classification rule or reducing the application weight of the first classification rule. For another example, when the second classification result has a smaller difference or a larger degree of coincidence with the first classification result, the first classification rule may be retained, and the classification rule may be further recommended to other similar rule bases, so as to avoid the "cold start" problem.

Optionally, processing the first classification rule includes: the first classification rule is removed from the classification rule base or the first classification rule does not join the classification rule base.

It should be appreciated that the first classification rule is not included in the classification rule base after it is removed, and generally does not function during the log classification process. In particular, after the first classification rule is removed, the classification rule library may be further rejoined through a series of processes. For example, the first classification rule may be reviewed by a tester, and the first classification rule may be rejoined with the classification rule library if the tester believes that the first classification rule facilitates better log classification.

It can be appreciated that in the embodiment of the present application, when the difference between the second classification result and the first classification result is large, the first classification rule corresponding to the first classification result is removed.

Optionally, processing the first classification rule includes: and adding the first classification rule into a classification rule base.

Classification rules contained in the classification rule base will be enabled in the log classification. It can be appreciated that in the embodiment of the present application, when the second classification result is the same as or has a smaller difference from the first classification result, the first classification rule corresponding to the first classification result is added to the classification rule library.

Optionally, processing the first classification rule includes: the first classification rule is marked for manual review.

It can be appreciated that in the embodiment of the present application, when the difference between the second classification result and the first classification result is not too large, the first classification rule may be marked, and the marked first classification rule may be manually inspected by a tester, and the tester may analyze the marked first classification rule according to expert experience to determine to remove the marked first classification rule or add the marked first classification rule to the classification rule library.

The first classification rule is marked for manual review, and may also be combined with a technique of removing the first classification rule or adding the first classification rule to the classification rule base. For example, the second classification result is not too different from the first classification result, but the corresponding first classification rule is not already included in the classification rule base, and by marking the first classification rule, a tester can manually inspect the first classification rule, and if the tester considers that the first classification rule can perform log classification better, the tester can re-add the first classification rule into the classification rule base. For another example, the second classification result is not too different from the first classification result, but the corresponding first classification rule has been added to the classification rule base, and by marking the first classification rule, a tester can manually inspect the first classification rule, and if the tester considers that the first classification rule reduces the accuracy of log classification, the tester can remove the first classification rule from the classification rule base.

Optionally, processing the first classification rule according to the second classification result and the first classification result includes: scoring the first classification rule according to the second classification result and the first classification result to obtain the score of the first classification rule, and processing the first classification rule according to the score of the first classification rule.

It should be appreciated that the score of the first classification rule may represent the accuracy with which the first classification rule is used for log classification. For example, a higher score for the first classification rule indicates that the first classification rule is more accurate, and a lower score for the first classification rule indicates that the first classification rule is less accurate. As an example, the first classification rule may be deleted from the classification rule base when the first classification rule is very low.

As an example, the accuracy and/or hit rate of the first classification rule may be obtained from the second classification result and the first classification result, and the score of the first classification rule may be obtained from the accuracy and/or hit rate.

For example, the first log template is "device connected not, open channel failed, abnormal information", and the first classification result mapped by the first log template is "network failure". If the second classification result is also "network failure", then the correct positive example (TP) is recorded; if the second classification result is not "network failure," a counterexample of an error is noted (FALSE NEGATIVE, FN). For another example, the first log template is other content and should not map "network failure", but the second classification result is "network failure", and then is marked as a False Positive (FP); if the second classification result is not a network failure, then the correct counterexample (TN) is noted.

The precision a can be determined by the following formula:

the hit rate R can be determined by the following formula:

TP, TN, FP, FN of the above formula is as previously described.

As an example, weights of the precision and hit rates may be set in advance, and the precision and hit rates are calculated from the weights, thereby obtaining a score of the classification rule.

For example, the accuracy of the classification rule is 10%, and the score of the classification rule can be determined to be 10 points.

For another example, the hit rate of the classification rule is 12%, and the score of the classification rule may be determined to be 12.

For another example, the hit rate of the classification rule is 10% and the precision rate is 15%. The embodiment of the application can set weights for the score calculation of the hit rate and the precision rate, such as the hit rate: the precision ratio is 1:1. Then the score for the classification rule may be determined to be 12.5 points.

Optionally, the method further comprises: when the score of the first classification rule is below a first threshold, the first classification rule is removed from the classification rule base or the first classification rule does not join the classification rule base.

It should be appreciated that the first threshold may be used to represent a very low score. When the score of the first classification rule is smaller than a first threshold value, the first classification rule corresponding to the score is removed or not added into the classification rule base.

For example, if the score of the first threshold is 15 points, the score of the first classification rule is 10 points, the first classification rule is removed from the classification rule base.

Optionally, the method further comprises: and adding the first classification rule into the classification rule base when the score of the first classification rule is higher than a second threshold value.

It should be appreciated that the second threshold may be used to represent a relatively high score. When the score of the first classification rule is greater than a second threshold, the first classification rule corresponding to the score may be added to the classification rule base.

For example, if the score of the first threshold is 50 points and the score of the first classification rule is 60 points, the first classification rule may be added to the classification rule base.

Adding the first classification rule to the classification rule base may cause the first classification rule to be enabled in log classification.

Optionally, the method further comprises: the first classification rule is marked for manual inspection when the score of the first classification rule is between a second threshold and a first threshold.

As an example, when the second threshold is greater than the first threshold, the score of the first classification rule is less than the second threshold and greater than the first threshold. In one possible implementation, the classification rule is added to the classification rule library when the score of the first classification rule is higher than a second threshold value, the classification rule is marked for manual inspection when the score of the first classification rule is smaller than the second threshold value and is larger than the first threshold value, and the classification rule is not included in the classification rule library when the score of the first classification rule is smaller than the first threshold value.

As another example, when the second threshold is less than the first threshold, the score of the first classification rule is greater than the second threshold and less than the first threshold. In one possible implementation manner, when the score of the first classification rule is higher than the second threshold value, the classification rule is added into the classification rule base, and when the score of the first classification rule is smaller than the first threshold value, the classification rule base does not include the first classification rule, further, if the score of the first classification rule is larger than the second threshold value and smaller than the first threshold value, the first classification rule is marked, and the tester can manually inspect the first classification rule. After manual inspection, if the first classification rule is helpful to log classification, the first classification rule may be added to the classification rule base again, and if the accuracy of log classification by the first classification rule is poor, the first classification rule may still be removed from the classification rule base.

That is, after the first classification rule is marked, it is convenient for a tester to manually inspect, and the tester can analyze the marked first classification rule according to expert experience to determine whether to re-add the first classification rule to the classification rule base or remove the first classification rule from the classification rule base.

Optionally, determining the first classification result of the first log according to the first log and the first classification rule includes: and determining the classification result of the first log as the first classification result according to the first log and the correspondence of the first log template.

Optionally, obtaining the second classification result of the first log includes: acquiring a label of the first log, wherein the label is used for indicating the second classification result; and obtaining a second classification result of the first log according to the label.

In some possible implementations, before step 230, the method further includes: a first log template is generated from the cluster of second log templates, the second log template being determined from the first log.

In the first log, there are some constant fields and also some variable fields. In the embodiment of the application, the constant fields in the first log are extracted, so that the second log template can be obtained. It should be understood that the application is not limited in the manner of extraction. For example, the method of word frequency analysis may be used, or the method of longest common subsequence may be used. For example, the variable field in the first log may be replaced with a wild card, or the constant field may be directly obtained.

That is, the second log template includes a field of the first log that may map a first classification result of the first log, i.e., the second log template may reflect a failure root cause of the first log. However, since the first log is often unstructured, directly applying the second log template to the first classification rule may cause a conflict. In particular, the same meaning field may have many different expressions, and the different second log templates should correspond to the same first classification result; the fields with different meanings may also have similar expressions, and after the constant fields are extracted to generate the second log template, the second log template should correspond to different first classification results respectively. Thus, directly applying the second log template to the first classification rule may reduce the efficiency and accuracy of failure log classification.

In the embodiment of the application, the first log template is generated according to the second log template in a clustering way, and the second log template can be clustered based on a prefix tree method to generate the first log template.

The prefix tree is also called a dictionary tree, a word search tree and a Trie tree, can be used for counting, sequencing and storing a large number of character strings, and can reduce the query time by utilizing the common prefix of the character strings.

Specifically, the order of the second log templates may be arranged, and the second log templates may be queried in the prefix tree in turn according to the order. If the second log template can be matched with an existing character string in the prefix tree, the classification result of the second log template mapping can be corresponding to the character string, and the character string is determined to be the first log template. If the second log template cannot be matched with the existing character string in the prefix tree, inserting the second log template into the prefix tree, and determining the second log template as the first log template. It should be appreciated that the first log template may also be mapped with the first classification result based on the mapping of the second log template with the first classification result.

According to the embodiment of the application, the first log template is adopted as the first classification rule, so that on one hand, the classification rule library is prevented from comprising substantially the same classification rule, the redundancy of the classification rule library is reduced, and on the other hand, the classification rule library is prevented from comprising the classification rule with wrong mapping relation, and the efficiency and the accuracy of log classification can be improved, thereby improving the root cause analysis effect of the automatic test.

Optionally, before step 230, the method further comprises: acquiring source information of the first log; and acquiring the first classification rule according to the source information.

As an example, the source information may be used to indicate a product form of the first log. As an example, the first log may be obtained by testing on a router, and from this source information "router" a computer program applied to the router or having a similar product form may be determined, from the characteristics of which a suitable classification rule may be obtained. The application is not limited to the specific form of the source information, for example, the source information may be carried on a tag, and the source information of the first log may also be determined by a form mapping manner.

As another example, the source information may include a tag of the first log. It should be appreciated that the tag of the first log may be used to indicate a second classification rule of the first log.

Specifically, in configuring the log classification rule, the first classification rule may be obtained according to the same or similar second classification result. For example, the label of the first log is "compiling problem", and the embodiment of the present application may query the classification rule library, the classification rule preparation library or other libraries for classification rules that are the same as or similar to "compiling problem" according to the label.

It should be understood that the first classification rule may be obtained according to the source information, or the first classification rule may be added to a classification rule library, or the first classification rule may be added to a classification rule preparation library, and presented to a tester in a recommended manner for reference by the tester, which is not limited in the present application.

As an example, the tester may perform root cause analysis on the first log according to expert knowledge, and determine a second classification result corresponding to the root cause analysis. After that, when the tester newly builds the classification rule, the method of the embodiment of the application can recommend the classification rule according to the label of the first log, so that the tester can more efficiently build the classification rule, the redundancy of the classification rule library is reduced, and the accuracy of the classification rule library is improved. It should be noted that the above recommendation may be implemented by fuzzy matching.

Optionally, the method further comprises: acquiring a second log; determining a classification result of the second log according to the second log and the classification rule base; and outputting the classification result of the second log.

The second log may be a log to be analyzed/classified. Based on the classification rule base configured by the embodiment of the application, log classification can be more accurately performed, so that root cause analysis can be more accurately performed on the failure log, and the efficiency of automatic test can be improved.

The method embodiment of the present application is described in detail above with reference to fig. 2, and the device embodiment of the present application is described below with reference to fig. 3, where the device embodiment corresponds to the method embodiment, so that a portion not described in detail may refer to the foregoing method embodiments, and the device may implement any possible implementation manner of the foregoing method.

Fig. 3 shows a configuration apparatus 300 of log classification rules according to an embodiment of the present application, including an acquisition module 310, a matching module 330, and a processing module 350. The apparatus 300 may execute the method for configuring the log classification rule according to the embodiment of the present application.

As shown in fig. 3, the apparatus 300 may include:

an obtaining module 310, configured to obtain a second classification result of the first log, where the second classification result is used to indicate a real root cause of the first log;

A matching module 330, configured to determine a first classification result of the first log according to the first log and a first classification rule, where the first classification rule includes a correspondence between a first log template and the first classification result, the first log corresponds to the first log template, and the first classification result is used to indicate a predicted root cause of the first log;

And a processing module 350, configured to process the first classification rule according to the second classification result and the first classification result.

The obtaining module 310, the matching module 330 and the processing module 350 may be implemented by software, or may be implemented by hardware. Illustratively, the implementation of the acquisition module 310 is described next with reference to the acquisition module 310. Similarly, the implementation of the matching module 330 and the processing module 350 may refer to the implementation of the acquisition module 310.

Module as an example of a software functional unit, the acquisition module 310 may include code running on a computing instance. The computing instance may include at least one of a physical host (computing device), a virtual machine, and a container, among others. Further, the above-described computing examples may be one or more. For example, the acquisition module 310 may include code running on multiple hosts/virtual machines/containers. It should be noted that, multiple hosts/virtual machines/containers for running the code may be distributed in the same region (region), or may be distributed in different regions. Further, multiple hosts/virtual machines/containers for running the code may be distributed in the same availability zone (availability zone, AZ) or may be distributed in different AZs, each AZ comprising one data center or multiple geographically close data centers. Wherein typically a region may comprise a plurality of AZs.

Also, multiple hosts/virtual machines/containers for running the code may be distributed in the same virtual private cloud (virtual private cloud, VPC) or may be distributed in multiple VPCs. In general, one VPC is disposed in one region, and a communication gateway is disposed in each VPC for implementing inter-connection between VPCs in the same region and between VPCs in different regions.

Module as an example of a hardware functional unit, the acquisition module 310 may include at least one computing device, such as a server or the like. Alternatively, the acquisition module 310 may be a device implemented using an application-specific integrated circuit (ASIC), a programmable logic device (programmable logic device, PLD), or the like. The PLD may be implemented as a complex program logic device (complex programmable logical device, CPLD), a field-programmable gate array (FPGA) GATE ARRAY, a general-purpose array logic (GENERIC ARRAY logic, GAL), or any combination thereof.

The multiple computing devices included in the acquisition module 310 may be distributed in the same region or may be distributed in different regions. The plurality of computing devices included in the acquisition module 310 may be distributed among the same AZ or may be distributed among different AZ. Likewise, multiple computing devices included in the acquisition module 310 may be distributed in the same VPC or may be distributed among multiple VPCs. Wherein the plurality of computing devices may be any combination of computing devices such as servers, ASIC, PLD, CPLD, FPGA, and GAL.

It should be noted that, in other embodiments, the acquiring module 310 may be used to execute any step in the configuration method of the log classification rule, the matching module 330 may be used to execute any step in the configuration method of the log classification rule, the processing module 350 may be used to execute any step in the configuration method of the log classification rule, the steps that the acquiring module 310, the matching module 330, and the processing module 350 are responsible for implementing may be specified as needed, and all functions of the configuration device of the log classification rule are implemented by implementing different steps in the configuration method of the log classification rule by the acquiring module 310, the matching module 330, and the processing module 350, respectively.

Optionally, the processing module 350 is specifically configured to remove the first classification rule from the classification rule base or the first classification rule does not join the classification rule base.

Optionally, the processing module 350 is specifically configured to add the first classification rule to a classification rule base.

Optionally, the processing module 350 is specifically configured to flag the first classification rule for manual inspection.

Optionally, the processing module 350 is specifically configured to score the first classification rule according to the second classification result and the first classification result, so as to obtain a score of the first classification rule, and process the first classification rule according to the score of the first classification rule.

Optionally, the processing module 350 is further configured to remove the first classification rule from the classification rule base or the first classification rule does not join the classification rule base when the score of the first classification rule is below a first threshold.

Optionally, the processing module 350 is further configured to add the first classification rule to the classification rule base when the score of the first classification rule is higher than a second threshold.

Optionally, the processing module 350 is further configured to flag the first classification rule for manual inspection when the score of the first classification rule is between the second threshold and the first threshold.

Optionally, the processing module 350 is specifically configured to determine, according to the first log and the first log template, that the classification result of the first log is the first classification result.

Optionally, the obtaining module 310 is specifically configured to obtain a label of the first log, where the label is used to indicate the second classification result; and obtaining a second classification result of the first log according to the label.

Optionally, the obtaining module 310 is further configured to obtain source information of the first log; and acquiring the first classification rule according to the source information.

Optionally, the obtaining module 310 is further configured to obtain a second log; the matching module 330 is further configured to determine a classification result of the second log according to the second log and the classification rule base; the device also comprises an output module for outputting the classification result of the second log.

The present application also provides a computing device 400. As shown in fig. 4, the computing device 400 includes: bus 402, processor 404, memory 406, and communication interface 408. Communication between processor 404, memory 406, and communication interface 408 is via bus 402. Computing device 400 may be a server or a terminal device. It should be understood that the present application is not limited to the number of processors, memories in computing device 400.

Bus 402 may be a peripheral component interconnect standard (PERIPHERAL COMPONENT INTERCONNECT, PCI) bus, or an extended industry standard architecture (extended industry standard architecture, EISA) bus, among others. The buses may be divided into address buses, data buses, control buses, etc. For ease of illustration, only one line is shown in fig. 4, but not only one bus or one type of bus. Bus 404 may include a path to transfer information between various components of computing device 400 (e.g., memory 406, processor 404, communication interface 408).

The processor 404 may include any one or more of a central processing unit (central processing unit, CPU), a graphics processor (graphics processing unit, GPU), a Microprocessor (MP), or a digital signal processor (DIGITAL SIGNAL processor, DSP).

Memory 406 may include volatile memory (RAM), such as random access memory (random access memory). The processor 404 may also include non-volatile memory (ROM), such as read-only memory (ROM), flash memory, mechanical hard disk (HARD DISK DRIVE, HDD), or Solid State Disk (SSD).

The memory 406 stores executable program codes, and the processor 404 executes the executable program codes to implement the functions of the aforementioned acquisition module 310, matching module 330 and processing module 350, respectively, thereby implementing the configuration method of the log classification rule. That is, the memory 406 has stored thereon instructions for executing the configuration method of the log classification rule.

Or the memory 406 stores executable codes, and the processor 404 executes the executable codes to implement the functions of the configuration device of the log classification rule, thereby implementing the configuration method of the log classification rule. That is, the memory 406 has stored thereon instructions for executing the configuration method of the log classification rule.

Communication interface 403 enables communication between computing device 400 and other devices or communication networks using a transceiver module such as, but not limited to, a network interface card, transceiver, or the like.

The embodiment of the application also provides a computing device cluster. The cluster of computing devices includes at least one computing device. The computing device may be a server, such as a central server, an edge server, or a local server in a local data center. In some embodiments, the computing device may also be a terminal device such as a desktop, notebook, or smart phone.

As shown in fig. 5, the cluster of computing devices includes at least one computing device 400. The same instructions for performing the configuration method of log classification rules may be stored in memory 406 in one or more computing devices 400 in the computing device cluster.

In some possible implementations, the memory 406 of one or more computing devices 400 in the computing device cluster may also each have stored therein a portion of instructions for performing a configuration method of log classification rules. In other words, a combination of one or more computing devices 400 may collectively execute instructions for performing the configuration method of log classification rules.

It should be noted that, the memory 406 in different computing devices 400 in the computing device cluster may store different instructions for performing part of the functions of the configuration apparatus of the log classification rule, respectively. That is, the instructions stored by the memory 406 in the different computing devices 400 may implement the functionality of one or more of the acquisition module 310, the matching module 330, and the processing module 350.

In some possible implementations, one or more computing devices in a cluster of computing devices may be connected through a network. Wherein the network may be a wide area network or a local area network, etc. Fig. 6 shows one possible implementation. As shown in fig. 6, two computing devices 400A and 400B are connected by a network. Specifically, the network is connected through communication interfaces in the respective computing devices. In this type of possible implementation, instructions to perform the functions of the acquisition module 310 are stored in memory 406 in computing device 400A. Meanwhile, instructions to perform the functions of matching module 330 and processing module 350 are stored in memory 406 in computing device 400B.

The connection between clusters of computing devices shown in fig. 6 may be implemented by computing device 400B in consideration of the large amount of data required to store, match, and process the classification rules in the configuration method of log classification rules provided by the present application, and thus, the functions implemented by matching module 330 and processing module 350 are considered to be performed.

It should be appreciated that the functionality of computing device 400A shown in fig. 6 may also be performed by multiple computing devices 400. Likewise, the functionality of computing device 400B may also be performed by multiple computing devices 400.

The embodiment of the application also provides another computing device cluster. The connection between computing devices in the computing device cluster may be similar to the connection of the computing device cluster described with reference to fig. 5 and 6. In contrast, the same instructions for performing the configuration method of log classification rules may be stored in memory 406 in one or more computing devices 400 in the cluster of computing devices.

Embodiments of the present application also provide a computer program product comprising instructions. The computer program product may be software or a program product containing instructions capable of running on a computing device or stored in any useful medium. The computer program product, when run on at least one computing device, causes the at least one computing device to perform a method of configuring log classification rules.

The embodiment of the application also provides a computer readable storage medium. The computer readable storage medium may be any available medium that can be stored by a computing device or a data storage device such as a data center containing one or more available media. The usable medium may be a magnetic medium (e.g., floppy disk, hard disk, magnetic tape), an optical medium (e.g., DVD), or a semiconductor medium (e.g., solid state disk), etc. The computer-readable storage medium includes instructions that instruct a computing device to perform a method of configuring log classification rules.

Those of ordinary skill in the art will appreciate that the various illustrative modules and algorithm steps described in connection with the embodiments disclosed herein may be implemented as electronic hardware, or combinations of computer software and electronic hardware. Whether such functionality is implemented as hardware or software depends upon the particular application and design constraints imposed on the solution. Skilled artisans may implement the described functionality in varying ways for each particular application, but such implementation decisions should not be interpreted as causing a departure from the scope of the present application.

It will be clearly understood by those skilled in the art that, for convenience and brevity of description, specific working procedures of the above-described system, apparatus and module may refer to corresponding procedures in the foregoing method embodiments, which are not repeated herein.

In the several embodiments provided by the present application, it should be understood that the disclosed systems, devices, and methods may be implemented in other manners. For example, the apparatus embodiments described above are merely illustrative, e.g., the division of modules is merely a logical function division, and there may be additional divisions of actual implementation, e.g., multiple modules or components may be combined or integrated into another system, or some features may be omitted, or not performed. Alternatively, the coupling or direct coupling or communication connection shown or discussed with each other may be an indirect coupling or communication connection via some interfaces, devices or modules, which may be in electrical, mechanical, or other forms.

The modules illustrated as separate components may or may not be physically separate, and components shown as modules may or may not be physical modules, i.e., may be located in one place, or may be distributed over a plurality of network modules. Some or all of the modules may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

In addition, each functional module in each embodiment of the present application may be integrated into one module, or each module may exist alone physically, or two or more modules may be integrated into one module.

If the functions are implemented in the form of software functional modules and sold or used as a stand-alone product, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application may be embodied essentially or in a part contributing to the prior art or in a part of the technical solution in the form of a software product stored in a storage medium, comprising several instructions for causing a computer device (which may be a personal computer, a server, a network device, etc.) to perform all or part of the steps of the method of the embodiments of the present application. And the aforementioned storage medium includes: a U-disk, a removable hard disk, a Read-Only Memory (ROM), a random access Memory (Random Access Memory, RAM), a magnetic disk, or an optical disk, or other various media capable of storing program codes.

Finally, it should be noted that: the above embodiments are only for illustrating the technical solution of the present application, and are not limiting; although the application has been described in detail with reference to the foregoing embodiments, it will be understood by those of ordinary skill in the art that: the technical scheme described in the foregoing embodiments can be modified or some technical features thereof can be replaced by equivalents; these modifications or substitutions do not depart from the essence of the corresponding technical solutions from the protection scope of the technical solutions of the embodiments of the present application.

Claims

1. A method for configuring a log classification rule, comprising:

Acquiring a second classification result of the first log, wherein the second classification result is used for indicating the real root cause of the first log;

Determining a first classification result of the first log according to the first log and a first classification rule, wherein the first classification rule comprises a corresponding relation between a first log template and the first classification result, the first log corresponds to the first log template, and the first classification result is used for indicating a prediction root cause of the first log;

and processing the first classification rule according to the second classification result and the first classification result.

2. The method of claim 1, wherein processing the first classification rule comprises:

removing the first classification rule from the classification rule base or the first classification rule does not join the classification rule base.

3. The method of claim 1, wherein processing the first classification rule comprises:

And adding the first classification rule into a classification rule base.

4. A method according to any one of claims 1-3, wherein processing the first classification rule comprises:

The first classification rule is marked for manual review.

5. The method of any of claims 1-4, wherein processing the first classification rule based on the second classification result and the first classification result comprises:

Scoring the first classification rule according to the second classification result and the first classification result to obtain the score of the first classification rule;

and processing the first classification rule according to the score of the first classification rule.

6. The method as recited in claim 5, further comprising:

When the score of the first classification rule is lower than a first threshold value, the first classification rule is removed from the classification rule base or the first classification rule does not join the classification rule base.

7. The method as recited in claim 5, further comprising:

And adding the first classification rule into the classification rule base when the score of the first classification rule is higher than a second threshold value.

8. The method according to any one of claims 5-7, further comprising:

The first classification rule is marked for manual inspection when a score of the first classification rule is between a second threshold and a first threshold.

9. The method of any of claims 1-8, wherein determining a first classification result for the first log based on the first log and a first classification rule comprises:

And determining the classification result of the first log as the first classification result according to the correspondence between the first log and the first log template.

10. The method of any of claims 1-9, wherein obtaining a second classification result of the first log comprises:

acquiring a label of the first log, wherein the label is used for indicating the second classification result;

and obtaining a second classification result of the first log according to the label.

11. The method according to any one of claims 1-10, further comprising:

acquiring source information of the first log;

And acquiring the first classification rule according to the source information.

12. The method according to any one of claims 1-11, further comprising:

acquiring a second log;

determining a classification result of the second log according to the second log and a classification rule base;

and outputting the classification result of the second log.

13. A log classification rule configuration device, comprising:

the acquisition module is used for acquiring a second classification result of the first log, wherein the second classification result is used for indicating the real root cause of the first log;

The matching module is used for determining a first classification result of the first log according to the first log and a first classification rule, wherein the first classification rule comprises a corresponding relation between a first log template and the first classification result, the first log corresponds to the first log template, and the first classification result is used for indicating a prediction root cause of the first log;

And the processing module is used for processing the first classification rule according to the second classification result and the first classification result.

14. The apparatus of claim 13, wherein the processing module is specifically configured to remove the first classification rule from a classification rule base or the first classification rule does not join the classification rule base.

15. The apparatus of claim 13, wherein the processing module is configured to add the first classification rule to a classification rule base.

16. The apparatus of any of claims 13-15, wherein the processing module is specifically configured to flag the first classification rule for manual inspection.

17. The apparatus according to any one of claims 13-16, wherein the processing module is specifically configured to score the first classification rule according to the second classification result and the first classification result, so as to obtain a score of the first classification rule, and process the first classification rule according to the score of the first classification rule.

18. The apparatus of claim 17, wherein the processing module is further configured to remove the first classification rule from the classification rule base or the first classification rule does not join the classification rule base when the score of the first classification rule is below a first threshold.

19. The apparatus of claim 17, wherein the processing module is further configured to add the first classification rule to the classification rule base when the score of the first classification rule is above a second threshold.

20. The apparatus of any of claims 17-19, wherein the processing module is further configured to flag the first classification rule for manual inspection when the score of the first classification rule is between a second threshold and a first threshold.

21. The apparatus according to any one of claims 13-20, wherein the processing module is specifically configured to determine, according to the first log and the first log template, that the classification result of the first log is the first classification result.

22. The apparatus according to any one of claims 13-21, wherein the obtaining module is specifically configured to obtain a label of the first log, where the label is used to indicate the second classification result; and obtaining a second classification result of the first log according to the label.

23. The apparatus of any one of claims 13-22, wherein the obtaining module is further configured to obtain source information of the first log; and acquiring the first classification rule according to the source information.

24. The apparatus of any one of claims 13-23, wherein the obtaining module is further configured to obtain a second log;

the matching module is also used for determining the classification result of the second log according to the second log and the classification rule base;

The device also comprises an output module for outputting the classification result of the second log.

25. A computing device comprising a processor and a memory, the processor to execute instructions stored in the memory to cause the computing device to perform the method of any of claims 1-12.

26. A cluster of computing devices, comprising at least one computing device, each computing device comprising a processor and a memory;

The processor of the at least one computing device is configured to execute instructions stored in a memory of the at least one computing device to cause the cluster of computing devices to perform the method of any of claims 1-12.

27. A computer program product containing instructions that, when executed by a computing device, cause the computing device to perform the method of any of claims 1 to 12.

28. A computer program product containing instructions that, when executed by a cluster of computing devices, cause the cluster of computing devices to perform the method of any of claims 1-12.

29. A computer readable storage medium comprising computer program instructions which, when executed by a computing device, perform the method of any of claims 1 to 12.

30. A computer readable storage medium comprising computer program instructions which, when executed by a cluster of computing devices, perform the method of any of claims 1-12.