Log data exception detection method and device, terminal and medium

Abstract

The invention discloses a log data exception detection method and device, a terminal and a medium. The method comprises the following steps: converting the acquired first log data sequence into a first identification sequence, wherein the first log data sequence is M pieces of system log data arranged in a time sequence of the first network equipment, the first identification sequence comprises Mlog identifications, M is an integer greater than 1, and a prediction result is obtained based on the first identification sequence and comprises at least one prediction log identification; acquiringsecond log data, wherein the second log data is the next system log data generated by the first network device after the first log data sequence; the second log data is converted into the corresponding target log identifier, the target log identifier is compared with the prediction result, and whether the second log data is abnormal data or not is determined, so that abnormality detection of the system log data of the network equipment can be realized more accurately and efficiently, and abnormality processing can be carried out in time.

Description

technical field

[0001] The present application relates to the field of computer technology, and in particular to a log data anomaly detection method, device, terminal and medium. Background technique

[0002] The system log data output by network devices such as switches and routers records the various states of the devices in operation and contains a lot of important and valuable information. Through the detection of these system log data, it can be found whether the state of the network device is abnormal.

[0003] The anomaly detection method of system log data is generally based on rule-based keyword matching, which performs regular expression matching between system log data and each rule in the existing rule base, and generates an abnormal alarm if the match is successful. However, new devices are constantly introduced in network operations, and it takes a long time to add and complete these rules for each type of new device, resulting in the omission of many alarms t...

Images