WO2021047576A1 - 日志记录处理方法、装置、设备及机器可读存储介质 - Google Patents

日志记录处理方法、装置、设备及机器可读存储介质 Download PDF

Info

Publication number
WO2021047576A1
WO2021047576A1 PCT/CN2020/114412 CN2020114412W WO2021047576A1 WO 2021047576 A1 WO2021047576 A1 WO 2021047576A1 CN 2020114412 W CN2020114412 W CN 2020114412W WO 2021047576 A1 WO2021047576 A1 WO 2021047576A1
Authority
WO
WIPO (PCT)
Prior art keywords
operation behavior
sequence
event
resource consumption
log records
Prior art date
Application number
PCT/CN2020/114412
Other languages
English (en)
French (fr)
Inventor
林江彬
王勇
陈金富
Original Assignee
阿里巴巴集团控股有限公司
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Application filed by 阿里巴巴集团控股有限公司 filed Critical 阿里巴巴集团控股有限公司
Publication of WO2021047576A1 publication Critical patent/WO2021047576A1/zh

Links

Images

Classifications

    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/10—File systems; File servers
    • G06F16/18—File system types
    • G06F16/1805—Append-only file systems, e.g. using logs or journals to store data
    • G06F16/1815—Journaling file systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/10—File systems; File servers
    • G06F16/16—File or folder operations, e.g. details of user interfaces specifically adapted to file systems
    • G—PHYSICS
    • G06—COMPUTING; CALCULATING OR COUNTING
    • G06F—ELECTRIC DIGITAL DATA PROCESSING
    • G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
    • G06F16/10—File systems; File servers
    • G06F16/18—File system types

Definitions

  • This application relates to the field of Internet technology, and in particular to a log record processing method, device, equipment, and machine-readable storage medium.
  • Log records are generated during equipment operation, such as application log records, security log records, system log records, etc.
  • Log records are an important medium for recording software information, system information, and hardware information.
  • Log records can be a single file, a collection of files, a database, a data stream, and so on.
  • the content in the log record includes time stamp, event information, system status information, error information, user information, application information, etc.
  • users can monitor the safety of the equipment, detect abnormal behaviors, deal with the abnormalities of the equipment in time, ensure the normal operation of the equipment, and find system or software errors.
  • This application provides a log record processing method, the method includes:
  • log records where the log records include user information, operation behavior events, and resource consumption values;
  • the target operation behavior sequence is determined by using the operation behavior sequence.
  • log records where the log records include user information and operation behavior events
  • the target operation behavior sequence is determined by using the operation behavior sequence.
  • the present application provides a log record processing device, the device includes:
  • the obtaining module is used to obtain log records, the log records including user information, operation behavior events, and resource consumption values; the determining module is used to determine the category group to which the log records belong according to the resource consumption values and operation behavior events;
  • the user information determines the log records belonging to the same user, and determines the operation behavior sequence of the user according to the operation behavior events and category groups of the log records belonging to the same user; and uses the operation behavior sequence to determine the target operation behavior sequence.
  • This application provides a log record processing device, including:
  • log records where the log records include user information, operation behavior events, and resource consumption values;
  • the target operation behavior sequence is determined by using the operation behavior sequence.
  • This application provides a machine-readable storage medium that stores a number of computer instructions; when the computer instructions are executed, the following processing is performed:
  • log records where the log records include user information, operation behavior events, and resource consumption values;
  • a target operation behavior sequence which is an operation behavior sequence frequently performed by a large number of users.
  • the target operation behavior sequence includes the operation behavior event and the resource consumption value of the operation behavior event (such as the consumed storage space, CPU size, memory size, etc.).
  • the target operation behavior sequence can be used to know which operation behavior events are frequently executed, and The size of the resources consumed, and then effective control of the resources, to ensure the normal operation of the business.
  • the resource consumption values of the same operation behavior event can be grouped, thereby greatly reducing the number of operation behavior sequences and improving the processing efficiency when determining the target operation behavior sequence.
  • FIG. 1 is a schematic flowchart of a log record processing method in an embodiment of the present application
  • FIG. 2 is a schematic flowchart of a log record processing method in another embodiment of the present application.
  • FIG. 3 is a schematic structural diagram of a log recording processing device in an embodiment of the present application.
  • FIG. 4 is a schematic structural diagram of a log record processing device in an embodiment of the present application.
  • Fig. 5 is a structural diagram of a log recording processing system in an embodiment of the present application.
  • first, second, third, etc. may be used in the embodiments of the present application to describe various information, the information should not be limited to these terms. These terms are only used to distinguish the same type of information from each other.
  • first information may also be referred to as second information, and similarly, the second information may also be referred to as first information.
  • second information may also be referred to as first information.
  • if used can be interpreted as "when” or "when” or "in response to certainty.”
  • the embodiment of the application proposes a log record processing method, which is applied to a log record processing device.
  • the log record processing device can be any type of device, such as a server, a network device (such as a router, a switch), and a PC (Personal Computer). ), etc. There is no restriction on this, as long as the log records can be generated, and the server is taken as an example in the follow-up.
  • the server can generate a large number of log records. For example, for the user's login operation, the server generates a log record for the login operation.
  • the log record may include operation behavior events, and the operation behavior event is a login operation .
  • the server generates a log record for the registration operation.
  • the log record may include an operation behavior event, and the operation behavior event is a registration operation.
  • the server For the user's search operation, the server generates a log record for the search operation.
  • the log record may include operation behavior events, and the operation behavior event is a search operation, and so on, and there is no restriction on the types of operation behavior events.
  • FIG. 1 is a schematic flowchart of the log record processing method
  • the method may include:
  • Step 101 Obtain log records.
  • the log records may include, but are not limited to, one or any combination of the following: user information, operation behavior events, and resource consumption values.
  • the attribute information that needs to be extracted can be configured in advance, which means that the attribute information needs to be obtained from a large amount of information recorded in the log.
  • the attribute information can be arbitrarily configured according to actual needs, and there is no restriction on this.
  • the attribute information includes but is not limited to one or any combination of the following: user information, operation behavior event, resource consumption value, time stamp, and operation time value.
  • the data structure can be configured in advance. For a large number of log records obtained, user information, operation behavior events, resource consumption values, timestamps, and operation time values can be extracted from each log record, and these information Record to the data structure.
  • Table 1 is just an example.
  • the data structure can include a large amount of log information. In the subsequent process, analysis is performed based on the information in the data structure.
  • Log record identifier User Info Operational behavior event Resource consumption value Timestamp Operating time value
  • Log record 1 User Information 1 Login operation 15 bytes Timestamp 1 3 seconds
  • Logging 2 User Information 1 Search operation 120 bytes Timestamp 2 6 seconds
  • Log record 3 User Information 2
  • Login operation 16 bytes Timestamp 3 4 seconds
  • Logging 4 User Information 1
  • Shopping cart operation 800 bytes Timestamp 4 5 seconds
  • Log record 5 User Information 2 Search operation 126 bytes Timestamp 5 160 seconds
  • Log record 6 User Information 2 Purchase operation 1500 bytes Timestamp 6 7 seconds ... ... ... ... ... ... ... ... ...
  • the user information is used to uniquely indicate a user.
  • the user information can be a user identification (user ID), an IP address, a browser fingerprint, etc., and there is no restriction on this user information.
  • Operational behavior events are used to represent user operation behaviors, such as user login operations, and operation behavior events are login operations.
  • the operation behavior event is a search operation.
  • the operation behavior event is the shopping cart operation.
  • the operation behavior event is a purchase operation.
  • the resource consumption value is used to represent the resource consumption value of the operation behavior event, for example, storage space size, CPU size, memory size, etc. There is no restriction on the type of this consumption resource value, and the following takes the consumption resource value as the storage space size as an example.
  • the 15 bytes in log record 1 indicate that the login operation for user information 1 uses a total of 15 bytes of storage space.
  • the 120 bytes in log record 2 indicate that the search operation for user information 1 used a total of 120 bytes of storage space, and so on.
  • the timestamp is used to indicate the generation time of the log record. For example, timestamp 1 indicates that log record 1 was generated at timestamp 1, and timestamp 2 indicates that log record 2 was generated at timestamp 2, and so on. You can agree on the format of the timestamp (such as year, month, day, hour, minute, second, etc.), and use this format to record the timestamp in the data structure. There is no restriction on the format of the timestamp, and it can be based on actual needs. Configuration.
  • the operation time value is used to indicate the operation time value of the operation behavior event. For example, 3 seconds in log record 1 indicates that the login operation for user information 1 took a total of 3 seconds. The 6 seconds in log record 2 means that the search operation for user information 1 took a total of 6 seconds, and so on.
  • Step 102 Determine the category group to which the log record belongs based on the resource consumption value and the operation behavior event.
  • At least one category group may be created for each operation behavior event, and when the at least one category group is created, different category groups may correspond to different resource value intervals.
  • a category group 11, a category group 12, and a category group 13 are created for the login operation.
  • the category group 11 corresponds to the resource value interval 11, and the resource value interval 11 is an interval [0 byte, 10 bytes).
  • the category group 12 corresponds to the resource value interval 12, and the resource value interval 12 is an interval [10 bytes, 20 bytes).
  • the category group 13 corresponds to the resource value interval 13, and the resource value interval 13 is an interval [20 bytes, positive infinity).
  • the category group 21 corresponds to the resource value interval 21, and the resource value interval 21 is an interval [0 byte, 100 bytes).
  • the category group 22 corresponds to the resource value interval 22, and the resource value interval 22 is an interval [100 bytes, 200 bytes).
  • the category group 23 corresponds to the resource value interval 23, and the resource value interval 23 is an interval [200 bytes, positive infinity).
  • the category group 31 corresponds to the resource value interval 31, and the resource value interval 31 is an interval [0 byte, 1000 bytes).
  • the category group 32 corresponds to a resource value interval 32, and the resource value interval 32 is an interval [1000 bytes, 2000 bytes).
  • the category group 33 corresponds to the resource value interval 33, and the resource value interval 33 is an interval [2000 bytes, positive infinity).
  • a category group 41, a category group 42, and a category group 43 are created for the purchase operation.
  • the category group 41 corresponds to the resource value interval 41, and the resource value interval 41 is an interval [0 byte, 1000 bytes).
  • the category group 42 corresponds to the resource value interval 42, and the resource value interval 42 is an interval [1000 bytes, 2000 bytes).
  • the category group 43 corresponds to the resource value interval 43, and the resource value interval 43 is an interval [2000 bytes, positive infinity).
  • category groups and resource value intervals, and there is no restriction on this.
  • 4 category groups are created for each operation behavior event, and the 4 category groups correspond to 4 resource value intervals.
  • the category group to which the log record belongs can be determined according to the resource consumption value and the operation behavior event of the log record. Specifically, it is possible to determine all resource value intervals corresponding to the operation behavior event, and determine the resource value interval in which the consumed resource value is located from all resource value intervals corresponding to the operation behavior event; then, determine the resource value interval Corresponding category group, and divide the log record into the category group.
  • the operation behavior event of log record 1 is a login operation, and the resource consumption value is 15 bytes.
  • the login operation corresponds to the resource value interval 11, the resource value interval 12, and the resource value interval 13, and 15 bytes are located in the resource value interval 12. Therefore, the log record 1 is divided into the category group 12 corresponding to the resource value interval 12.
  • the operation behavior event of log record 2 is a search operation, and the resource consumption value is 120 bytes.
  • the search operation corresponds to the resource value interval 21, the resource value interval 22, and the resource value interval 23, and 120 bytes are located in the resource value interval 22. Therefore, the log record 2 is divided into the category group 22 corresponding to the resource value interval 22.
  • the operation behavior event of log record 3 is a login operation, and the resource consumption value is 16 bytes, and log record 3 is divided into category group 12.
  • the operation behavior event of log record 4 is a shopping cart operation, and the resource consumption value is 800 bytes.
  • the log record 4 is divided into category group 31.
  • the operation behavior event of log record 5 is a search operation, and the resource consumption value is 126 bytes.
  • the log record 5 is divided into category group 22.
  • the operation behavior event of the log record 6 is a purchase operation, and the resource consumption value is 1500 bytes.
  • the log record 6 is divided into the category group 42.
  • Step 103 Determine log records belonging to the same user according to the user information, and determine the user's operation behavior sequence according to the operation behavior events and category groups of the log records belonging to the same user.
  • the log record further includes a timestamp and an operation time value
  • determining the user's operation behavior sequence according to the operation behavior event and category group of the log records belonging to the same user may include:
  • Manner 1 Based on the sequence of time stamps, an initial sequence is determined according to the operation behavior events and category groups of log records belonging to the same user, and the initial sequence is determined as the user's operation behavior sequence.
  • a certain character may be used to indicate an operation behavior event, for example, a indicates a login operation, b indicates a search operation, c indicates a shopping cart operation, and d indicates a purchase operation.
  • Table 1 since log record 1, log record 2 and log record 4 correspond to the same user information 1, therefore, log record 1, log record 2 and log record 4 belong to the same user's log records, and are based on the time stamp.
  • sort the a12 of log record 1 (a represents the login operation, 12 represents the group ID of the category group), b22 of log record 2 and c31 of log record 4. Assuming the sorting result is a12, b22, c31, the initial The sequence is a12-b22-c31, and the initial sequence a12-b22-c31 is determined as the operation behavior sequence of user information 1.
  • log record 3 correspond to the same user information 2, therefore, log record 3, log record 5, and log record 6 belong to the same user's log records, and are based on the timestamp
  • Manner 2 Based on the sequence of time stamps, the initial sequence is determined according to the operation behavior events and category groups of log records belonging to the same user. The initial sequence is divided into at least one sub-sequence according to the operation time value and the resource consumption value, and the at least one sub-sequence is determined as the user's operation behavior sequence.
  • dividing the initial sequence into at least one sub-sequence according to the operation time value and the resource consumption value includes: for each operation behavior event in the initial sequence (such as the operation behavior event and the category group corresponding to the operation behavior event), According to the operation time value and resource consumption value corresponding to the operation behavior event, it is determined whether the operation behavior event (such as the operation behavior event and the category group corresponding to the operation behavior event) is a segmentation node; if it is, it is located in the initial sequence At least one operation behavior event and category group preceding the operation behavior event (for example, the operation behavior event and the category group corresponding to the operation behavior event) are divided into sub-sequences. If not, the operation behavior event and the category group before the operation behavior event (such as the operation behavior event and the category group corresponding to the operation behavior event) are not segmented.
  • log record 1, log record 2 and log record 4 correspond to the same user information 1, therefore, log record 1, log record 2 and log record 4 belong to the same user's log records, and are based on the time stamp.
  • b22 in the initial sequence a12-b22-c31 determine the operation time value and resource consumption value corresponding to b22, that is, the operation time value (6 seconds) and resource consumption value (120 bytes) of log record 2. Determine whether b22 is a split node according to the operating time value (6 seconds) and the resource consumption value (120 bytes). If not, then determine the next operation behavior event and category group. If yes, divide the operation behavior event and category group before b22 in the initial sequence a12-b22-c31 into sub-sequences to obtain a sub-sequence, the sub-sequence is a12, and then continue to judge the next operation behavior event and category group.
  • c31 in the initial sequence a12-b22-c31 determine the operation time value and resource consumption value corresponding to c31, that is, the operation time value (5 seconds) and resource consumption value (800 bytes) of log record 4. Determine whether c31 is a split node according to the operating time value (5 seconds) and the resource consumption value (800 bytes). If not, the judgment process is ended. If so, the operation behavior event and category group located before c31 in the initial sequence a12-b22-c31 are divided into sub-sequences.
  • c31 is a subsequence, that is, 3 subsequences are obtained for user information 1
  • the first subsequence is a12
  • the second subsequence It is b22 and the third subsequence is c31.
  • a12 is not divided into sub-sequences
  • a12 and b22 are divided into sub-sequences
  • c31 is a sub-sequence, that is, two sub-sequences are obtained for user information 1.
  • the first sub-sequence is a12-b22
  • the second The subsequence is c31.
  • log record 3 As log record 3, log record 5, and log record 6 correspond to the same user information 2, therefore, log record 3, log record 5, and log record 6 belong to the same user's log records, and are based on the timestamp
  • the operation behavior event (such as the operation behavior event and category group) is a segmentation node, which may include but is not limited to: according to the operation time value and Consume resource value, determine the residual error of operation behavior event (such as operation behavior event and category group); if the residual error is greater than the residual error threshold, determine that the operation behavior event is a segmentation node; if the residual error is not greater than the residual threshold , It is determined that the operation behavior event is not a split node.
  • the user’s initial sequence can be divided into at least one sub-sequence. If all the operation behavior events of the initial sequence are not split nodes, the initial sequence is divided into one sub-sequence. If all the operation behaviors of the initial sequence are If there are split nodes in the event, the initial sequence is split into multiple sub-sequences.
  • the operation behavior event of the log record and the group information of the category group to which the log record belongs can be referred to as the operation behavior parameter.
  • the operation behavior parameter may include, but is not limited to: the operation behavior event, the group information of the category group Group information, such as the group ID of the category group to which the log record belongs.
  • the operation behavior parameter of the log record can be determined according to the operation behavior event and category group.
  • the operation behavior parameter of log record 1 includes login operation and category group 12; the operation behavior parameter of log record 2 includes search operation and category group 22.
  • the operation behavior parameters of log record 3 include login operation and category group 12.
  • the operation behavior parameters of log record 4 include shopping cart operation and category group 31.
  • the operation behavior parameters of log record 5 include search operation and category group 22.
  • the operation behavior parameters of the log record 6 include the purchase operation and the category group 42.
  • a certain character may be used to indicate an operation behavior event, for example, a indicates a login operation, b indicates a search operation, c indicates a shopping cart operation, and d indicates a purchase operation.
  • the operation behavior parameter of log record 1 includes a12, that is, login operation and category group 12.
  • the operation behavior parameter of log record 2 includes b22.
  • the operation behavior parameter of log record 3 includes a12.
  • the operation behavior parameter of log record 4 includes c31.
  • the operation behavior parameter of log record 5 includes b22.
  • the operating behavior parameters of log record 6 include d42.
  • multiple category groups can be divided for the same operation behavior event, and the category groups correspond to the resource value range, rather than the specific resource consumption. value.
  • these resource consumption values can be determined to be the same category and belong to the same category group.
  • the resource consumption value of the operation behavior event is distributed from 0 to infinity, by dividing the category group, the number of operation behavior parameters can be significantly reduced. For example, if the category group is not divided, the operation behavior parameter of log record 1 is a15, 15 represents 15 bytes, the operation behavior parameter of log record 3 is a16, and 16 represents 16 bytes.
  • the operation behavior parameters of log record 1 and log record 3 are both a12, and 12 represents category group 12.
  • the operation behavior parameters include a11, a12, and a13.
  • a one-dimensional clustering method (such as Jenks Natural Breaks) can be used to divide multiple category groups for the same operation behavior event, and each category group corresponds to a different resource value interval, which is not limited.
  • the operation behavior event that can be used as the segmentation node is the operation behavior event that is stuck in all the operation behavior events. For example, when a user performs a login operation, if the residence time is relatively long, the login operation is a stuck operation behavior event, that is, the operation behavior event is an operation behavior event that can be used as a segmentation node.
  • the residual error of the operation behavior event can be determined according to the operation time value and resource consumption value of the operation behavior event; if the residual error is greater than the residual threshold, it is determined that the operation behavior event is a stagnant operation behavior event, namely The operation behavior event is a segmentation node; if the residual is not greater than the residual threshold, it is determined that the operation behavior event is not a stagnant operation behavior event, that is, the operation behavior event is not a segmentation node.
  • a linear regression method can be used to determine whether the operation behavior event is a stagnant operation behavior event. For example, in the process of user operation, the greater the resource consumption value, the longer the operation time. Therefore, a linear regression model can be established based on the operation time value and the resource consumption value.
  • the linear regression model is used to record the operation time value and consumption value. Correspondence between resource value and residual.
  • the operating time value of the operating behavior event is used as the independent variable
  • the resource consumption value of the operating behavior event is used as the independent variable.
  • the linear regression model can be queried according to the operation time value and resource consumption value of the operation behavior event to obtain the residual error of the operation behavior event.
  • the linear regression model based on the linear regression model, if the operation time value is large and the resource consumption value is small, the residual error is relatively large, and if the operation time value is small and the resource consumption value is relatively large, the residual error is relatively small.
  • the linear regression model can be selected arbitrarily, as long as the linear regression model is used to record the corresponding relationship between the operation time value, the resource consumption value and the residual. In this way, based on the linear regression model, the operation can be based on the operation behavior event. The time value and the resource consumption value determine the residual error of the operation behavior event.
  • the residual threshold can be configured based on experience. For example, the residual threshold is 0.5, 0.6, etc., which is not limited. If the residual error of the operational behavior event is greater than the residual threshold, the operational behavior event is a segmentation node; if the residual of the operational behavior event is not greater than the residual threshold, the operational behavior event is not a segmentation node.
  • Step 104 Determine the target operation behavior sequence by using the operation behavior sequence.
  • the target operation behavior sequence is a frequent sequence, indicating that the target operation behavior sequence appears in multiple operation behavior sequences.
  • a common subsequence can be determined by using an operation behavior sequence, and the common subsequence appears in multiple operation behavior sequences. Determine the number of occurrences of the common subsequence in all operation behavior sequences; if the number of occurrences is greater than the number threshold, determine the target operation behavior sequence according to the common subsequence.
  • the longest common prefix method can be used to mine common subsequences in all operation behavior sequences, and the common subsequences appear in multiple operation behavior sequences.
  • the number of occurrences of the common sub-sequence a12-b22 in all operation behavior sequences may be 10.
  • the number of occurrences of the common sub-sequence a13-b22 in all operation behavior sequences can be 8.
  • the number of occurrences of the common sub-sequence a11-b21-c33 in all operation behavior sequences can be 6.
  • multiple common subsequences can be mined based on all operation behavior sequences, and the number of occurrences of each common subsequence in all operation behavior sequences can be known, which will not be repeated here.
  • the target operation behavior sequence can be determined from all common subsequences. For example, for each common subsequence, if the number of occurrences of the common subsequence in all operation behavior sequences is greater than the number threshold, it is determined that the common subsequence is the target operation behavior sequence. Or, if the number of occurrences of the common subsequence in all operation behavior sequences is not greater than the number threshold, it is determined that the common subsequence is not the target operation behavior sequence.
  • the frequency threshold can be configured based on experience, and the frequency threshold has nothing to do with the number of operation behavior events in the common subsequence.
  • the frequency threshold may be 8.
  • the value 8 is only an example, and the frequency threshold is not limited, and can be configured arbitrarily based on experience.
  • the number of occurrences of the common sub-sequence a12-b22 in all operation behavior sequences is 10 (greater than the number threshold), therefore, the common sub-sequence a12-b22 is the target operation behavior sequence.
  • the number of occurrences of the common sub-sequence a13-b22 in all operation behavior sequences is 8 (not greater than the number threshold), therefore, the common sub-sequence a13-b22 is not the target operation behavior sequence.
  • the number of occurrences of the common sub-sequence a11-b21-c33 in all operation behavior sequences is 6 (not greater than the number threshold), therefore, the common sub-sequence a11-b21-c33 is not the target operation behavior sequence.
  • the number threshold is related to the number of operation behavior events in the common subsequence. Specifically, according to the number of operation behavior events in the common subsequence, the frequency threshold corresponding to the common subsequence is determined; wherein, if the number of operation behavior events is larger, the frequency threshold is smaller.
  • the threshold of times may be 8.
  • the value of 8 is only an example, and there is no limitation on the threshold of times, and it can be arbitrarily configured based on experience.
  • the threshold of times can be 5.
  • the value of 5 is only an example, and there is no limit to the threshold of times, and it can be configured arbitrarily according to experience.
  • the number threshold can be 3.
  • the value 3 is only an example, and there is no limit to the number threshold, and it can be configured arbitrarily based on experience.
  • the number of operation behavior events in the common subsequence a12-b22 is 2, therefore, the number threshold can be 8, that is, the number of occurrences of the common subsequence a12-b22 in all operation behavior sequences is 10 (more than the number of times Threshold), therefore, the common subsequence a12-b22 is the target operation behavior sequence.
  • the number of operation behavior events in the common subsequence a13-b22 is 2, therefore, the number threshold can be 8, that is, the number of occurrences of the common subsequence a13-b22 in all operation behavior sequences is 8 (not greater than the number threshold ), therefore, the common subsequence a13-b22 is not the target operation behavior sequence.
  • the number of operation behavior events in the common subsequence a11-b21-c33 is 3, therefore, the number threshold can be 5, that is, the number of occurrences of the common subsequence a11-b21-c33 in all operation behavior sequences is 6( Greater than the number threshold), therefore, the common subsequence a11-b21-c33 is the target operation behavior sequence.
  • multiple operation behavior sequences can be used to determine the target operation behavior sequence.
  • the target operation behavior sequence is a frequent sequence, which means that the target operation behavior sequence appears in multiple operation behavior sequences.
  • the target operation behavior sequence can be used to know which operations Behavioral events are frequently executed, and the amount of resources consumed, and then effective control of resources, to ensure the normal operation of the business.
  • log records may include, but are not limited to, load log records, such as load test log records, historical load log records, simulated load log records, real-time load log records, etc.
  • load log records such as load test log records, historical load log records, simulated load log records, real-time load log records, etc.
  • type of log records which can be Any type of logging.
  • the foregoing execution order is just an example for the convenience of description. In practical applications, the execution order between steps can also be changed, and the execution order is not limited. Moreover, in other embodiments, the steps of the corresponding method are not necessarily executed in the order shown and described in this specification, and the steps included in the method may be more or less than those described in this specification. In addition, a single step described in this specification may be decomposed into multiple steps for description in other embodiments; multiple steps described in this specification may also be combined into a single step for description in other embodiments.
  • a target operation behavior sequence which is an operation behavior sequence frequently performed by a large number of users.
  • the target operation behavior sequence includes the operation behavior event and the resource consumption value of the operation behavior event (such as the consumed storage space, CPU size, memory size, etc.).
  • the target operation behavior sequence can be used to know which operation behavior events are frequently executed, and The size of the resources consumed, and then effective control of the resources, to ensure the normal operation of the business.
  • the resource consumption values of the same operation behavior event can be grouped, thereby greatly reducing the number of operation behavior sequences and improving the processing efficiency when determining the target operation behavior sequence.
  • this embodiment of the present application proposes a method for efficiently mining target operation behavior sequences (ie, user frequent sequences).
  • the context information can include user information, operation behavior events, resource consumption values, timestamps, and operation time values.
  • one-dimensional clustering methods such as Jenks Natural Breaks
  • Jenks Natural Breaks can be used to divide the consumption resources of all users of the same operation behavior event. Values are grouped, and finally the consumed resource values belonging to the same group are determined to be in the same category and belong to the same category group.
  • the resource consumption values of operation behavior events are distributed from 0 to infinity, by dividing the category groups, the number of operation behavior events can be significantly reduced.
  • the operation time value and the resource consumption value can be used to divide the user's initial sequence into multiple subsequences.
  • linear regression can be used. The method divides all operation behavior events that are stuck in operation behavior events, that is, divides the initial sequence into multiple sub-sequences where there are stuck operation behavior events.
  • the resource consumption value of the operation behavior event is used as the independent variable
  • the operation time value of the operation behavior event is used as the independent variable.
  • the operation behavior event is the event of the segmented sequence.
  • one-dimensional clustering method when analyzing the resource consumption value of the same operation behavior event, one-dimensional clustering method can be used to group the resource consumption value of the same operation behavior event, that is, the consumption resource value is clustered.
  • the distribution of consumption resource values can be greatly reduced, thereby improving processing efficiency.
  • the greater the resource consumption value of the operation behavior event the longer the operation time value of the operation behavior event. Therefore, a linear regression model can be established based on the resource consumption value and the operation time value, and the linear regression model can be used
  • the user's initial sequence is segmented to obtain multiple sub-sequences, and then the target operation behavior sequence can be more accurately identified.
  • the target operation behavior sequence can be displayed efficiently and vividly.
  • FIG. 2 is a schematic flowchart of the log record processing method
  • the method may include:
  • Step 201 Obtain log records, where the log records include but are not limited to one or any combination of the following: user information, operation behavior events, and resource consumption values.
  • log records can include user information, operating behavior events, resource consumption values, time stamps, and operating time values.
  • Step 202 Determine the log records belonging to the same user according to the user information, and determine the operation behavior sequence of the user according to the operation behavior events of the log records belonging to the same user.
  • the operation behavior sequence may include all log-recorded operation behavior events belonging to the user; in another example, the operation behavior sequence may include all log-recorded operation behavior events and consumption events belonging to the user. Resource value; in another example, the operation behavior sequence may include the operation behavior events of all log records belonging to the user, and the group information of the category group to which each log record belongs, where the category group is based on the resource consumption value and the operation behavior The event is ok.
  • the process of determining the sequence of operation behaviors may include but is not limited to:
  • Manner 1 Based on the sequence of time stamps, an initial sequence is determined based on the operation behavior events recorded in the log belonging to the same user, and the initial sequence is determined as the user's operation behavior sequence.
  • Method 2 Based on the sequence of time stamps, the initial sequence is determined according to the operation behavior events recorded in the logs belonging to the same user.
  • the initial sequence is divided into at least one sub-sequence according to the operation time value and the resource consumption value, and the at least one sub-sequence is determined as the user's operation behavior sequence.
  • dividing the initial sequence into at least one sub-sequence according to the operation time value and the resource consumption value may include: for each operation behavior event in the initial sequence, according to the operation time value and resource consumption value of the operation behavior event, It is determined whether the operation behavior event is a segmentation node; if so, at least one operation behavior event located before the operation behavior event in the initial sequence is divided into sub-sequences.
  • determining whether the operation behavior event is a segmentation node according to the operation time value and the resource consumption value of the operation behavior event may include, but is not limited to: determining the residual error of the operation behavior event according to the operation time value and the resource consumption value ; If the residual is greater than the residual threshold, it is determined that the operation behavior event is a segmentation node; if the residual is not greater than the residual threshold, it is determined that the operation behavior event is not a segmentation node.
  • the user’s initial sequence can be divided into at least one sub-sequence. If all the operation behavior events of the initial sequence are not split nodes, the initial sequence is divided into one sub-sequence. If all the operation behaviors of the initial sequence are If there are split nodes in the event, the initial sequence is split into multiple sub-sequences.
  • the operation behavior event that can be used as the segmentation node is the operation behavior event that is stuck in all the operation behavior events. For example, when a user performs a login operation, if the residence time is long, the operation behavior event corresponding to this login operation is a stuck operation behavior event, that is, the operation behavior event is an operation behavior event that can be used as a segmentation node.
  • the residual error of the operation behavior event can be determined according to the operation time value and resource consumption value of the operation behavior event; if the residual error is greater than the residual threshold, it is determined that the operation behavior event is a stagnant operation behavior event, namely The operation behavior event is a segmentation node; if the residual is not greater than the residual threshold, it is determined that the operation behavior event is not a stagnant operation behavior event, that is, the operation behavior event is not a segmentation node.
  • a linear regression method can be used to determine whether the operation behavior event is a stagnant operation behavior event. For example, in the process of user operation, the greater the resource consumption value, the longer the operation time. Therefore, a linear regression model can be established based on the operation time value and the resource consumption value.
  • the linear regression model is used to record the operation time value and consumption value. Correspondence between resource value and residual.
  • the operating time value of the operating behavior event is used as the independent variable
  • the resource consumption value of the operating behavior event is used as the independent variable.
  • the linear regression model can be queried according to the operation time value and resource consumption value of the operation behavior event to obtain the residual error of the operation behavior event.
  • the linear regression model based on the linear regression model, if the operation time value is large and the resource consumption value is small, the residual error is relatively large, and if the operation time value is small and the resource consumption value is relatively large, the residual error is relatively small.
  • the linear regression model can be selected arbitrarily, as long as the linear regression model is used to record the corresponding relationship between the operation time value, the resource consumption value and the residual. In this way, based on the linear regression model, the operation can be based on the operation behavior event. The time value and the resource consumption value determine the residual error of the operation behavior event.
  • Step 203 Determine the target operation behavior sequence by using the operation behavior sequence.
  • the target operation behavior sequence is a frequent sequence, which means that the target operation behavior sequence appears in the operation behavior sequence of multiple users.
  • a common subsequence can be determined by using an operation behavior sequence, and the common subsequence appears in multiple operation behavior sequences. Determine the number of occurrences of the common subsequence in all operation behavior sequences; if the number of occurrences is greater than the number threshold, determine the target operation behavior sequence according to the common subsequence.
  • the target operation behavior sequence can be determined from all common subsequences. For example, for each common subsequence, if the number of occurrences of the common subsequence in all operation behavior sequences is greater than the number threshold, it is determined that the common subsequence is the target operation behavior sequence. Or, if the number of occurrences of the common subsequence in all operation behavior sequences is not greater than the number threshold, it is determined that the common subsequence is not the target operation behavior sequence.
  • the frequency threshold can be configured based on experience, and the frequency threshold has nothing to do with the number of operation behavior events in the common subsequence.
  • the number threshold is related to the number of operation behavior events in the common subsequence. According to the number of operation behavior events in the common subsequence, determine the frequency threshold corresponding to the common subsequence; wherein, if the number of operation behavior events is larger, the frequency threshold is smaller.
  • log records may include, but are not limited to, load log records, such as load test log records, historical load log records, simulated load log records, real-time load log records, etc.
  • load log records such as load test log records, historical load log records, simulated load log records, real-time load log records, etc.
  • type of log records which can be Any type of logging.
  • a target operation behavior sequence which is an operation behavior sequence frequently performed by a large number of users.
  • the target operation behavior sequence includes the operation behavior event and the resource consumption value of the operation behavior event (such as the consumed storage space, CPU size, memory size, etc.).
  • the target operation behavior sequence can be used to know which operation behavior events are frequently executed, and The size of the resources consumed, and then effective control of the resources, to ensure the normal operation of the business.
  • an embodiment of the present application also provides a log record processing device.
  • FIG. 3 it is a structural diagram of the log record processing device, and the device includes:
  • the obtaining module 31 is configured to obtain log records, the log records including user information, operation behavior events, and resource consumption values;
  • the determining module 32 is configured to determine the category group to which the log record belongs according to the resource consumption value and the operation behavior event; determine the log record belonging to the same user according to the user information, and determine the operation behavior event and the operation behavior event of the log record belonging to the same user according to the user information.
  • the category group determines the operation behavior sequence of the user; the operation behavior sequence is used to determine the target operation behavior sequence.
  • the determining module 32 determines the category group to which the log record belongs according to the resource consumption value and the operation behavior event, it is specifically used to: determine all the resource value intervals corresponding to the operation behavior event; from all resources corresponding to the operation behavior event In the value interval, determine the resource value interval in which the consumed resource value is located; determine the category group corresponding to the resource value interval; and divide the log record into the category group.
  • the determining module 32 is further configured to: create at least one category group for each operation behavior event;
  • the log record also includes a timestamp and an operating time value.
  • the determining module 32 is specifically used to determine the user's operating behavior sequence according to the operating behavior events and category groups of the log records belonging to the same user: Sequence, the initial sequence is determined according to the operational behavior events and category groups of log records belonging to the same user; the initial sequence is determined as the user’s operational behavior sequence; or, based on the sequence of timestamps, according to logs belonging to the same user
  • the recorded operation behavior event and category group determine an initial sequence; the initial sequence is divided into at least one subsequence according to the operation time value and the resource consumption value, and the at least one subsequence is determined as the user's operation behavior sequence.
  • the determining module 32 divides the initial sequence into at least one sub-sequence according to the operation time value and the resource consumption value, it is specifically used to: for the operation behavior event in the initial sequence, according to the operation time corresponding to the operation behavior event The value and the resource consumption value are used to determine whether the operation behavior event is a segmentation node; if so, at least one operation behavior event and category group located before the operation behavior event in the initial sequence is divided into sub-sequences.
  • the operation behavior event is a segmentation node
  • the determining module 32 uses the operation behavior sequence to determine the target operation behavior sequence, it is specifically configured to: use the operation behavior sequence to determine a common subsequence that appears in multiple operation behavior sequences; and determine the common subsequence. The number of occurrences of the subsequence in all operation behavior sequences; if the number of occurrences is greater than the number threshold, the target operation behavior sequence is determined according to the common subsequence.
  • the determining module 32 determines the frequency threshold corresponding to the common subsequence according to the number of operation behavior events in the common subsequence; if the number of operation behavior events is larger, the frequency threshold is smaller.
  • an embodiment of the present application also provides a log record processing device, including: a processor and a machine-readable storage medium, the machine-readable storage medium stores a number of computer instructions, and the processing The processor performs the following processing when executing the computer instruction:
  • log records where the log records include user information, operation behavior events, and resource consumption values;
  • the embodiments of the present application also provide a machine-readable storage medium on which a number of computer instructions are stored; when the computer instructions are executed, the following processing is performed:
  • log records where the log records include user information, operation behavior events, and resource consumption values;
  • the target operation behavior sequence is determined by using the operation behavior sequence.
  • the log record processing device 40 may include: a processor 41, a network interface 42, a bus 43, and a memory 44.
  • the memory 44 may be any electronic, magnetic, optical, or other physical storage device, and may contain or store information, such as executable instructions, data, and so on.
  • the memory 44 may be: RAM (Radom Access Memory), volatile memory, non-volatile memory, flash memory, storage drives (such as hard drives), solid state drives, and any type of storage disks (such as optical disks). , Dvd, etc.).
  • the configuration of the log recording processing device 53 will be described below.
  • the first obtaining module 531 is configured to obtain log records from the database 52.
  • the log records include user information, operation behavior events, resource consumption values, time stamps, and operation time values.
  • the first determining module 532 is configured to determine the category group to which the log record belongs according to the resource consumption value and the operation behavior event.
  • the second determining module 533 is configured to determine log records belonging to the same user according to the user information, and determine the user's operation behavior sequence according to the operation behavior events and category groups of the log records belonging to the same user. For example, based on the sequence of timestamps, the initial sequence is determined based on the operation behavior events and category groups recorded in the logs belonging to the same user; the initial sequence is divided into at least one sub-sequence according to the operation time value and the resource consumption value, and the at least one sub-sequence is divided Determined as the user's operation behavior sequence.
  • the third determining module 534 is configured to use the operation behavior sequence to determine the target operation behavior sequence. So far, the target operation behavior sequence is successfully obtained, and the target operation behavior sequence is output.
  • a typical implementation device is a computer.
  • the specific form of the computer can be a personal computer, a laptop computer, a cellular phone, a camera phone, a smart phone, a personal digital assistant, a media player, a navigation device, an email receiving and sending device, and a game control A console, a tablet computer, a wearable device, or a combination of any of these devices.
  • the embodiments of the present application can be provided as methods, systems, or computer program products. Therefore, this application may adopt the form of a complete hardware embodiment, a complete software embodiment, or an embodiment combining software and hardware. Moreover, the embodiments of the present application may adopt the form of computer program products implemented on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program codes.
  • computer-usable storage media including but not limited to disk storage, CD-ROM, optical storage, etc.
  • these computer program instructions can also be stored in a computer-readable memory that can guide a computer or other programmable data processing equipment to work in a specific manner, so that the instructions stored in the computer-readable memory produce an article of manufacture including the instruction device,
  • the instruction device implements the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.
  • These computer program instructions can also be loaded on a computer or other programmable data processing equipment, so that a series of operation steps are executed on the computer or other programmable equipment to produce computer-implemented processing, so as to execute on the computer or other programmable equipment.
  • the instructions provide steps for implementing the functions specified in one process or multiple processes in the flowchart and/or one block or multiple blocks in the block diagram.

Landscapes

  • Engineering & Computer Science (AREA)
  • Theoretical Computer Science (AREA)
  • Data Mining & Analysis (AREA)
  • Databases & Information Systems (AREA)
  • Physics & Mathematics (AREA)
  • General Engineering & Computer Science (AREA)
  • General Physics & Mathematics (AREA)
  • Human Computer Interaction (AREA)
  • Debugging And Monitoring (AREA)

Abstract

一种日志记录处理方法、装置、设备及机器可读存储介质，该方法包括：获取日志记录，所述日志记录包括用户信息、操作行为事件、消耗资源值；根据消耗资源值和操作行为事件确定所述日志记录所属的类别组（102）；根据所述用户信息确定属于同一用户的日志记录，并根据属于同一用户的日志记录的操作行为事件和类别组确定所述用户的操作行为序列（103）；利用所述操作行为序列确定目标操作行为序列（104）。能够有效提取日志记录中有价值的信息。

Description

日志记录处理方法、装置、设备及机器可读存储介质
本申请要求2019年09月12日递交的申请号为201910863551.3、发明名称为“日志记录处理方法、装置、设备及机器可读存储介质”的中国专利申请的优先权，其全部内容通过引用结合在本申请中。
技术领域
本申请涉及互联网技术领域，尤其涉及一种日志记录处理方法、装置、设备及机器可读存储介质。
背景技术
设备运行过程会产生日志记录，如应用程序日志记录、安全日志记录、系统日志记录等，日志记录是记录软件信息、系统信息、硬件信息的重要媒介。日志记录可以是单个文件、文件集合、数据库、数据流等。日志记录中的内容包括时间戳、事件信息、系统状态信息、错误信息、用户信息、应用信息等。
用户通过分析日志记录中的内容，可以监控设备的安全性，检测异常行为，及时对设备的异常进行处理，保证设备正常运行，发现系统或软件的错误等。
但是，设备通常会产生大量日志记录，由用户人工分析大量日志记录中的内容，其工作量很大，而且，用户可能无法分析出日志记录中有价值的信息。
发明内容
本申请提供一种日志记录处理方法，所述方法包括：
获取日志记录，所述日志记录包括用户信息、操作行为事件、消耗资源值；
根据消耗资源值和操作行为事件确定所述日志记录所属的类别组；
根据所述用户信息确定属于同一用户的日志记录，并根据属于同一用户的日志记录的操作行为事件和类别组确定所述用户的操作行为序列；
利用所述操作行为序列确定目标操作行为序列。
本申请提供一种日志记录处理方法，所述方法包括：
获取日志记录，所述日志记录包括用户信息、操作行为事件；
根据所述用户信息确定属于同一用户的日志记录，并根据属于同一用户的日志记录的操作行为事件确定所述用户的操作行为序列；
利用所述操作行为序列确定目标操作行为序列。
本申请提供一种日志记录处理装置，所述装置包括：
获取模块，用于获取日志记录，所述日志记录包括用户信息、操作行为事件、消耗资源值；确定模块，用于根据消耗资源值和操作行为事件确定所述日志记录所属的类别组；根据所述用户信息确定属于同一用户的日志记录，并根据属于同一用户的日志记录的操作行为事件和类别组确定所述用户的操作行为序列；利用所述操作行为序列确定目标操作行为序列。
本申请提供一种日志记录处理设备，包括：
处理器和机器可读存储介质，所述机器可读存储介质上存储有若干计算机指令，所述处理器执行所述计算机指令时进行如下处理：
获取日志记录，所述日志记录包括用户信息、操作行为事件、消耗资源值；
根据消耗资源值和操作行为事件确定所述日志记录所属的类别组；
根据所述用户信息确定属于同一用户的日志记录，并根据属于同一用户的日志记录的操作行为事件和类别组确定所述用户的操作行为序列；
利用所述操作行为序列确定目标操作行为序列。
本申请提供一种机器可读存储介质，所述机器可读存储介质上存储有若干计算机指令；所述计算机指令被执行时进行如下处理：
获取日志记录，所述日志记录包括用户信息、操作行为事件、消耗资源值；
根据消耗资源值和操作行为事件确定所述日志记录所属的类别组；
根据所述用户信息确定属于同一用户的日志记录，并根据属于同一用户的日志记录的操作行为事件和类别组确定所述用户的操作行为序列；
利用所述操作行为序列确定目标操作行为序列。
基于上述技术方案，本申请实施例中，能够快速有效地提取日志记录中有价值的信息，如确定目标操作行为序列，目标操作行为序列是被大量用户频繁执行的操作行为序列。目标操作行为序列包括操作行为事件和操作行为事件的消耗资源值(如消耗的存储空间大小、CPU大小、内存大小等)，这样，通过目标操作行为序列可以获知哪些操作行为事件被频繁执行，且消耗的资源大小，继而对资源进行有效控制，保证业务的正常运行。在分析同一操作行为事件对应的消耗资源值时，可以将同一操作行为事件的消耗资源值进行分组，从而大大减少操作行为序列的数量，提高确定目标操作行为序列时的处理效率。
附图说明
为了更加清楚地说明本申请实施例或者现有技术中的技术方案，下面将对本申请实施例或者现有技术描述中所需要使用的附图作简单地介绍，显而易见地，下面描述中的附图仅仅是本申请中记载的一些实施例，对于本领域普通技术人员来讲，还可以根据本申请实施例的这些附图获得其它的附图。
图1是本申请一种实施方式中的日志记录处理方法的流程示意图；
图2是本申请另一种实施方式中的日志记录处理方法的流程示意图；
图3是本申请一种实施方式中的日志记录处理装置的结构示意图；
图4是本申请一种实施方式中的日志记录处理设备的结构示意图；
图5是本申请一种实施方式中的日志记录处理系统的结构图。
具体实施方式
在本申请实施例使用的术语仅仅是出于描述特定实施例的目的，而非限制本申请。本申请和权利要求书中所使用的单数形式的“一种”、“所述”和“该”也旨在包括多数形式，除非上下文清楚地表示其它含义。还应当理解，本文中使用的术语“和/或”是指包含一个或多个相关联的列出项目的任何或所有可能组合。
应当理解，尽管在本申请实施例可能采用术语第一、第二、第三等来描述各种信息，但这些信息不应限于这些术语。这些术语仅用来将同一类型的信息彼此区分开。例如，在不脱离本申请范围的情况下，第一信息也可以被称为第二信息，类似地，第二信息也可以被称为第一信息。取决于语境，此外，所使用的词语“如果”可以被解释成为“在……时”或“当……时”或“响应于确定”。
本申请实施例提出一种日志记录处理方法，应用于日志记录处理设备，该日志记录处理设备可以是任意类型的设备，如服务器、网络设备(如路由器、交换机)、PC(Personal Computer，个人计算机)等，对此不做限制，只要能够产生日志记录即可，后续以服务器为例。在用户通过客户端访问服务器的过程中，服务器可以产生大量日志记录，如针对用户的登录操作，服务器产生针对登录操作的日志记录，该日志记录可以包括操作行为事件，且操作行为事件为登录操作。针对用户的注册操作，服务器产生针对注册操作的日志记录，该日志记录可以包括操作行为事件，且操作行为事件为注册操作。针对用户的搜索操作，服务器产生针对搜索操作的日志记录，该日志记录可以包括操作行为事 件，且操作行为事件为搜索操作，以此类推，对操作行为事件的类型不做限制。
为了分析日志记录中有价值的信息，本申请实施例中提出一种日志记录处理方法，参见图1所示，为日志记录处理方法的流程示意图，该方法可以包括：
步骤101，获取日志记录，所述日志记录可以包括但不限于以下之一或者任意组合：用户信息、操作行为事件、消耗资源值。
在服务器的运行过程中，可以产生大量日志记录，每个日志记录包括大量信息，对此信息不做限制。本实施例中，可以预先配置需要提取的属性信息，表示需要从日志记录的大量信息中获取这些属性信息，属性信息可以根据实际需要任意配置，对此不做限制。本实施例中，属性信息包括但不限于以下之一或者任意组合：用户信息、操作行为事件、消耗资源值、时间戳和操作时间值。
参见表1所示，可以预先配置数据结构，针对获取的大量日志记录，可以从每个日志记录中提取用户信息、操作行为事件、消耗资源值、时间戳和操作时间值等，并将这些信息记录到数据结构中。当然，表1只是示例，数据结构可以包括大量日志记录的信息，后续过程中，根据数据结构中的信息进行分析。
表1
日志记录标识 用户信息 操作行为事件 消耗资源值 时间戳 操作时间值
日志记录1 用户信息1 登录操作 15字节 时间戳1 3秒
日志记录2 用户信息1 搜索操作 120字节 时间戳2 6秒
日志记录3 用户信息2 登录操作 16字节 时间戳3 4秒
日志记录4 用户信息1 购物车操作 800字节 时间戳4 5秒
日志记录5 用户信息2 搜索操作 126字节 时间戳5 160秒
日志记录6 用户信息2 购买操作 1500字节 时间戳6 7秒
… … … … … …
在上述实施例中，用户信息用于唯一表示一个用户，如用户信息可以为用户标识(用户ID)、IP地址、浏览器指纹等，对此用户信息不做限制。
操作行为事件用于表示用户的操作行为，如针对用户的登录操作，操作行为事件为登录操作。针对用户的搜索操作，操作行为事件为搜索操作。针对用户的购物车操作，操作行为事件为购物车操作。针对用户的购买操作，操作行为事件为购买操作。当然，上述只是操作行为事件的示例，对此不做限制。
消耗资源值用于表示操作行为事件的消耗资源值，例如，存储空间大小、CPU大小、内存大小等，对此消耗资源值的类型不做限制，后续以消耗资源值为存储空间大小为例。例如，日志记录1中的15字节，表示针对用户信息1的登录操作，共使用了15字节的存储空间大小。日志记录2中的120字节，表示针对用户信息1的搜索操作，共使用了120字节的存储空间大小，以此类推。
时间戳用于表示日志记录的产生时刻，如时间戳1表示日志记录1在时间戳1产生，时间戳2表示日志记录2在时间戳2产生，以此类推。可以约定时间戳的格式(如年、月、日、时、分、秒等的格式)，并采用该格式在数据结构中记录时间戳，对此时间戳的格式不做限制，可以根据实际需要配置。
操作时间值用于表示操作行为事件的操作时间值，例如，日志记录1中的3秒，表示针对用户信息1的登录操作，共使用了3秒的时间。日志记录2中的6秒，表示针对用户信息1的搜索操作，共使用了6秒的时间，以此类推。
步骤102，根据消耗资源值和操作行为事件确定日志记录所属的类别组。
在一个例子中，可以针对每种操作行为事件创建至少一个类别组，在创建所述至少一个类别组时，不同的类别组可以对应不同的资源值区间。
例如，针对登录操作创建类别组11、类别组12、类别组13。类别组11对应资源值区间11，且资源值区间11为区间[0字节，10字节)。类别组12对应资源值区间12，且资源值区间12为区间[10字节，20字节)。类别组13对应资源值区间13，且资源值区间13为区间[20字节，正无穷)。
针对搜索操作创建类别组21、类别组22、类别组23。类别组21对应资源值区间21，且资源值区间21为区间[0字节，100字节)。类别组22对应资源值区间22，且资源值区间22为区间[100字节，200字节)。类别组23对应资源值区间23，且资源值区间23为区间[200字节，正无穷)。
针对购物车操作创建类别组31、类别组32、类别组33。类别组31对应资源值区间31，且资源值区间31为区间[0字节，1000字节)。类别组32对应资源值区间32，且资源值区间32为区间[1000字节，2000字节)。类别组33对应资源值区间33，且资源值区间33为区间[2000字节，正无穷)。
针对购买操作创建类别组41、类别组42、类别组43。类别组41对应资源值区间41，且资源值区间41为区间[0字节，1000字节)。类别组42对应资源值区间42，且资源值区间42为区间[1000字节，2000字节)。类别组43对应资源值区间43，且资源值区间 43为区间[2000字节，正无穷)。
当然，上述只是类别组和资源值区间的示例，对此不做限制，例如，针对每种操作行为事件创建4个类别组，4个类别组对应4个资源值区间。
在一个例子中，针对每个日志记录来说，可以根据该日志记录的消耗资源值和操作行为事件确定该日志记录所属的类别组。具体的，可以确定该操作行为事件对应的所有资源值区间，并从该操作行为事件对应的所有资源值区间中确定该消耗资源值所位于的资源值区间；然后，确定与所述资源值区间对应的类别组，并将该日志记录划分到所述类别组中。
例如，日志记录1的操作行为事件为登录操作，消耗资源值为15字节。登录操作对应资源值区间11、资源值区间12和资源值区间13，且15字节位于资源值区间12，因此，将日志记录1划分到资源值区间12对应的类别组12。日志记录2的操作行为事件为搜索操作，消耗资源值为120字节。搜索操作对应资源值区间21、资源值区间22和资源值区间23，且120字节位于资源值区间22，因此，将日志记录2划分到资源值区间22对应的类别组22。同理，日志记录3的操作行为事件为登录操作，消耗资源值为16字节，将日志记录3划分到类别组12。日志记录4的操作行为事件为购物车操作，消耗资源值为800字节，将日志记录4划分到类别组31。日志记录5的操作行为事件为搜索操作，消耗资源值为126字节，将日志记录5划分到类别组22。日志记录6的操作行为事件为购买操作，消耗资源值为1500字节，将日志记录6划分到类别组42。
步骤103，根据用户信息确定属于同一用户的日志记录，并根据属于同一用户的日志记录的操作行为事件和类别组确定所述用户的操作行为序列。
在一个例子中，日志记录还包括时间戳和操作时间值，根据属于同一用户的日志记录的操作行为事件和类别组确定所述用户的操作行为序列，可以包括：
方式一、基于时间戳的先后顺序，根据属于同一用户的日志记录的操作行为事件和类别组确定初始序列，并将初始序列确定为所述用户的操作行为序列。
在一个例子中，可以通过某个字符表示操作行为事件，如a表示登录操作，b表示搜索操作，c表示购物车操作，d表示购买操作。参见表1所示，由于日志记录1、日志记录2和日志记录4对应同一个用户信息1，因此，日志记录1、日志记录2和日志记录4是属于同一用户的日志记录，按照时间戳的先后顺序，对日志记录1的a12(a表示登录操作，12表示类别组的组标识)、日志记录2的b22和日志记录4的c31进行排序，假设排序结果为a12、b22、c31，则初始序列为a12-b22-c31，将初始序列a12-b22-c31确 定为用户信息1的操作行为序列。
参见表1所示，由于日志记录3、日志记录5和日志记录6对应同一个用户信息2，因此，日志记录3、日志记录5和日志记录6是属于同一用户的日志记录，按照时间戳的先后顺序，对日志记录3的a12、日志记录5的b22和日志记录6的d42进行排序，假设排序结果为a12、b22、d42，则初始序列为a12-b22-d42，将初始序列a12-b22-d42确定为用户信息2的操作行为序列。
方式二、基于时间戳的先后顺序，根据属于同一用户的日志记录的操作行为事件和类别组确定初始序列。根据操作时间值和消耗资源值将该初始序列切分成至少一个子序列，并将至少一个子序列确定为所述用户的操作行为序列。
其中，根据操作时间值和消耗资源值将该初始序列切分成至少一个子序列，包括：针对该初始序列中的每个操作行为事件(如操作行为事件和该操作行为事件对应的类别组)，根据该操作行为事件对应的操作时间值和消耗资源值，确定该操作行为事件(如操作行为事件和该操作行为事件对应的类别组)是否为切分节点；若是，则将该初始序列中位于该操作行为事件(如操作行为事件和该操作行为事件对应的类别组)之前的至少一个操作行为事件和类别组切分成子序列。若否，则不对该操作行为事件(如操作行为事件和该操作行为事件对应的类别组)之前的操作行为事件和类别组进行切分。
参见表1所示，由于日志记录1、日志记录2和日志记录4对应同一个用户信息1，因此，日志记录1、日志记录2和日志记录4是属于同一用户的日志记录，按照时间戳的先后顺序，对日志记录1的a12、日志记录2的b22和日志记录4的c31进行排序，假设排序结果为a12、b22、c31，则初始序列为a12-b22-c31。
针对初始序列a12-b22-c31中的操作行为事件和类别组a12，确定a12对应的操作时间值和消耗资源值，即日志记录1的操作时间值(3秒)和消耗资源值(15字节)。根据操作时间值(3秒)和消耗资源值(15字节)确定a12是否为切分节点。若否，则判断下一个操作行为事件和类别组，直至初始序列的最后一个操作行为事件和类别组。若是，由于初始序列a12-b22-c31中位于a12之前的操作行为事件和类别组为空，因此不切分子序列，然后，继续判断下一个操作行为事件和类别组。
针对初始序列a12-b22-c31中的b22，确定b22对应的操作时间值和消耗资源值，即日志记录2的操作时间值(6秒)和消耗资源值(120字节)。根据操作时间值(6秒)和消耗资源值(120字节)确定b22是否为切分节点。若否，则判断下一个操作行为事件和类别组。若是，则将初始序列a12-b22-c31中位于b22之前的操作行为事件和类别组 切分成子序列，即得到一个子序列，该子序列为a12，然后，继续判断下一个操作行为事件和类别组。
针对初始序列a12-b22-c31中的c31，确定c31对应的操作时间值和消耗资源值，即日志记录4的操作时间值(5秒)和消耗资源值(800字节)。根据操作时间值(5秒)和消耗资源值(800字节)确定c31是否为切分节点。若否，则结束判断流程。若是，则将初始序列a12-b22-c31中位于c31之前的操作行为事件和类别组切分成子序列。例如，假设已经将a12切分为子序列，则将b22切分为子序列，且c31是一个子序列，即针对用户信息1得到3个子序列，第一个子序列为a12，第二个子序列为b22，第三个子序列为c31。假设没有将a12切分为子序列，则将a12和b22切分为子序列，且c31是一个子序列，即针对用户信息1得到2个子序列，第一个子序列为a12-b22，第二个子序列为c31。
参见表1所示，由于日志记录3、日志记录5和日志记录6对应同一个用户信息2，因此，日志记录3、日志记录5和日志记录6是属于同一用户的日志记录，按照时间戳的先后顺序，对日志记录3的a12、日志记录5的b22和日志记录6的d42进行排序，假设排序结果为a12、b22、d42，则初始序列为a12-b22-d42。
针对初始序列a12-b22-d42，可以根据a12对应的操作时间值(日志记录3的操作时间值)和消耗资源值(日志记录3的消耗资源值)，确定a12是否为切分节点；可以根据b22对应的操作时间值(日志记录5的操作时间值)和消耗资源值(日志记录5的消耗资源值)，确定b22是否为切分节点；可以根据d42对应的操作时间值(日志记录6的操作时间值)和消耗资源值(日志记录6的消耗资源值)，确定d42是否为切分节点。具体方式参见上述实施例，假设针对用户信息2得到两个子序列，第一个子序列为a12-b22，第二个子序列为d42。
在上述实施例中，根据操作行为事件对应的操作时间值和消耗资源值，确定操作行为事件(如操作行为事件和类别组)是否为切分节点，可以包括但不限于：根据操作时间值和消耗资源值，确定操作行为事件(如操作行为事件和类别组)的残差；若该残差大于残差阈值，则确定该操作行为事件是切分节点；若该残差不大于残差阈值，则确定该操作行为事件不是切分节点。
示例性的，可以将用户的初始序列切分为至少一个子序列，若初始序列的所有操作行为事件均不是切分节点，则将初始序列切分为一个子序列，若初始序列的所有操作行为事件中存在切分节点，则将初始序列切分为多个子序列。
为了方便描述，本实施例中，可以将日志记录的操作行为事件和日志记录所属类别组的组信息称为操作行为参数，该操作行为参数可以包括但不限于：操作行为事件、该类别组的组信息，如日志记录所属类别组的组标识。
在一个例子中，针对每个日志记录来说，可以根据操作行为事件和类别组确定该日志记录的操作行为参数。例如，参见上述实施例，日志记录1的操作行为参数包括登录操作和类别组12；日志记录2的操作行为参数包括搜索操作和类别组22。日志记录3的操作行为参数包括登录操作和类别组12。日志记录4的操作行为参数包括购物车操作和类别组31。日志记录5的操作行为参数包括搜索操作和类别组22。日志记录6的操作行为参数包括购买操作和类别组42。
示例性的，可以通过某个字符表示操作行为事件，如a表示登录操作，b表示搜索操作，c表示购物车操作，d表示购买操作。基于此，日志记录1的操作行为参数包括a12，即登录操作和类别组12。日志记录2的操作行为参数包括b22。日志记录3的操作行为参数包括a12。日志记录4的操作行为参数包括c31。日志记录5的操作行为参数包括b22。日志记录6的操作行为参数包括d42。
在一个例子中，考虑到操作行为事件的消耗资源值的分布比较广，因此，可以为同一种操作行为事件划分多个类别组，且类别组对应的是资源值区间，而不是具体的消耗资源值。当多个消耗资源值对应同一个资源值区间时，就可以将这些消耗资源值确定为同样的类别，属于同一个类别组。显然，由于操作行为事件的消耗资源值分布在0至无穷大，因此，通过划分类别组，可以显著减少操作行为参数的数量。例如，若未划分类别组，则日志记录1的操作行为参数为a15，15表示15个字节，日志记录3的操作行为参数为a16，16表示16个字节，本实施例中，由于划分类别组，因此，日志记录1和日志记录3的操作行为参数均为a12，12表示类别组12。显然，针对登录操作划分3个类别组时，针对登录操作的操作行为参数为3个，如操作行为参数包括a11、a12、a13。
示例性的，可以使用一维聚类方法(如Jenks Natural Breaks)，为同一操作行为事件划分多个类别组，每个类别组对应不同的资源值区间，对此不做限制。
在一个例子中，为了将初始序列切分为多个子序列，则需要从初始序列的所有操作行为事件(如操作行为事件和该操作行为事件对应的类别组)中，获知能够作为切分节点的操作行为事件。而能够作为切分节点的操作行为事件，是所有操作行为事件中有滞留的操作行为事件。例如，用户在执行登录操作时，若滞留时间比较长，则这个登录操作就是有滞留的操作行为事件，也就是说，该操作行为事件是能够作为切分节点的操作 行为事件。
在一个例子中，针对每个操作行为事件，可以根据该操作行为事件的操作时间值和消耗资源值，确定该操作行为事件是否为有滞留的操作行为事件。例如，可以根据该操作行为事件的操作时间值和消耗资源值，确定该操作行为事件的残差；若该残差大于残差阈值，则确定该操作行为事件为有滞留的操作行为事件，即该操作行为事件是切分节点；若该残差不大于残差阈值，则确定该操作行为事件不为有滞留的操作行为事件，即该操作行为事件不是切分节点。
示例性的，可以使用线性回归的方法，确定操作行为事件是否为有滞留的操作行为事件。例如，在用户操作过程中，消耗资源值越大，则操作的时间越长，因此，可以根据操作时间值和消耗资源值来建立线性回归模型，该线性回归模型用于记录操作时间值、消耗资源值和残差的对应关系。在线性回归模型中，操作行为事件的操作时间值作为自变量，操作行为事件的消耗资源值作为自变量，对此线性回归模型的构建过程不做限制。由于操作时间值和消耗资源值均作为自变量，因此，针对每个操作行为事件，可以根据该操作行为事件的操作时间值和消耗资源值查询线性回归模型，得到该操作行为事件的残差。
示例性的，基于线性回归模型，若操作时间值较大，消耗资源值较小，则残差比较大，若操作时间值较小，消耗资源值较大，则残差比较小。当然，这里只是示例，线性回归模型可以任意选择，只要线性回归模型用于记录操作时间值、消耗资源值和残差的对应关系即可，这样，基于线性回归模型，可以根据操作行为事件的操作时间值和消耗资源值，确定该操作行为事件的残差。
进一步的，在得到操作行为事件的残差后，判断该残差是否大于残差阈值，该残差阈值可以根据经验配置，如残差阈值为0.5、0.6等，对此不做限制。若该操作行为事件的残差大于残差阈值，则该操作行为事件是切分节点；若该操作行为事件的残差不大于残差阈值，则该操作行为事件不是切分节点。
步骤104，利用操作行为序列确定目标操作行为序列，目标操作行为序列是频繁序列，表示目标操作行为序列出现在多个操作行为序列。
在一个例子中，可以利用操作行为序列确定公共子序列，所述公共子序列出现在多个操作行为序列。确定公共子序列在所有操作行为序列中的出现次数；若所述出现次数大于次数阈值，则根据所述公共子序列确定目标操作行为序列。
示例性的，参见上述实施例，假设针对用户信息1得到两个操作行为序列，分别为 a12-b22、c31，针对用户信息2得到一个操作行为序列，如a12-b22-d42，当然，这里只是以两个用户信息的操作行为序列为例，在实际应用中，操作行为序列的数量很多，对此不做限制。然后，将所有操作行为序列看成字符串，如一个字符串为a12b22，另一个字符串为c31，另一个字符串为a12b22d42。
然后，使用后缀数组的结构分析每一个操作行为序列，对此分析过程不再赘述。基于所有操作行为序列，可以使用最长公共前缀的方法来挖掘所有操作行为序列中的公共子序列，所述公共子序列出现在多个操作行为序列中。
例如，假设公共子序列a12-b22出现在10个操作行为序列中，则公共子序列a12-b22在所有操作行为序列中的出现次数可以为10。假设公共子序列a13-b22出现在8个操作行为序列中，则公共子序列a13-b22在所有操作行为序列中的出现次数可以为8。假设公共子序列a11-b21-c33出现在6个操作行为序列中，则公共子序列a11-b21-c33在所有操作行为序列中的出现次数可以为6。
以此类推，可以基于所有操作行为序列挖掘出多个公共子序列，且能够获知每个公共子序列在所有操作行为序列中的出现次数，对此不再赘述。
进一步的，基于每个公共子序列在所有操作行为序列中的出现次数，可以从所有公共子序列中确定出目标操作行为序列。例如，针对每个公共子序列，若该公共子序列在所有操作行为序列中的出现次数大于次数阈值，则确定该公共子序列为目标操作行为序列。或者，若该公共子序列在所有操作行为序列中的出现次数不大于次数阈值，则确定该公共子序列不为目标操作行为序列。
在一个例子中，次数阈值可以根据经验配置，且次数阈值与公共子序列中的操作行为事件的数量无关。例如，次数阈值可以为8，当然，数值8只是一个示例，对此次数阈值不做限制，可以根据经验任意配置。公共子序列a12-b22在所有操作行为序列中的出现次数为10(大于次数阈值)，因此，公共子序列a12-b22为目标操作行为序列。公共子序列a13-b22在所有操作行为序列中的出现次数为8(不大于次数阈值)，因此，公共子序列a13-b22不为目标操作行为序列。公共子序列a11-b21-c33在所有操作行为序列中的出现次数为6(不大于次数阈值)，因此，公共子序列a11-b21-c33不为目标操作行为序列。
在另一个例子中，次数阈值与公共子序列中的操作行为事件的数量有关。具体的，根据公共子序列中的操作行为事件的数量，确定所述公共子序列对应的次数阈值；其中，若操作行为事件的数量越大时，则次数阈值越小。
例如，操作行为事件的数量为2时，则次数阈值可以为8，当然，数值8只是一个示例，对此次数阈值不做限制，可以根据经验任意配置。操作行为事件的数量为3时，则次数阈值可以为5，当然，数值5只是一个示例，对此次数阈值不做限制，可以根据经验任意配置。操作行为事件的数量为4时，则次数阈值可以为3，当然，数值3只是一个示例，对此次数阈值不做限制，可以根据经验任意配置。以此类推，操作行为事件的数量越大时，则次数阈值越小。
例如，公共子序列a12-b22中的操作行为事件的数量为2，因此，次数阈值可以为8，也就是说，公共子序列a12-b22在所有操作行为序列中的出现次数为10(大于次数阈值)，因此，公共子序列a12-b22为目标操作行为序列。
公共子序列a13-b22中的操作行为事件的数量为2，因此，次数阈值可以为8，也就是说，公共子序列a13-b22在所有操作行为序列中的出现次数为8(不大于次数阈值)，因此，公共子序列a13-b22不为目标操作行为序列。
公共子序列a11-b21-c33中的操作行为事件的数量为3，因此，次数阈值可以为5，也就是说，公共子序列a11-b21-c33在所有操作行为序列中的出现次数为6(大于次数阈值)，因此，公共子序列a11-b21-c33为目标操作行为序列。
综上所述，可以利用多个操作行为序列确定目标操作行为序列，目标操作行为序列是频繁序列，表示目标操作行为序列出现在多个操作行为序列，这样，通过目标操作行为序列可以获知哪些操作行为事件被频繁执行，且消耗的资源大小，继而对资源进行有效控制，保证业务的正常运行。
在上述实施例中，日志记录可以包括但不限于负载日志记录，如负载测试日志记录、历史负载日志记录、模拟负载日志记录、实时负载日志记录等，对此日志记录类型不做限制，可以是任意类型的日志记录。当日志记录为负载日志记录时，基于目标操作行为序列，获知哪些操作行为事件被频繁执行，从而预留资源，保证所有用户都能够正常访问服务器，避免服务器出现故障。
在一个例子中，上述执行顺序只是为了方便描述给出的一个示例，在实际应用中，还可以改变步骤之间的执行顺序，对此执行顺序不做限制。而且，在其它实施例中，并不一定按照本说明书示出和描述的顺序来执行相应方法的步骤，其方法所包括的步骤可以比本说明书所描述的更多或更少。此外，本说明书中所描述的单个步骤，在其它实施例中可能被分解为多个步骤进行描述；本说明书中所描述的多个步骤，在其它实施例也可能被合并为单个步骤进行描述。
基于上述技术方案，本申请实施例中，能够快速有效地提取日志记录中有价值的信息，如确定目标操作行为序列，目标操作行为序列是被大量用户频繁执行的操作行为序列。目标操作行为序列包括操作行为事件和操作行为事件的消耗资源值(如消耗的存储空间大小、CPU大小、内存大小等)，这样，通过目标操作行为序列可以获知哪些操作行为事件被频繁执行，且消耗的资源大小，继而对资源进行有效控制，保证业务的正常运行。在分析同一操作行为事件对应的消耗资源值时，可以将同一操作行为事件的消耗资源值进行分组，从而大大减少操作行为序列的数量，提高确定目标操作行为序列时的处理效率。
综上所述，本申请实施例提出一种高效地挖掘目标操作行为序列(即用户频繁序列)的方法。首先，从日志记录中提取上下文信息，该上下文信息可以包括用户信息、操作行为事件、消耗资源值、时间戳和操作时间值等。
其次，考虑到操作行为事件的消耗资源值(如字节数)的分布比较广，因此，可以使用一维聚类的方法(如Jenks Natural Breaks)，将所有用户同一种操作行为事件的消耗资源值进行分组，最后将属于同一个组的消耗资源值确定为同样的类别，属于同一个类别组。显然，由于操作行为事件的消耗资源值分布在0至无穷大，因此，通过划分类别组，可以显著减少操作行为事件的数量。
再次，将操作行为事件和消耗资源值所属类别组的组标识连接起来，作为一个完整事件(即操作行为参数)，将完整事件替换成字符和数字，如a1这个完整事件中，a代表操作行为事件，1代表消耗资源值所属类别组的组标识。
再次，考虑到用户的所有操作行为事件中存在有滞留的操作行为事件，因此，可以利用操作时间值和消耗资源值，将用户的初始序列切分为多个子序列，例如，可以使用线性回归的方法切分所有操作行为事件中存在滞留的操作行为事件，即在存在滞留的操作行为事件处将初始序列切分为多个子序列。在线性回归模型中，操作行为事件的消耗资源值作为自变量，操作行为事件的操作时间值作为自变量，在该线性回归模型中，如果某一个操作行为事件的消耗资源值和操作时间值的残差大于残差阈值，则该操作行为事件为被切分序列的事件。
最后，将每个用户的所有子序列理解成字符串，使用后缀数组的结构分析每一个子序列，使用最长公共前缀的方法来挖掘所有子序列的公共子序列，基于公共子序列的出现次数对所有公共子序列进行优先级排序，并将出现次数大于次数阈值的公共子序列作为目标操作行为序列，即挖掘出频繁序列。
基于上述技术方案，在分析同一种操作行为事件的消耗资源值时，可以使用一维聚类的方法将同一种操作行为事件的消耗资源值进行分组，即对消耗资源值进行聚类处理，这样可以大大减少消耗资源值的分布，进而提高处理效率。在用户的操作过程中，操作行为事件的消耗资源值越大时，操作行为事件的操作时间值越长，因此，可以根据消耗资源值和操作时间值建立线性回归模型，并使用该线性回归模型对用户的初始序列进行切分，得到多个子序列，继而可以更加准确地识别目标操作行为序列。通过使用后缀数组和最长公共前缀挖掘目标操作行为序列，可以高效而形象地展示出目标操作行为序列。
为了分析日志记录中有价值的信息，本申请实施例中提出一种日志记录处理方法，参见图2所示，为日志记录处理方法的流程示意图，该方法可以包括：
步骤201，获取日志记录，所述日志记录包括但不限于以下之一或者任意组合：用户信息、操作行为事件、消耗资源值。例如，日志记录可以包括用户信息、操作行为事件、消耗资源值、时间戳和操作时间值。
步骤202，根据用户信息确定属于同一用户的日志记录，并根据属于同一用户的日志记录的操作行为事件确定所述用户的操作行为序列。
在一个例子中，该操作行为序列可以包括属于所述用户的所有日志记录的操作行为事件；在另一个例子中，该操作行为序列可以包括属于所述用户的所有日志记录的操作行为事件和消耗资源值；在另一个例子中，该操作行为序列可以包括属于所述用户的所有日志记录的操作行为事件、各日志记录所属类别组的组信息，其中，类别组是根据消耗资源值和操作行为事件确定的。
在一个例子中，确定操作行为序列的过程，可以包括但不限于：
方式一、基于时间戳的先后顺序，根据属于同一用户的日志记录的操作行为事件确定初始序列，将初始序列确定为所述用户的操作行为序列。
方式二、基于时间戳的先后顺序，根据属于同一用户的日志记录的操作行为事件确定初始序列。根据操作时间值和消耗资源值将该初始序列切分成至少一个子序列，并将至少一个子序列确定为所述用户的操作行为序列。
其中，根据操作时间值和消耗资源值将该初始序列切分成至少一个子序列，可以包括：针对该初始序列中的每个操作行为事件，根据该操作行为事件的操作时间值和消耗资源值，确定该操作行为事件是否为切分节点；若是，则将该初始序列中位于该操作行为事件之前的至少一个操作行为事件切分成子序列。
在一个例子中，根据操作行为事件的操作时间值和消耗资源值，确定操作行为事件 是否为切分节点，可以包括但不限于：根据操作时间值和消耗资源值，确定操作行为事件的残差；若该残差大于残差阈值，则确定操作行为事件是切分节点；若该残差不大于残差阈值，则确定操作行为事件不是切分节点。
示例性的，可以将用户的初始序列切分为至少一个子序列，若初始序列的所有操作行为事件均不是切分节点，则将初始序列切分为一个子序列，若初始序列的所有操作行为事件中存在切分节点，则将初始序列切分为多个子序列。
为了将初始序列切分为多个子序列，则需要从初始序列的所有操作行为事件中，获知能够作为切分节点的操作行为事件。而能够作为切分节点的操作行为事件，是所有操作行为事件中有滞留的操作行为事件。例如，用户在执行登录操作时，若滞留时间较长，则这个登录操作对应的操作行为事件，就是有滞留的操作行为事件，即该操作行为事件是能够作为切分节点的操作行为事件。
在一个例子中，针对每个操作行为事件，可以根据该操作行为事件的操作时间值和消耗资源值，确定该操作行为事件是否为有滞留的操作行为事件。例如，可以根据该操作行为事件的操作时间值和消耗资源值，确定该操作行为事件的残差；若该残差大于残差阈值，则确定该操作行为事件为有滞留的操作行为事件，即该操作行为事件是切分节点；若该残差不大于残差阈值，则确定该操作行为事件不为有滞留的操作行为事件，即该操作行为事件不是切分节点。
示例性的，可以使用线性回归的方法，确定操作行为事件是否为有滞留的操作行为事件。例如，在用户操作过程中，消耗资源值越大，则操作的时间越长，因此，可以根据操作时间值和消耗资源值来建立线性回归模型，该线性回归模型用于记录操作时间值、消耗资源值和残差的对应关系。在线性回归模型中，操作行为事件的操作时间值作为自变量，操作行为事件的消耗资源值作为自变量，对此线性回归模型的构建过程不做限制。由于操作时间值和消耗资源值均作为自变量，因此，针对每个操作行为事件，可以根据该操作行为事件的操作时间值和消耗资源值查询线性回归模型，得到该操作行为事件的残差。
示例性的，基于线性回归模型，若操作时间值较大，消耗资源值较小，则残差比较大，若操作时间值较小，消耗资源值较大，则残差比较小。当然，这里只是示例，线性回归模型可以任意选择，只要线性回归模型用于记录操作时间值、消耗资源值和残差的对应关系即可，这样，基于线性回归模型，可以根据操作行为事件的操作时间值和消耗资源值，确定该操作行为事件的残差。
步骤203，利用操作行为序列确定目标操作行为序列，目标操作行为序列是频繁序列，表示目标操作行为序列出现在多个用户的操作行为序列。
在一个例子中，可以利用操作行为序列确定公共子序列，所述公共子序列出现在多个操作行为序列。确定公共子序列在所有操作行为序列中的出现次数；若所述出现次数大于次数阈值，则根据所述公共子序列确定目标操作行为序列。
具体的，基于每个公共子序列在所有操作行为序列中的出现次数，可以从所有公共子序列中确定出目标操作行为序列。例如，针对每个公共子序列，若该公共子序列在所有操作行为序列中的出现次数大于次数阈值，则确定该公共子序列为目标操作行为序列。或者，若该公共子序列在所有操作行为序列中的出现次数不大于次数阈值，则确定该公共子序列不为目标操作行为序列。
在一个例子中，次数阈值可以根据经验配置，且次数阈值与公共子序列中的操作行为事件的数量无关。或者，次数阈值与公共子序列中的操作行为事件的数量有关。根据公共子序列中的操作行为事件的数量，确定所述公共子序列对应的次数阈值；其中，若操作行为事件的数量越大时，则次数阈值越小。
在上述实施例中，日志记录可以包括但不限于负载日志记录，如负载测试日志记录、历史负载日志记录、模拟负载日志记录、实时负载日志记录等，对此日志记录类型不做限制，可以是任意类型的日志记录。
在一个例子中，上述执行顺序只是为了方便描述给出的一个示例，在实际应用中，还可以改变步骤之间的执行顺序，对此执行顺序不做限制。而且，在其它实施例中，并不一定按照本说明书示出和描述的顺序来执行相应方法的步骤，其方法所包括的步骤可以比本说明书所描述的更多或更少。此外，本说明书中所描述的单个步骤，在其它实施例中可能被分解为多个步骤进行描述；本说明书中所描述的多个步骤，在其它实施例也可能被合并为单个步骤进行描述。
基于上述技术方案，本申请实施例中，能够快速有效地提取日志记录中有价值的信息，如确定目标操作行为序列，目标操作行为序列是被大量用户频繁执行的操作行为序列。目标操作行为序列包括操作行为事件和操作行为事件的消耗资源值(如消耗的存储空间大小、CPU大小、内存大小等)，这样，通过目标操作行为序列可以获知哪些操作行为事件被频繁执行，且消耗的资源大小，继而对资源进行有效控制，保证业务的正常运行。
基于与上述方法同样的申请构思，本申请实施例还提供一种日志记录处理装置，如 图3所示，为所述日志记录处理装置的结构图，所述装置包括：
获取模块31，用于获取日志记录，所述日志记录包括用户信息、操作行为事件、消耗资源值；
确定模块32，用于根据消耗资源值和操作行为事件确定所述日志记录所属的类别组；根据所述用户信息确定属于同一用户的日志记录，并根据属于同一用户的日志记录的操作行为事件和类别组确定所述用户的操作行为序列；利用所述操作行为序列确定目标操作行为序列。
所述确定模块32根据消耗资源值和操作行为事件确定所述日志记录所属的类别组时具体用于：确定所述操作行为事件对应的所有资源值区间；从所述操作行为事件对应的所有资源值区间中确定所述消耗资源值所位于的资源值区间；确定与所述资源值区间对应的类别组；将所述日志记录划分到所述类别组。
所述确定模块32还用于：针对每种操作行为事件创建至少一个类别组；
其中，不同类别组对应不同的资源值区间。
所述日志记录还包括时间戳和操作时间值，所述确定模块32根据属于同一用户的日志记录的操作行为事件和类别组确定所述用户的操作行为序列时具体用于：基于时间戳的先后顺序，根据属于同一用户的日志记录的操作行为事件和类别组确定初始序列；将所述初始序列确定为所述用户的操作行为序列；或者，基于时间戳的先后顺序，根据属于同一用户的日志记录的操作行为事件和类别组确定初始序列；根据操作时间值和消耗资源值将所述初始序列切分成至少一个子序列，并将所述至少一个子序列确定为所述用户的操作行为序列。
所述确定模块32根据操作时间值和消耗资源值将所述初始序列切分成至少一个子序列时具体用于：针对所述初始序列中的操作行为事件，根据所述操作行为事件对应的操作时间值和消耗资源值，确定所述操作行为事件是否为切分节点；若是，则将所述初始序列中位于所述操作行为事件之前的至少一个操作行为事件和类别组切分成子序列。
所述确定模块32根据所述操作行为事件对应的操作时间值和消耗资源值，确定所述操作行为事件是否为切分节点时具体用于：
根据所述操作时间值和所述消耗资源值，确定所述操作行为事件的残差；
若所述残差大于残差阈值，则确定所述操作行为事件是切分节点；
若所述残差不大于残差阈值，确定所述操作行为事件不是切分节点。
所述确定模块32利用所述操作行为序列确定目标操作行为序列时具体用于：利用所 述操作行为序列确定公共子序列，所述公共子序列出现在多个操作行为序列中；确定所述公共子序列在所有操作行为序列中的出现次数；若所述出现次数大于次数阈值，则根据所述公共子序列确定目标操作行为序列。
所述确定模块32根据所述公共子序列中的操作行为事件的数量，确定所述公共子序列对应的次数阈值；若操作行为事件的数量越大时，则次数阈值越小。
基于与上述方法同样的申请构思，本申请实施例还提供一种日志记录处理设备，包括：处理器和机器可读存储介质，所述机器可读存储介质上存储有若干计算机指令，所述处理器执行所述计算机指令时进行如下处理：
获取日志记录，所述日志记录包括用户信息、操作行为事件、消耗资源值；
根据消耗资源值和操作行为事件确定所述日志记录所属的类别组；
根据所述用户信息确定属于同一用户的日志记录，并根据属于同一用户的日志记录的操作行为事件和类别组确定所述用户的操作行为序列；
利用所述操作行为序列确定目标操作行为序列。
本申请实施例还提供一种机器可读存储介质，所述机器可读存储介质上存储有若干计算机指令；所述计算机指令被执行时进行如下处理：
获取日志记录，所述日志记录包括用户信息、操作行为事件、消耗资源值；
根据消耗资源值和操作行为事件确定所述日志记录所属的类别组；
根据所述用户信息确定属于同一用户的日志记录，并根据属于同一用户的日志记录的操作行为事件和类别组确定所述用户的操作行为序列；
利用所述操作行为序列确定目标操作行为序列。
参见图4所示，为本申请实施例中提出的日志记录处理设备的结构图，所述日志记录处理设备40可以包括：处理器41，网络接口42，总线43，存储器44。存储器44可以是任何电子、磁性、光学或其它物理存储装置，可以包含或存储信息，如可执行指令、数据等等。例如，存储器44可以是：RAM(Radom Access Memory，随机存取存储器)、易失存储器、非易失性存储器、闪存、存储驱动器(如硬盘驱动器)、固态硬盘、任何类型的存储盘(如光盘、dvd等)。
参见图5所示，为本申请实施例中提出的日志记录处理系统的结构图，日志记录处理系统包括多个客户端51、数据库52和日志记录处理装置53。用户通过客户端51访问日志记录处理设备，针对用户的操作过程，日志记录处理设备可以产生日志记录，并将日志记录存储到数据库52中。日志记录处理装置53从数据库52中获取多个日志记录， 并根据多个日志记录确定目标操作行为序列。
以下对日志记录处理装置53的结构进行说明。
第一获取模块531，用于从数据库52中获取日志记录，所述日志记录包括用户信息、操作行为事件、消耗资源值、时间戳和操作时间值。
第一确定模块532，用于根据消耗资源值和操作行为事件确定所述日志记录所属的类别组。
第二确定模块533，用于根据所述用户信息确定属于同一用户的日志记录，并根据属于同一用户的日志记录的操作行为事件和类别组确定所述用户的操作行为序列。例如，基于时间戳的先后顺序，根据属于同一用户的日志记录的操作行为事件和类别组确定初始序列；根据操作时间值和消耗资源值将初始序列切分成至少一个子序列，将至少一个子序列确定为所述用户的操作行为序列。
第三确定模块534，用于利用所述操作行为序列确定目标操作行为序列。至此，成功获取到目标操作行为序列，并输出目标操作行为序列。
上述实施例阐明的系统、装置、模块或单元，具体可以由计算机芯片或实体实现，或者由具有某种功能的产品来实现。一种典型的实现设备为计算机，计算机的具体形式可以是个人计算机、膝上型计算机、蜂窝电话、相机电话、智能电话、个人数字助理、媒体播放器、导航设备、电子邮件收发设备、游戏控制台、平板计算机、可穿戴设备或者这些设备中的任意几种设备的组合。
为了描述的方便，描述以上装置时以功能分为各种单元分别描述。当然，在实施本申请时可以把各单元的功能在同一个或多个软件和/或硬件中实现。
本领域内的技术人员应明白，本申请的实施例可提供为方法、系统、或计算机程序产品。因此，本申请可采用完全硬件实施例、完全软件实施例、或结合软件和硬件方面的实施例的形式。而且，本申请实施例可采用在一个或多个其中包含有计算机可用程序代码的计算机可用存储介质(包括但不限于磁盘存储器、CD-ROM、光学存储器等)上实施的计算机程序产品的形式。
本申请是参照根据本申请实施例的方法、设备(系统)、和计算机程序产品的流程图和/或方框图来描述的。应理解可以由计算机程序指令实现流程图和/或方框图中的每一流程和/或方框、以及流程图和/或方框图中的流程和/或方框的结合。可提供这些计算机程序指令到通用计算机、专用计算机、嵌入式处理机或其它可编程数据处理设备的处理器以产生一个机器，使得通过计算机或其它可编程数据处理设备的处理器执行的指令产 生用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的装置。
而且，这些计算机程序指令也可以存储在能引导计算机或其它可编程数据处理设备以特定方式工作的计算机可读存储器中，使得存储在该计算机可读存储器中的指令产生包括指令装置的制造品，该指令装置实现在流程图一个流程或者多个流程和/或方框图一个方框或者多个方框中指定的功能。
这些计算机程序指令也可装载到计算机或其它可编程数据处理设备上，使得在计算机或者其它可编程设备上执行一系列操作步骤以产生计算机实现的处理，从而在计算机或其它可编程设备上执行的指令提供用于实现在流程图一个流程或多个流程和/或方框图一个方框或多个方框中指定的功能的步骤。
以上所述仅为本申请的实施例而已，并不用于限制本申请。对于本领域技术人员来说，本申请可以有各种更改和变化。凡在本申请的精神和原理之内所作的任何修改、等同替换、改进等，均应包含在本申请的权利要求范围之内。

Claims (16)

  1. 一种日志记录处理方法，其特征在于，所述方法包括：
    获取日志记录，所述日志记录包括用户信息、操作行为事件、消耗资源值；
    根据消耗资源值和操作行为事件确定所述日志记录所属的类别组；
    根据所述用户信息确定属于同一用户的日志记录，并根据属于同一用户的日志记录的操作行为事件和类别组确定所述用户的操作行为序列；
    根据所述操作行为序列确定目标操作行为序列。
  2. 根据权利要求1所述的方法，其特征在于，所述根据消耗资源值和操作行为事件确定所述日志记录所属的类别组，包括：
    确定所述操作行为事件对应的所有资源值区间；从所述操作行为事件对应的所有资源值区间中确定所述消耗资源值所位于的资源值区间；
    确定与所述资源值区间对应的类别组；
    将所述日志记录划分到所述类别组中。
  3. 根据权利要求2所述的方法，其特征在于，所述根据消耗资源值和操作行为事件确定所述日志记录所属的类别组之前，所述方法还包括：
    针对每种操作行为事件创建至少一个类别组；
    其中，不同类别组对应不同的资源值区间。
  4. 根据权利要求1所述的方法，其特征在于，
    所述日志记录还包括时间戳和操作时间值，所述根据属于同一用户的日志记录的操作行为事件和类别组确定所述用户的操作行为序列，包括：
    基于时间戳的先后顺序，根据属于同一用户的日志记录的操作行为事件和类别组确定初始序列；将所述初始序列确定为所述用户的操作行为序列；或者，
    基于时间戳的先后顺序，根据属于同一用户的日志记录的操作行为事件和类别组确定初始序列；根据操作时间值和消耗资源值将所述初始序列切分成至少一个子序列，并将所述至少一个子序列确定为所述用户的操作行为序列。
  5. 根据权利要求4所述的方法，其特征在于，所述根据操作时间值和消耗资源值将所述初始序列切分成至少一个子序列，包括：
    针对所述初始序列中的操作行为事件，根据所述操作行为事件对应的操作时间值和消耗资源值，确定所述操作行为事件是否为切分节点；
    若是，则将所述初始序列中位于所述操作行为事件之前的至少一个操作行为事件和 类别组切分成子序列。
  6. 根据权利要求5所述的方法，其特征在于，根据所述操作行为事件对应的操作时间值和消耗资源值，确定所述操作行为事件是否为切分节点，包括：
    根据所述操作时间值和所述消耗资源值，确定所述操作行为事件的残差；
    若所述残差大于残差阈值，则确定所述操作行为事件是切分节点；
    若所述残差不大于残差阈值，确定所述操作行为事件不是切分节点。
  7. 根据权利要求1所述的方法，其特征在于，
    所述根据所述操作行为序列确定目标操作行为序列，包括：
    利用所述操作行为序列确定公共子序列，所述公共子序列出现在多个操作行为序列中；确定所述公共子序列在所有操作行为序列中的出现次数；若所述出现次数大于次数阈值，则根据所述公共子序列确定目标操作行为序列。
  8. 根据权利要求7所述的方法，其特征在于，所述方法还包括：
    根据所述公共子序列中的操作行为事件的数量，确定所述公共子序列对应的次数阈值；其中，若操作行为事件的数量越大时，则次数阈值越小。
  9. 根据权利要求1-8任一所述的方法，其特征在于，
    所述日志记录包括负载日志记录。
  10. 一种日志记录处理方法，其特征在于，所述方法包括：
    获取日志记录，所述日志记录包括用户信息、操作行为事件；
    根据所述用户信息确定属于同一用户的日志记录，并根据属于同一用户的日志记录的操作行为事件确定所述用户的操作行为序列；
    利用所述操作行为序列确定目标操作行为序列。
  11. 根据权利要求10所述的方法，其特征在于，
    所述日志记录还包括时间戳、操作时间值和消耗资源值，所述根据属于同一用户的日志记录的操作行为事件确定所述用户的操作行为序列，包括：
    基于时间戳的先后顺序，根据属于同一用户的日志记录的操作行为事件确定初始序列；根据操作时间值和消耗资源值将所述初始序列切分成至少一个子序列，并将所述至少一个子序列确定为所述用户的操作行为序列。
  12. 根据权利要求11所述的方法，其特征在于，所述根据操作时间值和消耗资源值将所述初始序列切分成至少一个子序列，包括：
    针对所述初始序列中的操作行为事件，根据所述操作行为事件对应的操作时间值和 消耗资源值，确定所述操作行为事件是否为切分节点；
    若是，则将所述初始序列中位于所述操作行为事件之前的至少一个操作行为事件切分成子序列。
  13. 根据权利要求12所述的方法，其特征在于，根据所述操作行为事件对应的操作时间值和消耗资源值，确定所述操作行为事件是否为切分节点，包括：
    根据所述操作时间值和所述消耗资源值，确定所述操作行为事件的残差；
    若所述残差大于残差阈值，则确定所述操作行为事件是切分节点；
    若所述残差不大于残差阈值，确定所述操作行为事件不是切分节点。
  14. 一种日志记录处理装置，其特征在于，所述装置包括：
    获取模块，用于获取日志记录，所述日志记录包括用户信息、操作行为事件、消耗资源值；
    确定模块，用于根据消耗资源值和操作行为事件确定所述日志记录所属的类别组；根据所述用户信息确定属于同一用户的日志记录，并根据属于同一用户的日志记录的操作行为事件和类别组确定所述用户的操作行为序列；利用所述操作行为序列确定目标操作行为序列。
  15. 一种日志记录处理设备，其特征在于，包括：
    处理器和机器可读存储介质，所述机器可读存储介质上存储有若干计算机指令，所述处理器执行所述计算机指令时进行如下处理：
    获取日志记录，所述日志记录包括用户信息、操作行为事件、消耗资源值；
    根据消耗资源值和操作行为事件确定所述日志记录所属的类别组；
    根据所述用户信息确定属于同一用户的日志记录，并根据属于同一用户的日志记录的操作行为事件和类别组确定所述用户的操作行为序列；
    利用所述操作行为序列确定目标操作行为序列。
  16. 一种机器可读存储介质，其特征在于，所述机器可读存储介质上存储有若干计算机指令；所述计算机指令被执行时进行如下处理：
    获取日志记录，所述日志记录包括用户信息、操作行为事件、消耗资源值；
    根据消耗资源值和操作行为事件确定所述日志记录所属的类别组；
    根据所述用户信息确定属于同一用户的日志记录，并根据属于同一用户的日志记录的操作行为事件和类别组确定所述用户的操作行为序列；
    利用所述操作行为序列确定目标操作行为序列。
PCT/CN2020/114412 2019-09-12 2020-09-10 日志记录处理方法、装置、设备及机器可读存储介质 WO2021047576A1 (zh)

Applications Claiming Priority (2)

Application Number Priority Date Filing Date Title
CN201910863551.3 2019-09-12
CN201910863551.3A CN112486935B (zh) 2019-09-12 2019-09-12 日志记录处理方法、装置、设备及机器可读存储介质

Publications (1)

Publication Number Publication Date
WO2021047576A1 true WO2021047576A1 (zh) 2021-03-18

Family

ID=74866943

Family Applications (1)

Application Number Title Priority Date Filing Date
PCT/CN2020/114412 WO2021047576A1 (zh) 2019-09-12 2020-09-10 日志记录处理方法、装置、设备及机器可读存储介质

Country Status (2)

Country Link
CN (1) CN112486935B (zh)
WO (1) WO2021047576A1 (zh)

Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160070739A1 (en) * 2014-09-10 2016-03-10 Ca, Inc, Batch processed data structures in a log repository referencing a template repository and an attribute repository
CN105589905A (zh) * 2014-12-26 2016-05-18 中国银联股份有限公司 用户兴趣数据分析和收集系统及其方法
CN106649061A (zh) * 2015-11-04 2017-05-10 阿里巴巴集团控股有限公司 一种记录用户在web系统中的操作日志的方法与设备
CN108334646A (zh) * 2018-04-11 2018-07-27 焦点科技股份有限公司 一种基于频繁浏览序列的网站结构优化方法
CN108388508A (zh) * 2018-01-29 2018-08-10 华南理工大学 一种基于用户会话和层次聚类算法的测试用例选择方法
CN109359263A (zh) * 2018-10-16 2019-02-19 杭州安恒信息技术股份有限公司 一种用户行为特征提取方法及系统

Patent Citations (6)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20160070739A1 (en) * 2014-09-10 2016-03-10 Ca, Inc, Batch processed data structures in a log repository referencing a template repository and an attribute repository
CN105589905A (zh) * 2014-12-26 2016-05-18 中国银联股份有限公司 用户兴趣数据分析和收集系统及其方法
CN106649061A (zh) * 2015-11-04 2017-05-10 阿里巴巴集团控股有限公司 一种记录用户在web系统中的操作日志的方法与设备
CN108388508A (zh) * 2018-01-29 2018-08-10 华南理工大学 一种基于用户会话和层次聚类算法的测试用例选择方法
CN108334646A (zh) * 2018-04-11 2018-07-27 焦点科技股份有限公司 一种基于频繁浏览序列的网站结构优化方法
CN109359263A (zh) * 2018-10-16 2019-02-19 杭州安恒信息技术股份有限公司 一种用户行为特征提取方法及系统

Also Published As

Publication number Publication date
CN112486935A (zh) 2021-03-12
CN112486935B (zh) 2024-01-30

Similar Documents

Publication Publication Date Title
US11727305B2 (en) System and method for detecting anomalies in prediction generation systems
US10192051B2 (en) Data acceleration
US9495640B1 (en) Inferring application type based on input-output characteristics of application storage resources
US10423624B2 (en) Event log analysis
CN107111625B (zh) 实现数据的高效分类和探索的方法和系统
US20160253229A1 (en) Event log analysis
US20160098390A1 (en) Command history analysis apparatus and command history analysis method
US10002142B2 (en) Method and apparatus for generating schema of non-relational database
US20170140309A1 (en) Database analysis device and database analysis method
Yu et al. Mass log data processing and mining based on Hadoop and cloud computing
US11119843B2 (en) Verifying application behavior based on distributed tracing
CN107016115B (zh) 数据导出方法、装置、计算机可读存储介质及电子设备
CN111339293A (zh) 告警事件的数据处理方法、装置和告警事件的分类方法
US10346450B2 (en) Automatic datacenter state summarization
CN117312825A (zh) 一种目标行为检测方法、装置、电子设备及存储介质
JP2014035749A (ja) ログ生成則作成装置及び方法
CN104539449A (zh) 一种故障信息处理方法与相关装置
WO2021047576A1 (zh) 日志记录处理方法、装置、设备及机器可读存储介质
CN117093556A (zh) 日志分类方法、装置、计算机设备及计算机可读存储介质
US20110078218A1 (en) Event history storage device, event history tracking device, event history storage method, event history storage program, and data structure
CN106776704B (zh) 统计信息收集方法和装置
CN113220530A (zh) 数据质量监控方法及平台
CN111898010A (zh) 新关键词挖掘方法、装置及电子设备
JP5718256B2 (ja) システム性能解析装置、システム性能解析方法、およびシステム性能解析プログラム
WO2021047575A1 (zh) 负载测试方法、装置、电子设备及计算机可读存储介质

Legal Events

Date Code Title Description
121 Ep: the epo has been informed by wipo that ep was designated in this application

Ref document number: 20863685

Country of ref document: EP

Kind code of ref document: A1

NENP Non-entry into the national phase

Ref country code: DE

122 Ep: pct application non-entry in european phase

Ref document number: 20863685

Country of ref document: EP

Kind code of ref document: A1