Log diagnosis method and device based on flow arrangement, equipment and medium

Abstract

The invention discloses a log diagnosis method and device based on flow arrangement, equipment and a medium. Comprising the steps of obtaining log data, and obtaining an arrangement diagnosis task; determining abnormal alarm data in the log data, and determining a target arrangement diagnosis task according to the abnormal alarm data; and diagnosing the abnormal alarm data based on the target arrangement diagnosis task to generate a diagnosis result, and displaying the diagnosis result, the diagnosis result including a single fault diagnosis result and a comprehensive fault diagnosis result. Through diagnosis process arrangement, information required by diagnosis can be comprehensively covered, diagnosis process planning can be clarified, a basis is provided for subsequent accurate diagnosis, and systematicness and orderliness of diagnosis work are ensured. The efficiency of the diagnosis process is improved, and the method can adapt to complex and changeable operation and maintenance scenes. Through visual display, a user can intuitively and clearly know the fault condition, a decision can be quickly made, corresponding repair measures can be taken, and the timeliness and effectiveness of fault processing are improved.

Description

Technical Field

[0001] The present invention relates to the technical field of fault diagnosis, and in particular to a log diagnosis method, device, equipment and medium based on process orchestration. Background Art

[0002] In today's highly digital and information-based era, various systems and applications generate a large amount of log data during operation, recording key content such as the system's operating status, operating behavior, and error information. As the complexity of the system continues to increase, failures are becoming more frequent and unpredictable. When a system fails, quickly and accurately diagnosing and solving the problem is crucial to ensuring business continuity and stability.

[0003] Currently, there are many traditional operation and maintenance tools on the market, such as Zabbix, Prometheus and Nagios, which are good at monitoring and analyzing the indicators of single objects such as hosts, containers, networks, etc., and can issue single indicator alarms in a timely manner. Although these tools perform well in their respective fields, they lack a global perspective and cannot perform comprehensive diagnosis and analysis of a complex fault. Summary of the invention

[0004] The present invention provides a log diagnosis method, device, equipment and medium based on process arrangement to realize customized diagnosis task arrangement, with high configuration efficiency, high adjustment flexibility and saving of a large amount of development cost.

[0005] According to one aspect of the present invention, a log diagnosis method based on process orchestration is provided, the method comprising:

[0006] Obtaining log data and obtaining an orchestration diagnosis task, wherein the orchestration diagnosis task includes a parallel diagnosis process and a serial diagnosis process;

[0007] Determine the abnormal alarm data in the log data, and determine the target orchestration diagnosis task based on the abnormal alarm data;

[0008] Based on the target-based diagnostic task arrangement, the abnormal alarm data is diagnosed to generate diagnostic results, and the diagnostic results are displayed. The diagnostic results include single fault diagnosis results and comprehensive fault diagnosis results.

[0009] Optionally, obtaining log data includes: determining a business data collection address of a current monitoring platform; performing text collection on the business data collection address by a specified collection method to obtain collected data; and storing the collected data in a specified storage address to generate log data.

[0010] Optionally, obtaining the orchestration diagnostic task includes: obtaining each first query statement and directly generating a parallel diagnostic process based on each first query statement; obtaining each second query statement and its corresponding step number, and combining each second query statement according to the step number to generate a serial diagnostic process.

[0011] Optionally, determining abnormal alarm data in the log data includes: obtaining an alarm trigger item and scanning the log data at a specified time interval; when the scanning process triggers the alarm trigger item, using data in the log data corresponding to the alarm trigger item as abnormal alarm data.

[0012] Optionally, determining a target orchestration diagnosis task according to abnormal alarm data includes: determining a target data type corresponding to the abnormal alarm data; obtaining an alarm trigger configuration list, wherein the alarm trigger configuration list includes a diagnosis type corresponding to each data type, and the diagnosis type includes a single fault diagnosis and a comprehensive fault diagnosis; matching the target data type through the alarm trigger configuration list to obtain a target diagnosis type corresponding to the abnormal alarm data; when the target diagnosis type is a single fault diagnosis, determining that the target orchestration diagnosis task is a parallel diagnosis process; when the target diagnosis type is a comprehensive fault diagnosis, determining that the target orchestration diagnosis task is a serial diagnosis process.

[0013] Optionally, diagnosing the abnormal alarm data based on the target orchestration diagnosis task to generate a diagnosis result includes: diagnosing the abnormal alarm data according to each query statement in the target orchestration diagnosis task to obtain each sub-diagnosis result; obtaining a comprehensive diagnosis expression, and inputting each sub-diagnosis result into the comprehensive diagnosis expression to determine the diagnosis result.

[0014] Optionally, displaying the diagnosis results includes: obtaining a data display template and determining each extraction keyword corresponding to the data display template; performing data extraction on the diagnosis results according to each extraction keyword to generate each extracted data, and determining a target position corresponding to each extracted data in the data display template; combining the extracted data and the data display template based on the target position to generate display data; and displaying the display data through a visualization tool.

[0015] According to another aspect of the present invention, a log diagnosis device based on process orchestration is provided, the device comprising:

[0016] The log data and diagnostic task acquisition module is used to acquire log data and obtain the orchestration diagnostic task, wherein the orchestration diagnostic task includes a parallel diagnostic process and a serial diagnostic process;

[0017] A target orchestration diagnosis task determination module is used to determine abnormal alarm data in the log data and determine the target orchestration diagnosis task according to the abnormal alarm data;

[0018] The diagnosis result generation and data display module is used to diagnose abnormal alarm data based on the target arrangement diagnosis task to generate diagnosis results, and display the diagnosis results, where the diagnosis results include single fault diagnosis results and comprehensive fault diagnosis results.

[0019] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0020] at least one processor;

[0021] and a memory communicatively coupled to the at least one processor;

[0022] The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute a log diagnosis method based on process orchestration described in any embodiment of the present invention.

[0023] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement a log diagnosis method based on process orchestration described in any embodiment of the present invention when executed.

[0024] The technical solution of the embodiment of the present invention can comprehensively cover the information required for diagnosis and clarify the process planning of diagnosis through diagnostic process arrangement, provide a basis for subsequent accurate diagnosis, and ensure the systematic and orderly nature of diagnostic work. It improves the development efficiency of the diagnostic process and can adapt to complex and changeable operation and maintenance scenarios. Through visual display, users can understand the fault situation intuitively and clearly, which helps to make decisions quickly and take corresponding repair measures, and improves the timeliness and effectiveness of fault handling.

[0025] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0026] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0027] Figure 1 is a flow chart of a log diagnosis method based on process orchestration provided according to Embodiment 1 of the present invention;

[0028] Figure 2 is a flow chart of another log diagnosis method based on process orchestration provided according to Embodiment 2 of the present invention;

[0029] Figure 3 is a structural diagram of a log diagnosis device based on process orchestration provided according to Embodiment 3 of the present invention;

[0030] Figure 4 It is a structural schematic diagram of an electronic device for implementing a log diagnosis method based on process orchestration according to an embodiment of the present invention. DETAILED DESCRIPTION

[0031] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0032] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0033] Embodiment 1

[0034] Figure 1 A flow chart of a log diagnosis method based on process arrangement is provided for the first embodiment of the present invention. This embodiment is applicable to the situation where multiple targets such as hosts, containers and networks are monitored simultaneously. The method can be executed by a log diagnosis device, which can be implemented in the form of hardware and / or software, and can be configured in a computer controller. Figure 1 As shown, the method includes:

[0035] S110: Obtain log data and obtain an orchestration diagnosis task, wherein the orchestration diagnosis task includes a parallel diagnosis process and a serial diagnosis process.

[0036] Among them, log data refers to the recorded information automatically generated by the business system or application during operation, which contains details such as time, operation, status, error, etc., and can be used to track and analyze the performance of the business system. The orchestration of diagnostic tasks refers to the set of tasks after the diagnostic process and steps are orchestrated. The parallel diagnostic process refers to multiple query statements being executed simultaneously, each operating independently, which can make full use of computing resources and speed up the diagnosis. The serial diagnostic process refers to executing query statements in sequence.

[0037] Specifically, the orchestration diagnostic task is a pre-set diagnostic process based on the architecture of the business system and possible problems. Among them, the parallel diagnostic process is based on the principle of parallel computing, and multiple independent diagnostic subtasks are simultaneously assigned to different computing resources for processing. The serial diagnostic process follows the principle of sequential execution and executes the diagnostic steps in a certain order. For example, in the software dependency relationship, the status of the front module must be checked first before the subsequent modules that depend on it can be diagnosed.

[0038] Optionally, obtaining log data includes: determining a business data collection address of a current monitoring platform; performing text collection on the business data collection address by a specified collection method to obtain collected data; and storing the collected data in a specified storage address to generate log data.

[0039] Specifically, the current monitoring platform can determine the business data collection address according to the business configuration. The business data collection address can be each business layer connected to the current monitoring platform, such as SAAS layer, PAAS layer and IAAS layer. The specified collection method can be text collection, kafka collection and API connection. The specified storage address can be the storage engine beaver.

[0040] Optionally, obtaining the orchestration diagnostic task includes: obtaining each first query statement and directly generating a parallel diagnostic process based on each first query statement; obtaining each second query statement and its corresponding step number, and combining each second query statement according to the step number to generate a serial diagnostic process.

[0041] Among them, the first query statement is a query statement entered by the user for the parallel diagnostic process, and the second query statement is a query statement entered by the user for the serial diagnostic process. The query statement can be an SPL query operator. The SPL query operator predefines the connection information of the beaver and can read the status data of the sub-steps that need to be diagnosed from the beaver library. The user can customize the scheduling task according to the diagnostic needs.

[0042] S120: Determine abnormal alarm data in the log data, and determine a target orchestration diagnosis task according to the abnormal alarm data.

[0043] The abnormal alarm data refers to the abnormal data in the log data that triggers the alarm mechanism. The target orchestration diagnostic task refers to the diagnostic task process that needs to be specifically executed based on the detected abnormal alarm data.

[0044] Specifically, the controller will use the principles of data analysis and pattern recognition to determine abnormal alarm data from the large amount of log data it obtains. Specifically, it can identify data that deviates from the normal range or presents abnormal patterns as abnormal alarm data by setting thresholds, comparing the distribution characteristics of historical data, and using statistical analysis methods.

[0045] Optionally, determining abnormal alarm data in the log data includes: obtaining an alarm trigger item and scanning the log data at a specified time interval; when the scanning process triggers the alarm trigger item, using data in the log data corresponding to the alarm trigger item as abnormal alarm data.

[0046] Specifically, the alarm trigger item refers to the pre-set conditions based on the normal operating parameters, thresholds and business rules of the system. The controller can scan the log data at a specified time interval. Specifically, the entire diagnostic process can be triggered by adding a data source. For example, the data source can be a scheduled task that triggers a scan every 20 seconds. The scan content is whether the diagnostic value is triggered.

[0047] It should be noted that the setting of the specified time interval needs to comprehensively consider the system performance, data volume, and the timeliness of the response to exceptions. If the time interval is too short, it may cause excessive consumption of system resources; if the time interval is too long, it may cause delays in the discovery of exceptions.

[0048] Furthermore, during the scanning process, when a situation that meets the alarm trigger items is encountered, an alarm will be triggered. That is, the controller will compare and match the currently scanned log data with the preset alarm trigger items. If certain features, values ​​or patterns in the log data match the alarm trigger items, it means that an abnormal situation has occurred. For example, the alarm trigger item may be set to when the CPU usage of the server exceeds 80% for more than 5 minutes. Then, when scanning the log data, if it is found that the CPU usage records exceed 80% in a continuous period of time, the log data corresponding to this period will be identified as abnormal alarm data.

[0049] Optionally, determining a target orchestration diagnosis task according to abnormal alarm data includes: determining a target data type corresponding to the abnormal alarm data; obtaining an alarm trigger configuration list, wherein the alarm trigger configuration list includes a diagnosis type corresponding to each data type, and the diagnosis type includes a single fault diagnosis and a comprehensive fault diagnosis; matching the target data type through the alarm trigger configuration list to obtain a target diagnosis type corresponding to the abnormal alarm data; when the target diagnosis type is a single fault diagnosis, determining that the target orchestration diagnosis task is a parallel diagnosis process; when the target diagnosis type is a comprehensive fault diagnosis, determining that the target orchestration diagnosis task is a serial diagnosis process.

[0050] Specifically, in the process of determining the target orchestration diagnosis task according to the abnormal alarm data, the target data type corresponding to the abnormal alarm data must first be determined. For example, network traffic data, server performance data, application error log, etc. Then, the target data type is matched through the alarm trigger configuration list. The alarm trigger configuration list contains the diagnosis type corresponding to each data type. When the target diagnosis type is single fault diagnosis, the target orchestration diagnosis task is determined to be a parallel diagnosis process. This is because single faults are usually relatively independent, and there is no strict sequence and dependency between the various diagnostic steps. Based on the principle of parallel computing, detecting and diagnosing multiple possible fault points at the same time can improve the diagnosis efficiency and quickly locate and solve the problems of a single component or module. When the target diagnosis type is comprehensive fault diagnosis, the target orchestration diagnosis task is determined to be a serial diagnosis process. Comprehensive faults often involve complex interactions and associations between multiple components or systems, and need to be checked and analyzed step by step in a certain logical order. Following the principle of serial processing, the result of the previous diagnostic step may affect the decision and execution of the subsequent steps, thereby ensuring that the comprehensive root cause of the fault in the system is found comprehensively and accurately.

[0051] S130, diagnose the abnormal alarm data based on the target arrangement diagnosis task to generate a diagnosis result, and display the diagnosis result, wherein the diagnosis result includes a single fault diagnosis result and a comprehensive fault diagnosis result.

[0052] Specifically, the way to display diagnostic results is based on the principle of information visualization, presenting complex diagnostic data to users in the form of intuitive and clear charts, reports or real-time monitoring interfaces. For example, using bar charts to display the frequency of occurrence of different fault types, using line charts to display the development trend of faults, etc., so that users can quickly and accurately understand the diagnostic results, so as to make corresponding decisions and take effective measures.

[0053] Optionally, diagnosing the abnormal alarm data based on the target orchestration diagnosis task to generate a diagnosis result includes: diagnosing the abnormal alarm data according to each query statement in the target orchestration diagnosis task to obtain each sub-diagnosis result; obtaining a comprehensive diagnosis expression, and inputting each sub-diagnosis result into the comprehensive diagnosis expression to determine the diagnosis result.

[0054] Specifically, the controller will diagnose the abnormal alarm data according to each query statement in the target orchestration diagnosis task to obtain each sub-diagnosis result. Through the query operation of the database, the abnormal alarm data is accurately screened and extracted to obtain the sub-diagnosis results related to each query statement. The comprehensive diagnostic expression is usually an algorithm built based on logical operations, which comprehensively considers the relationship and weight between each sub-diagnosis result. The comprehensive diagnostic expression may contain logical AND, OR, NOT operations, as well as weighted summation, threshold judgment and other operations.

[0055] For example, if the comprehensive diagnosis expression stipulates that when sub-diagnosis results A and B are both true, and sub-diagnosis result C is false, the final diagnosis result is "serious fault"; otherwise, it is "general fault". Then, the obtained sub-diagnosis results A, B, and C are substituted into this expression, and calculations and judgments are performed according to the preset logical rules to finally obtain an accurate diagnosis result.

[0056] It should be noted that logical operations play a key role in comprehensive diagnostic expressions. Common logical operations include "AND", "OR", and "NOT". AND operations require that multiple conditions are met at the same time to get a true result. For example, when diagnosing a system failure, it may be stipulated that the system is considered to be at high load risk (the result is true) only when the server's memory usage exceeds 80% (condition A) and the CPU usage exceeds 70% (condition B). This means that the result of the "AND" operation is true only when both conditions A and B are met at the same time. The result of the OR operation is true as long as at least one of the multiple conditions is met. For example, when detecting network failures, if the network delay exceeds 100 milliseconds (condition C) or the packet loss rate exceeds 5% (condition D), it is determined that the network has performance problems (the result is true). As long as one of C or D is met, the result of the "OR" operation is true. The NOT operation negates a single condition. For example, if it is originally stipulated that a temperature below 50 degrees Celsius is normal (condition E), then "non-E" means that the temperature is not lower than 50 degrees Celsius, that is, a temperature higher than or equal to 50 degrees Celsius is abnormal.

[0057] In a specific implementation, the decision rules may include setting thresholds, priorities, weights, etc. The threshold rule refers to setting a specific numerical limit for a parameter or condition, and exceeding or falling below the limit triggers the corresponding diagnostic result. For example, the hard disk remaining space below 10% is set as the threshold for issuing an alarm. The priority rule is used to determine the order of processing when multiple conditions exist at the same time. For example, when insufficient memory and hard disk read and write errors occur at the same time, if insufficient memory has a higher priority, memory-related problems are processed first. The weight rule assigns different levels of importance to different conditions or sub-diagnostic results. For example, when evaluating system stability, the weight of CPU utilization may be 40%, the weight of memory utilization may be 30%, and the weight of network bandwidth utilization may be 30%. The final diagnostic result is obtained through weighted calculation.

[0058] In summary, by gradually querying and extracting sub-diagnosis results and integrating and judging through comprehensive diagnostic expressions, comprehensive and accurate diagnostic results can be generated from complex abnormal alarm data, providing strong support for subsequent fault handling and system optimization.

[0059] The technical solution of the embodiment of the present invention can comprehensively cover the information required for diagnosis and clarify the process planning of diagnosis through diagnostic process arrangement, provide a basis for subsequent accurate diagnosis, and ensure the systematic and orderly nature of diagnostic work. It improves the development efficiency of the diagnostic process and can adapt to complex and changeable operation and maintenance scenarios. Through visual display, users can understand the fault situation intuitively and clearly, which helps to make decisions quickly and take corresponding repair measures, and improves the timeliness and effectiveness of fault handling.

[0060] Embodiment 2

[0061] Figure 2 This is a flow chart of a log diagnosis method based on process arrangement provided in the second embodiment of the present invention. This embodiment adds a specific process of displaying the diagnosis results on the basis of the above-mentioned first embodiment. Among them, the specific contents of steps S210-S220 are roughly the same as steps S110-S120 in the first embodiment, so they will not be repeated in this embodiment. Figure 2 As shown, the method includes:

[0062] S210: Obtain log data and obtain an orchestration diagnosis task, wherein the orchestration diagnosis task includes a parallel diagnosis process and a serial diagnosis process.

[0063] Optionally, obtaining log data includes: determining a business data collection address of a current monitoring platform; performing text collection on the business data collection address by a specified collection method to obtain collected data; and storing the collected data in a specified storage address to generate log data.

[0064] Optionally, obtaining the orchestration diagnostic task includes: obtaining each first query statement and directly generating a parallel diagnostic process based on each first query statement; obtaining each second query statement and its corresponding step number, and combining each second query statement according to the step number to generate a serial diagnostic process.

[0065] S220: Determine abnormal alarm data in the log data, and determine a target orchestration diagnosis task according to the abnormal alarm data.

[0066] Optionally, determining abnormal alarm data in the log data includes: obtaining an alarm trigger item and scanning the log data at a specified time interval; when the scanning process triggers the alarm trigger item, using data in the log data corresponding to the alarm trigger item as abnormal alarm data.

[0067] Optionally, determining a target orchestration diagnosis task according to abnormal alarm data includes: determining a target data type corresponding to the abnormal alarm data; obtaining an alarm trigger configuration list, wherein the alarm trigger configuration list includes a diagnosis type corresponding to each data type, and the diagnosis type includes a single fault diagnosis and a comprehensive fault diagnosis; matching the target data type through the alarm trigger configuration list to obtain a target diagnosis type corresponding to the abnormal alarm data; when the target diagnosis type is a single fault diagnosis, determining that the target orchestration diagnosis task is a parallel diagnosis process; when the target diagnosis type is a comprehensive fault diagnosis, determining that the target orchestration diagnosis task is a serial diagnosis process.

[0068] S230: diagnose the abnormal alarm data based on the target scheduling diagnosis task to generate a diagnosis result.

[0069] Optionally, diagnosing the abnormal alarm data based on the target orchestration diagnosis task to generate a diagnosis result includes: diagnosing the abnormal alarm data according to each query statement in the target orchestration diagnosis task to obtain each sub-diagnosis result; obtaining a comprehensive diagnosis expression, and inputting each sub-diagnosis result into the comprehensive diagnosis expression to determine the diagnosis result.

[0070] S240: Acquire a data display template, and determine each extraction keyword corresponding to the data display template.

[0071] Specifically, in the process of displaying the diagnosis results, it is necessary to first obtain the data display template. The data display template is a pre-set format based on the type of diagnosis results, relevant specifications and user needs. Its role is to provide a clear, unified and easy-to-understand framework structure for subsequent data display. Extracting keywords refers to the representative and important identifiers screened from a large amount of diagnosis data. By extracting keywords, the core content of the diagnosis results can be accurately reflected.

[0072] S250 , extracting data from the diagnosis results according to the extraction keywords to generate various extracted data, and determining the target position corresponding to each extracted data in the data display template.

[0073] Specifically, the controller will extract data from the diagnosis results according to each extraction keyword to generate each extracted data. That is, the original diagnosis results are processed and screened through the set algorithms and rules to obtain standard and effective extracted data. Then, the controller will determine the corresponding target position of each extracted data in the data display template. Through reasonable mapping and matching, the extracted data can be accurately filled into the corresponding position of the data display template.

[0074] S260: Combining the extracted data with the data presentation template based on the target location to generate presentation data.

[0075] Specifically, the controller can combine the extracted data and the data display template based on the target location to generate display data, thereby forming a complete, orderly and logically structured data display unit. The combination process not only needs to consider the accuracy and completeness of the data, but also ensure that the format of the display data is standardized, beautiful and easy to read.

[0076] S270. Display the display data through a visualization tool.

[0077] Specifically, visualization tools can present complex data to users in intuitive forms such as charts, graphs, and tables. Visualization tools can help users understand and analyze data more quickly and clearly. For example, bar charts can be used to compare the size of data in different categories; line charts are suitable for showing the changing trend of data; and pie charts can intuitively present the proportion of each part of the data in the whole. Through visualization tools, users can more easily obtain key information in the diagnosis results and make accurate judgments and decisions.

[0078] The technical solution of the embodiment of the present invention can comprehensively cover the information required for diagnosis and clarify the process planning of diagnosis through diagnostic process arrangement, provide a basis for subsequent accurate diagnosis, and ensure the systematic and orderly nature of diagnostic work. It improves the development efficiency of the diagnostic process and can adapt to complex and changeable operation and maintenance scenarios. Through visual display, users can understand the fault situation intuitively and clearly, which helps to make decisions quickly and take corresponding repair measures, and improves the timeliness and effectiveness of fault handling.

[0079] Embodiment 3

[0080] Figure 3 This is a schematic diagram of the structure of a log diagnosis device based on process arrangement provided by the third embodiment of the present invention. Figure 3As shown, the device includes: a log data and diagnostic task acquisition module 310, which is used to acquire log data and acquire an orchestrated diagnostic task, wherein the orchestrated diagnostic task includes a parallel diagnostic process and a serial diagnostic process;

[0081] The target orchestration diagnosis task determination module 320 is used to determine the abnormal alarm data in the log data, and determine the target orchestration diagnosis task according to the abnormal alarm data;

[0082] The diagnosis result generation and data display module 330 is used to diagnose the abnormal alarm data based on the target arrangement diagnosis task to generate the diagnosis result, and display the diagnosis result, wherein the diagnosis result includes the single fault diagnosis result and the comprehensive fault diagnosis result.

[0083] Optionally, the log data and diagnostic task acquisition module 310 specifically includes: a log data acquisition unit, used to: determine the business data collection address of the current monitoring platform; perform text collection on the business data collection address through a specified collection method to obtain collection data; and store the collection data to a specified storage address to generate log data.

[0084] Optionally, the log data and diagnostic task acquisition module 310 specifically includes: an orchestration diagnostic task acquisition unit, used to: including: obtaining each first query statement, and directly generating a parallel diagnostic process based on each first query statement; obtaining each second query statement and its corresponding step number, and combining each second query statement according to the step number to generate a serial diagnostic process.

[0085] Optionally, the target orchestration diagnostic task determination module 320 specifically includes: an abnormal alarm data unit, which is used to: obtain an alarm trigger item and scan the log data at a specified time interval; when the scanning process triggers the alarm trigger item, the data corresponding to the alarm trigger item in the log data is used as abnormal alarm data.

[0086] Optionally, the target orchestration diagnosis task determination module 320 specifically includes: a target orchestration diagnosis task determination unit, which is used to: determine the target data type corresponding to the abnormal alarm data; obtain an alarm trigger configuration list, wherein the alarm trigger configuration list includes the diagnosis type corresponding to each data type, and the diagnosis type includes single fault diagnosis and comprehensive fault diagnosis; match the target data type through the alarm trigger configuration list to obtain the target diagnosis type corresponding to the abnormal alarm data; when the target diagnosis type is single fault diagnosis, determine that the target orchestration diagnosis task is a parallel diagnosis process; when the target diagnosis type is comprehensive fault diagnosis, determine that the target orchestration diagnosis task is a serial diagnosis process.

[0087] Optionally, the diagnosis result generation and data display module 330 specifically includes: a diagnosis result generation unit, used to: diagnose the abnormal alarm data according to each query statement in the target arrangement diagnosis task to obtain each sub-diagnosis result; obtain a comprehensive diagnosis expression, and input each sub-diagnosis result into the comprehensive diagnosis expression to determine the diagnosis result.

[0088] Optionally, the diagnosis result generation and data display module 330 specifically includes: a data display unit, which is used to: obtain a data display template, and determine each extraction keyword corresponding to the data display template; perform data extraction on the diagnosis result according to each extraction keyword to generate each extracted data, and determine the target position corresponding to each extracted data in the data display template; combine the extracted data and the data display template based on the target position to generate display data; and display the display data through a visualization tool.

[0089] The technical solution of the embodiment of the present invention can comprehensively cover the information required for diagnosis and clarify the process planning of diagnosis through diagnostic process arrangement, provide a basis for subsequent accurate diagnosis, and ensure the systematic and orderly nature of diagnostic work. It improves the development efficiency of the diagnostic process and can adapt to complex and changeable operation and maintenance scenarios. Through visual display, users can understand the fault situation intuitively and clearly, which helps to make decisions quickly and take corresponding repair measures, and improves the timeliness and effectiveness of fault handling.

[0090] A log diagnosis device based on process orchestration provided by an embodiment of the present invention can execute a log diagnosis method based on process orchestration provided by any embodiment of the present invention, and has functional modules and beneficial effects corresponding to the execution method.

[0091] Embodiment 4

[0092] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital assistants, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0093] like Figure 4As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0094] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0095] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as a log diagnosis method based on process orchestration.

[0096] In some embodiments, a log diagnostic method based on process orchestration may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the log diagnostic method based on process orchestration described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute a log diagnostic method based on process orchestration in any other appropriate manner (e.g., by means of firmware).

[0097] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0098] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0099] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0100] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0101] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0102] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0103] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0104] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A log diagnosis method based on process orchestration, characterized in that: include: Obtaining log data and obtaining an orchestration diagnosis task, wherein the orchestration diagnosis task includes a parallel diagnosis process and a serial diagnosis process; Determine abnormal alarm data in the log data, and determine a target orchestration diagnosis task according to the abnormal alarm data; The abnormal alarm data is diagnosed based on the target scheduling diagnosis task to generate a diagnosis result, and the diagnosis result is displayed, wherein the diagnosis result includes a single fault diagnosis result and a comprehensive fault diagnosis result.

2. The method according to claim 1, characterized in that The obtaining of log data includes: Determine the business data collection address of the current monitoring platform; Performing text collection on the business data collection address by specifying a collection method to obtain collection data; The collected data is stored in a designated storage address to generate the log data.

3. The method according to claim 1, characterized in that The obtaining and arranging diagnosis tasks includes: Obtain each first query statement, and directly generate the parallel diagnosis process according to each first query statement; Each second query statement and its corresponding step number are obtained, and each second query statement is combined according to the step number to generate the serial diagnosis process.

4. The method according to claim 2, characterized in that: The determining of abnormal alarm data in the log data includes: Obtaining alarm trigger items and scanning the log data at specified time intervals; When the scanning process triggers the alarm triggering item, the data corresponding to the alarm triggering item in the log data is used as abnormal alarm data.

5. The method according to claim 4, characterized in that The step of determining a target scheduling diagnosis task according to the abnormal alarm data includes: Determine the target data type corresponding to the abnormal alarm data; Obtaining an alarm trigger configuration list, wherein the alarm trigger configuration list includes a diagnosis type corresponding to each data type, and the diagnosis type includes a single fault diagnosis and a comprehensive fault diagnosis; Matching the target data type through the alarm trigger configuration list to obtain a target diagnosis type corresponding to the abnormal alarm data; When the target diagnosis type is single-body fault diagnosis, determining that the target arrangement diagnosis task is a parallel diagnosis process; When the target diagnosis type is comprehensive fault diagnosis, the target scheduled diagnosis task is determined to be a serial diagnosis process.

6. The method according to claim 3, characterized in that The diagnosing the abnormal alarm data based on the target-based arrangement of the diagnosis task to generate a diagnosis result includes: Diagnose the abnormal alarm data according to each query statement in the target arrangement diagnosis task to obtain each sub-diagnosis result; A comprehensive diagnostic expression is obtained, and each of the sub-diagnosis results is input into the comprehensive diagnostic expression to determine a diagnostic result.

7. The method according to claim 1, characterized in that The presenting of the diagnosis result comprises: Acquire a data display template, and determine each extraction keyword corresponding to the data display template; Extracting data from the diagnosis results according to the extraction keywords to generate extracted data, and determining a target position corresponding to each extracted data in the data display template; combining the extracted data with the data presentation template based on the target location to generate presentation data; The display data is displayed through a visualization tool.

8. A log diagnosis device based on process arrangement, characterized in that: include: A log data and diagnostic task acquisition module, used to acquire log data and obtain an orchestration diagnostic task, wherein the orchestration diagnostic task includes a parallel diagnostic process and a serial diagnostic process; a target orchestration diagnosis task determination module, configured to determine abnormal alarm data in the log data, and determine a target orchestration diagnosis task according to the abnormal alarm data; A diagnosis result generation and data display module is used to diagnose the abnormal alarm data based on the target arrangement diagnosis task to generate a diagnosis result, and to display the diagnosis result, wherein the diagnosis result includes a single fault diagnosis result and a comprehensive fault diagnosis result.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively coupled to the at least one processor; The memory stores a computer program that can be executed by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method according to any one of claims 1 to 7.

10. A computer storage medium, characterized in that: The computer storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method according to any one of claims 1 to 7 when executed.

Images