Training method, device, equipment and medium for log error judgment model
By training the link log error judgment model, the problem of time-consuming and low accuracy of log error detection is solved, and more efficient and accurate log error detection and link log correlation judgment are achieved.
Patent Information
- Application Number
- CN202410608187.7
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2024-05-16
- Publication Date
- 2025-03-07
- Estimated Expiration
- 2044-05-16
AI Technical Summary
In the prior art, log error detection is time-consuming and labor-intensive and has low accuracy, making it difficult to effectively troubleshoot errors in log content.
By obtaining the target link logs of the task link, determining the field error results and the broken link error results, generating error tags, building a training set, and using this training set to train the link log error judgment model.
It improves the efficiency and accuracy of log error detection, can more accurately judge the correlation between the target link log and other link logs, and improves the accuracy of link log correlation judgment.
Smart Images

Figure CN118350485B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of deep learning, and in particular to a training method, device, equipment and medium for a link log error judgment model. Background Art
[0002] With the development of information technology, log records have become an indispensable tool for system operation and troubleshooting. The log content records the specified completion time, storage path, work results and other related content of the work task. Therefore, in order to detect the completion status of the work task, it can be obtained by parsing the log content.
[0003] However, due to the diversity of work tasks and the uncertainty of system operation, it is easy to have problems such as log content errors and disorder. The troubleshooting of log errors is currently mainly done through manual reading. However, manual log troubleshooting is not only time-consuming, labor-intensive and inefficient, but also has low accuracy. Summary of the invention
[0004] The embodiments of the present invention provide a training method, device, equipment and medium for a log error judgment model. The link log error judgment model trained by the method of the embodiment of the present invention can solve the problem that the current log error detection is time-consuming, labor-intensive and has low accuracy, and can improve the detection efficiency of log errors by improving the accuracy of log error detection.
[0005] In a first aspect, an embodiment of the present invention provides a method for training a link log error judgment model, comprising:
[0006] Get the target link logs of each task link;
[0007] Determine, according to the field value and field type of the target link log, a field error result and a link break error result of the target link log, wherein the link break error indicates that the target link log cannot be associated with other link logs in the task link;
[0008] Generate an error label corresponding to the target link log according to the field error result and the link break error result of the target link log;
[0009] A training set is constructed according to the target link log of the task link and the corresponding error label, and a link log error judgment model is trained using the training set.
[0010] In a second aspect, an embodiment of the present invention provides a link log error judgment method, which is applied to any link log error judgment model described in an embodiment of the present invention, and includes:
[0011] Obtain the link log to be determined;
[0012] Based on the link log error judgment model, determining the error type vector of the link log to be judged;
[0013] The error type of the link log to be determined is determined based on the error type vector.
[0014] In a third aspect, an embodiment of the present invention provides a training device for a link log error judgment model, including:
[0015] The acquisition module is used to obtain the logs of each target link of the task link;
[0016] An error determination module, used to determine a field error result and a broken link error result of the target link log according to a field value and a field type of the target link log, wherein the broken link error indicates that the target link log cannot be associated with other link logs in the task link;
[0017] An error label determination module, used to generate an error label corresponding to the target link log according to the field error result and the link break error result of the target link log;
[0018] The training module is used to construct a training set according to the target link log of the task link and the corresponding error label, and use the training set to train the link log error judgment model.
[0019] In a fourth aspect, an embodiment of the present invention provides a link log error judgment device, including:
[0020] A log acquisition module, used to acquire the link log to be determined;
[0021] An error type vector determination module, used to determine the error type vector of the link log to be determined based on the link log error judgment model;
[0022] A judgment module is used to determine the error type of the link log to be judged based on the error type vector.
[0023] In a fourth aspect, an embodiment of the present invention provides an electronic device, the electronic device comprising:
[0024] at least one processor; and
[0025] a memory communicatively connected to the at least one processor; wherein,
[0026] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the training method of the link log error judgment model described in any one of the embodiments of the present invention.
[0027] In a fifth aspect, an embodiment of the present invention provides a computer-readable storage medium, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the training method of the link log error judgment model described in any one of the embodiments of the present invention when executed.
[0028] In a sixth aspect, an embodiment of the present invention provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, it implements a training method for a link log error judgment model according to any one of the embodiments of the present invention.
[0029] An embodiment of the present invention provides a training method, device, equipment and medium for a log error judgment model. The training method for a link log error judgment model includes: obtaining each target link log of a task link; determining a field error result and a broken link error result of the target link log according to a field value and a field type of the target link log, wherein the broken link error indicates that the target link log cannot be associated with other link logs in the task link; generating an error label corresponding to the target link log according to the field error result and the broken link error result of the target link log; constructing a training set according to the target link log and the corresponding error label of the task link, and using the training set to train a link log error judgment model. Specifically, by detecting the field value and field type of the target link log, the field error result and the broken link error result of the target link log can be determined, and then the corresponding error label can be generated according to the field error result and the broken link error result of the target link log, and then the link log error judgment model can be trained according to the target link log and the corresponding error label. Through this method, the link log error judgment model trained by the method of the embodiment of the present invention can solve the problem that the current log error detection is time-consuming, labor-intensive and has low accuracy, and can improve the detection efficiency of log errors. By improving the accuracy of log error detection, further, by determining the broken link error result in the link log, it can be determined whether the target link log is associated with other link logs, which helps to improve the accuracy of the correlation judgment of the link logs. BRIEF DESCRIPTION OF THE DRAWINGS
[0030] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.
[0031] Figure 1 is a flowchart of a training method for a link log error judgment model provided in Embodiment 1 of the present invention;
[0032] Figure 2 is a flowchart of a training method for a link log error judgment model provided in Embodiment 2 of the present invention;
[0033] Figure 3 A flowchart of a link log error judgment method provided in Embodiment 3 of the present invention;
[0034] Figure 4 A training device for a log error judgment model provided in Embodiment 4 of the present invention;
[0035] Figure 5 A link log error judgment device provided in Embodiment 5 of the present invention;
[0036] Figure 6 FIG. 1 is a schematic diagram of the structure of an electronic device provided according to Embodiment 6 of the present invention. DETAILED DESCRIPTION
[0037] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.
[0038] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.
[0039] Embodiment 1
[0040] Figure 1A flowchart of a method for training a link log error judgment model is provided for the first embodiment of the present invention. The embodiment of the present invention can be applicable to the training of a link log error judgment model. The link log error judgment model can be used for link log error detection, such as detecting field errors and broken link errors in link logs. Through the model, the error type existing in the link log can be accurately determined, and the detection efficiency of log errors can be improved. At the same time, the correlation between the target link log and other link logs can be determined through the model. The method can be executed by a training device for a link log error judgment model. The device can be implemented in the form of hardware and / or software and configured in a computer or server for training the link log error judgment model.
[0041] Specifically, Figure 1 include:
[0042] Step 110: Obtain each target link log of the task link.
[0043] Since current computer network tasks are usually multi-level, that is, completing a task may require multi-level network devices, multiple network layers or multiple levels of sub-tasks, therefore, task links are usually used to describe the process sequence represented when completing the entire network task. Task links usually contain various nodes. When each node executes the corresponding sub-task or sub-operation, it will generate a corresponding link log. By parsing the link log, you can understand the task process, task results, task status and other information of the current node.
[0044] Specifically, the target link log of each node in the task link can be obtained as an initial data set for model training.
[0045] Step 120: Determine a field error result and a broken link error result of the target link log according to the field value and field type of the target link log, wherein the broken link error indicates that the target link log cannot be associated with other link logs in the task link.
[0046] The target link log contains field values and field types that describe task information, such as the path field that describes the storage location, the time field that describes the task time, etc. However, due to errors in task execution or system operation, the link log may contain some field errors and broken link errors. A field error is that the field generated by the current log is different from the preset correct field. For example, a field error may include missing fields, generation of redundant fields, path address errors of storage paths, or character type errors of parameters.
[0047] Link log association can be understood as follows: since the completion of the task link corresponding to the task requires a specific order or steps, the contents of the link logs have a certain order or causal relationship. Therefore, corresponding keywords can be preset in the log to describe the order relationship or causal relationship between the link log and other link logs. Then, the association between the link logs can be determined by keyword matching between the target link log and other link logs. If the causal relationship between the current link log and other link logs is unclear, it indicates that the log has a broken link error.
[0048] Specifically, the field error result and the broken link error result of the target link log may be determined according to the field value and field type of the target link log and the preset judgment rule.
[0049] Step 130: Generate an error label corresponding to the target link log according to the field error result and the broken link error result of the target link log.
[0050] The error label may be determined according to the field error result and the broken link error result of the target link log. The error label may be in the form of a feature vector. The error label is used to characterize the error type existing in the corresponding target link log.
[0051] Optionally, determining an error type value of the target link log according to a field error result and a broken link error result of the target link log;
[0052] An error type vector of the target link log is constructed according to the error type value, and the error type vector is used to characterize an error label corresponding to the target link log.
[0053] Exemplarily, the corresponding element in the error type vector may be set to a preset value to characterize the error type of the target link log. For example, the error type vector may be constructed in the following manner:
[0054] Set the error type vector to [X1,X2], {X1 and X2∈{0 or 1}}
[0055] Field Error: first element of vector
[0056] Broken link error: the second element of the vector
[0057] If a field error occurs in the log but there is no link-breaking error, the error type vector may be [1,0], where '1' indicates that the target link log contains a field error and '0' indicates that the target link log does not contain a link-breaking error.
[0058] Step 140: construct a training set according to the target link log of the task link and the corresponding error label, and use the training set to train a link log error judgment model.
[0059] Specifically, a training set may be constructed using target link logs and corresponding error labels, and the link log error judgment model may be trained using the training set.
[0060] Exemplarily, the link log error judgment model may be a random forest model. The random forest model constructs multiple decision trees to perform classification or regression prediction. The random forest model may be used to complete the classification of the target link log error type.
[0061] An embodiment of the present invention provides a training method for a link log error judgment model, including: obtaining each target link log of a task link; determining a field error result and a broken link error result of the target link log according to a field value and a field type of the target link log, wherein the broken link error indicates that the target link log cannot be associated with other link logs in the task link; generating an error label corresponding to the target link log according to the field error result and the broken link error result of the target link log; constructing a training set according to the target link log of the task link and the corresponding error label, and using the training set to train a link log error judgment model. Specifically, by detecting the field value and field type of the target link log, the field error result and the broken link error result of the target link log can be determined, and then the corresponding error label can be generated through the field error result and the broken link error result of the target link log, and then the link log error judgment model can be trained according to the target link log and the corresponding error label. The link log error judgment model trained by the method of the embodiment of the present invention can solve the problem that the current log error detection is time-consuming, labor-intensive and has low accuracy, and can improve the detection efficiency of log errors. By improving the accuracy of log error detection, further, by determining the broken link error result in the link log, it can be determined whether the target link log is associated with other link logs, which helps to improve the accuracy of the correlation judgment of the link log. At the same time, by generating accurate error labels based on the error results, a training set for error label construction can be better established, thereby improving the accuracy of model training.
[0062] Embodiment 2
[0063] Figure 2 A flowchart of a training method for a link log error judgment model provided in an embodiment of the present invention. Based on the above embodiments, this embodiment further optimizes the method for determining the field error result and the broken link error result of the target link log according to the field value and field type of the target link log, and can be applied to the above embodiments.
[0064] like Figure 2 As shown, including:
[0065] Step 201: Obtain each target link log of the task link.
[0066] Step 202: Obtain a standard link log corresponding to the target link log, wherein the field value of the standard link log is a preset correct field value.
[0067] Among them, since the subtasks completed by each link node may be different, the correct logs corresponding to each target link log may be different. The standard link log is the correct log of the preset target link log, and the field values in the log content of the standard link log are the preset correct field values.
[0068] Specifically, the error in the target link log may be determined by comparing the field value of the target link log with the field value in the standard link log.
[0069] Step 203: Determine a separator in the standard link log and the target link log, wherein the separator is used to separate field values at different fields in the link log.
[0070] Step 204: Based on the separator, determine the standard comparison content of the standard link log and the current comparison content of the target link log.
[0071] The standard comparison content is the correct content determined by the corresponding separator in the standard link log, and the current comparison content is the content required for comparison determined by the corresponding separator in the target link log.
[0072] Specifically, the positions of different fields in the standard link log and the target link log can be determined by the positions of preset separators, and then the error judgment process can be completed by comparing the contents of corresponding positions.
[0073] Exemplarily, the separator can be at a preset position in the link log. For example, the content between the second separator and the third separator can be preset as the storage path content. If the storage path content needs to be compared, the positions of the second separator and the third separator can be determined in the standard link log to determine the correct path content and complete the comparison.
[0074] Step 205: If there is at least one character in the current comparison content that is different from the standard comparison content, it is determined that there is a field error in the target link log.
[0075] Exemplarily, the standard comparison content and the current comparison content may be compared word by word to determine whether there are errors in the current comparison content.
[0076] Specifically, through step 202 to step 205, it is possible to determine the field error in the target link log and determine the field error result of the target link log.
[0077] Step 206: Determine the node sequence number of the target link log.
[0078] Step 207: Determine the location of the target link log in the log tree according to the node sequence number.
[0079] Step 208: According to the position of the target link log in the log tree, determine that the link logs corresponding to the parent and child nodes of the target link log are associated logs.
[0080] The node serial number represents the serial number of the network node that generates the target link log. Specifically, the position of the target link log in the log tree can be determined by the node serial number.
[0081] The log tree is generated based on the tasks corresponding to the task links. The connection relationship between the parent and child nodes of the log tree is determined by the task relationship between the child tasks. Exemplarily, the log tree can be a binary tree or a red-black tree. Each node of the log tree will generate a corresponding link log according to its own task.
[0082] Specifically, the position of the target link log in the log tree can be determined by the node sequence number, and the parent and child nodes of the target link log can be determined by the position of the target link log in the log tree, and then the link logs corresponding to the parent and child nodes can be determined as associated logs. Associated logs are logs that may have an associated relationship with the target link log. The associated relationship can be a task inclusion relationship, a task connection relationship, a time sequence relationship, etc., which is not limited here.
[0083] Step 209: Determine the link break error result in the target link log according to the target link log and the associated logs of the target link log.
[0084] Optionally, determining a broken link keyword representing content association between the target link log and each of the associated logs;
[0085] Determine a link break error in the target link log according to the field values of the link break keywords of the target link log and each associated log.
[0086] Specifically, whether there is an association relationship between the target link log and the associated logs can be determined through the value of the keyword representing the link break in the target link log and each associated log of the target link log.
[0087] Optionally, if the matching result between the field value of the broken link keyword in each associated log and the field value of the target link log keyword does not meet a preset condition, it is determined that a broken link error exists in the target link log.
[0088] Among them, the preset condition can be a numerical condition, such as the numerical values are the same or the numerical values have a preset corresponding relationship, which is not limited here.
[0089] Specifically, the field value of the broken link keyword in the associated log may be matched with the field value of the target link log keyword, and whether the target link log has a broken link error may be determined based on the matching result and preset conditions.
[0090] For example, the first keyword and the second keyword can be set in the link log. If the first keyword in the target link log is not empty, and the second keyword of at least one associated log is equal to the first keyword in the target link log, it indicates that there is a correlation between the target link log and the corresponding associated log, and the target link log has no broken link error.
[0091] Specifically, through step 206 to step 209, the judgment of the link breaking error in the target link log can be completed, and the link breaking error result in the target link log can be obtained.
[0092] Step 210: Generate an error label corresponding to the target link log according to the field error result and the broken link error result of the target link log.
[0093] Step 211: construct a training set according to the target link log of the task link and the corresponding error label, and use the training set to train a link log error judgment model.
[0094] The embodiment of the present invention provides a training method for a link log error judgment model. The method determines the positions of the current comparison content and the standard comparison content required for comparison in the link log by determining the separators in the standard link log and the target link log, thereby efficiently completing the field comparison work and determining the field error result; at the same time, the position of the target link log in the log tree can be quickly determined by the node sequence number of the target link log, thereby determining the associated log corresponding to the parent-child node that may have an associated relationship with the target link log, and then determining the association relationship between the target link log and the associated log according to the matching result of the preset broken link keyword, and determining the broken link error result of the target link log. Through the method of the embodiment of the present invention, the field error result and the broken link error result of the target link log can be efficiently determined, thereby improving the efficiency of the link log error judgment model training, and the trained link log error judgment model can accurately judge the field error result and the broken link error result of the target link log, thereby improving the accuracy of the link log error judgment.
[0095] Embodiment 3
[0096] Figure 3 The flowchart of a link log error judgment method provided in the third embodiment of the present invention can be applied to the link log error judgment model described in any embodiment of the present application.
[0097] like Figure 3As shown, including:
[0098] Step 310: Obtain the link log to be determined;
[0099] Specifically, the link log to be determined can be obtained from the task node of the task link, which includes field values and field types representing task information. Furthermore, the link log to be determined may also include field errors and broken link errors.
[0100] Step 320: Determine the error type vector of the link log to be determined based on the link log error judgment model.
[0101] Step 330: Determine the error type of the link log to be determined based on the error type vector.
[0102] Among them, each element of the error type vector can represent whether there are field errors and broken link errors in the link log to be determined. For example, if the error type vector is [1,1], it represents that there are field errors and broken link errors in the link log to be determined; if the error type vector is [1,0], it represents that there are field errors in the link log to be determined, but no broken link errors.
[0103] Specifically, the link log to be judged can be input into a link log error judgment model to determine the error type vector of the link log, wherein the error type vector of the link log is used to characterize whether the link log has field error results and broken link error results.
[0104] An embodiment of the present invention provides a link log error judgment method, which is based on a link log error judgment model trained by the embodiment of the present invention. Through the method of this embodiment, the accuracy and efficiency of link log error judgment can be improved. For example, it can be judged whether there are field errors and broken link errors in the link log. Furthermore, if the broken link error result indicates that there is a broken link error in the link log, it means that the link log has no correlation with other link logs. This method is helpful to determine the correlation between link logs.
[0105] Embodiment 4
[0106] Figure 4 A training device for a log error judgment model provided in the fourth embodiment of the present invention can be used to implement the training method for a log error judgment model described in any one of the embodiments of the present invention. Specifically, Figure 4 include:
[0107] The acquisition module 410 is used to acquire the logs of each target link of the task link;
[0108] An error determination module 420 is used to determine a field error result and a link break error result of the target link log according to a field value and a field type of the target link log, wherein the link break error indicates that the target link log cannot be associated with other link logs in the task link;
[0109] An error label determination module 430, configured to generate an error label corresponding to the target link log according to a field error result and a broken link error result of the target link log;
[0110] The training module 440 is used to construct a training set according to the target link log of the task link and the corresponding error label, and use the training set to train the log error judgment model.
[0111] The present embodiment provides a training device for a log error judgment model, and the device is used to implement the training method for the log error judgment model described in any one of the embodiments of the present invention. Specifically, the device can determine the field error result and the broken link error result of the target link log by detecting the field value and the field type of the target link log, and then generate corresponding error labels through the field error result and the broken link error result of the target link log, and then train the link log error judgment model according to the target link log and the corresponding error labels. Through this device, the problem that the current log error detection is time-consuming, labor-intensive and has low accuracy can be solved. The link log error judgment model trained by the device of the embodiment of the present invention can improve the detection efficiency of log errors, and by improving the accuracy of log error detection, further, by determining the broken link error result in the link log, it can be determined whether the target link log is associated with other link logs, which helps to improve the accuracy of the correlation judgment of the link logs.
[0112] Optionally, the error determination module 420 includes a field error result determination submodule and a link break error result determination submodule.
[0113] The field error result determination submodule includes: an acquisition unit, a separator determination unit, a comparison unit and a result determination unit.
[0114] An acquiring unit, configured to acquire a standard link log corresponding to a target link log, wherein a field value of the standard link log is a preset correct field value;
[0115] A delimiter determination unit, used to determine delimiters in the standard link log and the target link log, wherein the delimiter is used to separate field values at different fields in the link log;
[0116] A comparison unit, configured to determine, based on the separator, a standard comparison content of the standard link log and a current comparison content of the target link log;
[0117] A result determination unit is used to determine a field error result in the target link log according to the standard comparison content and the current comparison content.
[0118] Optionally, the result determination unit includes a result determination unit subunit, which is used to determine that there is a field error in the target link log if there is at least one character in the current comparison content that is different from the standard comparison content.
[0119] The link-break error result determination submodule includes: a node sequence number determination unit, a position determination unit, an associated log determination unit and a link-break error determination unit.
[0120] A node serial number determination unit, used to determine the node serial number of the target link log;
[0121] A position determination unit, used to determine the position of the target link log in the log tree according to the node sequence number;
[0122] An associated log determining unit, configured to determine, according to the position of the target link log in the log tree, the link log corresponding to the parent and child nodes of the target link log as an associated log;
[0123] The link breaking error determining unit is used to determine the link breaking error result in the target link log according to the target link log and each associated log of the target link log.
[0124] The broken link error determination unit includes a broken link keyword determination subunit and a broken link error determination subunit.
[0125] A broken link keyword determination subunit, used to determine a broken link keyword representing the association between the target link log and the content in each associated log;
[0126] The link-breaking error determining subunit is used to determine the link-breaking error in the target link log according to the field values of the link-breaking keywords of the target link log and each of the associated logs.
[0127] The link-breaking error determination subunit is specifically used to determine that a link-breaking error exists in the target link log if the matching result between the field value of the link-breaking keyword in each associated log and the field value of the target link log keyword does not meet a preset condition.
[0128] Optionally, the error label determination module 430 includes an error type value determination unit and a generation unit.
[0129] An error type value determining unit, configured to determine an error type value of the target link log according to a field error result and a link break error result of the target link log;
[0130] A generating unit is used to construct an error type vector of the target link log according to the error type value, and the error type vector is used to represent an error label corresponding to the target link log.
[0131] The training device for the log error judgment model provided in the embodiment of the present invention can execute the training method for the log error judgment model provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.
[0132] Embodiment 5
[0133] Figure 5 A link log error judgment device is provided in Embodiment 5 of the present invention. The device can be used to implement the link log error judgment method described in any one of the embodiments of the present invention. Specifically, Figure 5 include:
[0134] An acquisition module 510 is used to acquire a link log to be determined;
[0135] An input module 520, configured to determine an error type vector of the link log to be determined based on the link log error judgment model;
[0136] The determination module 530 is configured to determine the error type of the link log to be determined based on the error type vector.
[0137] An embodiment of the present invention provides a link log error judgment method, which is based on a link log error judgment model trained by the embodiment of the present invention. Through the method of this embodiment, the accuracy and efficiency of link log error judgment can be improved. For example, it can be judged whether there are field errors and broken link errors in the link log. Furthermore, if the broken link error result indicates that there is a broken link error in the link log, it means that the link log has no correlation with other link logs. This method is helpful to determine the correlation between link logs.
[0138] Embodiment 6
[0139] Figure 6 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.
[0140] like Figure 6 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.
[0141] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.
[0142] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as the training method of the log error judgment model and the link log error judgment method.
[0143] In some embodiments, the training method of the log error judgment model and the link log error judgment method can be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program can be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the training method of the log error judgment model and the link log error judgment method described above can be executed. Alternatively, in other embodiments, the processor 11 can be configured to execute the training method of the log error judgment model and the link log error judgment method in any other appropriate manner (for example, by means of firmware).
[0144] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), complex programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.
[0145] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.
[0146] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.
[0147] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).
[0148] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.
[0149] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.
[0150] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.
[0151] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.
[0152] Embodiment 7
[0153] The embodiments of the present disclosure also provide a computer program product, including a computer program and / or instructions, which, when executed by a processor, implements a log error judgment model training method and a link log error judgment method as provided in any embodiment of the present application.
[0154] In the process of implementation, the computer program product can be written in one or more programming languages or a combination thereof to write computer program codes for performing the operation of the disclosed embodiments, the programming languages including object-oriented programming languages, such as Java, Smalltalk, C++, and also including conventional procedural programming languages, such as "C" language or similar programming languages. The program code can be executed entirely on the user's computer, partially on the user's computer, as an independent software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer can be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computer (e.g., using an Internet service provider to connect through the Internet).
[0155] Note that the above are only preferred embodiments of the embodiments of the present disclosure and the technical principles used. Those skilled in the art will understand that the embodiments of the present disclosure are not limited to the specific embodiments herein, and that various obvious changes, readjustments and substitutions can be made by those skilled in the art without departing from the protection scope of the embodiments of the present disclosure. Therefore, although the embodiments of the present disclosure are described in more detail through the above embodiments, the embodiments of the present disclosure are not limited to the above embodiments, and may include more other equivalent embodiments without departing from the concept of the embodiments of the present disclosure, and the scope of the embodiments of the present disclosure is determined by the scope of the attached claims.
Claims
1. A training method for a link log error judgment model, characterized in that: include: Get the target link logs of each task link; Determine, according to the field value and field type of the target link log, a field error result and a link break error result of the target link log, wherein the link break error indicates that the target link log cannot be associated with other link logs in the task link; Generate an error label corresponding to the target link log according to the field error result and the link break error result of the target link log; Building a training set according to the target link log of the task link and the corresponding error label, and using the training set to train a link log error judgment model; Wherein, determining the field error result of the target link log includes: Obtaining a standard link log corresponding to the target link log, wherein the field value of the standard link log is a preset correct field value; Determine a separator in the standard link log and the target link log, wherein the separator is used to separate field values at different fields in the link log; Based on the separator, determining the standard comparison content of the standard link log and the current comparison content of the target link log; If at least one character in the current comparison content is different from the standard comparison content, it is determined that there is a field error in the target link log; Wherein, determining the link break error result of the target link log includes: Determine the node sequence number of the target link log; Determine the location of the target link log in the log tree according to the node sequence number; According to the position of the target link log in the log tree, determining the link log corresponding to the parent and child nodes of the target link log as the associated log; The link breaking error result in the target link log is determined according to the target link log and each associated log of the target link log.
2. The method according to claim 1, characterized in that The determining the link break error result in the target link log according to the target link log and each associated log of the target link log includes: Determine the target link log and the broken link keywords representing the content association in each of the associated logs; If the matching result of the field value of the broken link keyword in each associated log and the field value of the target link log keyword does not meet the preset condition, it is determined that there is a broken link error in the target link log.
3. The method according to claim 1, characterized in that The step of generating an error label corresponding to the target link log according to the field error result and the link break error result of the target link log includes: Determine the error type value of the target link log according to the field error result and the link break error result of the target link log; An error type vector of the target link log is constructed according to the error type value, and the error type vector is used to characterize an error label corresponding to the target link log.
4. A link log error judgment method, characterized in that: include: Obtain the link log to be determined; Determine the error type vector of the link log to be determined based on the link log error judgment model; The error type of the link log to be determined is determined based on the error type vector; wherein the link log error judgment model is trained by any one of the methods described in claims 1-3.
5. A training device for a link log error judgment model, characterized in that: include: The acquisition module is used to obtain the logs of each target link of the task link; An error determination module, used to determine a field error result and a broken link error result of the target link log according to a field value and a field type of the target link log, wherein the broken link error indicates that the target link log cannot be associated with other link logs in the task link; An error label determination module, used to generate an error label corresponding to the target link log according to the field error result and the link break error result of the target link log; A training module, used to construct a training set according to the target link log of the task link and the corresponding error label, and use the training set to train a link log error judgment model; Wherein, the error determination module includes a field error result determination submodule and a link break error result determination submodule; The field error result determination submodule includes: An acquiring unit, configured to acquire a standard link log corresponding to a target link log, wherein a field value of the standard link log is a preset correct field value; A delimiter determination unit, used to determine delimiters in the standard link log and the target link log, wherein the delimiter is used to separate field values at different fields in the link log; A comparison unit, configured to determine, based on the separator, a standard comparison content of the standard link log and a current comparison content of the target link log; A result determination unit, configured to determine that a field error exists in the target link log if at least one character in the current comparison content is different from the standard comparison content; The link break error result determination submodule includes: A node serial number determination unit, used to determine the node serial number of the target link log; A position determination unit, used to determine the position of the target link log in the log tree according to the node sequence number; An associated log determining unit, configured to determine, according to the position of the target link log in the log tree, the link log corresponding to the parent and child nodes of the target link log as an associated log; The link breaking error determining unit is used to determine the link breaking error result in the target link log according to the target link log and each associated log of the target link log.
6. A link log error judgment device, characterized in that: include: A log acquisition module, used to acquire the link log to be determined; An error type vector determination module, used to determine the error type vector of the link log to be determined based on a link log error judgment model; A judgment module is used to determine the error type of the link log to be judged based on the error type vector; wherein the link log error judgment model is obtained by training the device described in claim 5.
7. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the training method of the link log error judgment model described in any one of claims 1-3.
8. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the training method of the link log error judgment model described in any one of claims 1 to 3 when executed.
Citation Information
Patent Citations
Log anomaly detection method and system
CN116048862A