System exception positioning notification method and device, computer equipment and storage medium

Abstract

The invention belongs to the technical field of computers, and relates to a system exception positioning notification method and device, computer equipment and a storage medium, and the method comprises the steps: obtaining complete log information; log extraction parameters are obtained, target log information is obtained through screening, multi-channel log analysis and integration are carried out, and a target analysis result is obtained; obtaining abnormal feature information and abnormal stack information according to the target analysis result, obtaining code features based on the abnormal feature information, and accessing a code warehouse based on the abnormal stack information and the code features to position abnormal codes and positions thereof; obtaining code replacement historical data of the abnormal code to position developer information before the abnormality occurs, and taking a corresponding developer as a target object; and rating the exception according to the target analysis result, generating notification information according to the rating, the exception code and the position of the exception code, and sending the notification information to the target object. According to the invention, targeted notification and reminding can be carried out, and the abnormal problem solving efficiency is improved.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, and specifically relates to a system abnormality location notification method, device, computer equipment, and storage medium. Background Art

[0002] For software operation and maintenance tools, system exception location and notification management are required to help system administrators and relevant responsible personnel to promptly discover, locate and resolve system exceptions to ensure the stability and safe operation of the system. Existing system exceptions rely on parsing system logs to determine exceptions, but the log parsing process is simple, with low accuracy, and cannot be targeted at specific objects for exception handling. Summary of the invention

[0003] The purpose of the embodiments of the present application is to propose a system exception location notification method, device, computer equipment, and storage medium to solve the problems in the prior art that the log parsing process is simple, the accuracy is low, and it is impossible to provide specific objects with targeted exception handling.

[0004] In order to solve the above technical problems, the embodiment of the present application provides a system abnormality location notification method, which adopts the following technical solution:

[0005] A system abnormality location notification method, comprising:

[0006] Obtaining log information of the target system, determining the integrity of the log information, re-obtaining it if it is incomplete, and temporarily storing the complete log information at the target location;

[0007] Obtaining log extraction parameters, screening target log information from the target location according to the log extraction parameters, performing multi-channel log analysis on the target log information, and integrating the multi-channel analysis results to obtain a target analysis result;

[0008] Acquire exception feature information according to the target parsing result, acquire code features based on the exception feature information, read exception stack information corresponding to the exception feature information, and access the code repository based on the exception stack information and the code features to locate the exception code and its position;

[0009] Obtain code change history data of the abnormal code, locate the developer information before the abnormality occurs based on the code change history data, and take the corresponding developer as the target object;

[0010] The anomaly is rated according to the target parsing result, notification information is generated according to the rating, the anomaly code and its location, and the notification information is sent to the target object.

[0011] Furthermore, the step of performing multi-channel log parsing on the target log information includes:

[0012] A distributed computing framework is used to perform multi-channel parallel analysis on the target log information, log features are extracted from the time dimension, space dimension, and business dimension, and a multi-channel analysis result is obtained;

[0013] Before the step of integrating the multi-channel analysis results, the method further includes:

[0014] The initial multi-channel analysis results are cross-validated with the historical abnormal data, and similarity calculation is used to determine whether there is a disagreement. If there is a disagreement, the target log information is re-parsed, and special invalid information is iteratively eliminated until there is no disagreement between the multi-channel analysis results and the historical abnormal data, thereby obtaining the final multi-channel analysis results.

[0015] Furthermore, before the step of sending the notification information to the target object, the method further includes:

[0016] Accessing an abnormal case library according to the abnormal characteristic information, searching in the abnormal case library whether there is a processing solution corresponding to the abnormal characteristic information, and if so, adding the processing solution to the notification information;

[0017] After the step of sending the notification information to the target object, the method further includes: in the process of the target processing handling the exception, recording log information, location information of the exception, original code information causing the exception and corresponding processing method, obtaining a new processing solution and storing it in the exception case library.

[0018] Furthermore, the step of obtaining log extraction parameters and screening target log information from the target location according to the log extraction parameters includes:

[0019] According to the preset log extraction parameters, original log information is obtained from the target location, and the log content that meets the log extraction parameters is screened out by using a regular expression matching method to obtain preliminary target log information;

[0020] The preliminary target log information is filtered twice, and the keyword score of each log is calculated by setting the keyword weight. If the score exceeds the set threshold, the log is retained, otherwise it is removed to obtain accurate target log information.

[0021] Further, the step of accessing the code repository based on the exception stack information and the code features to locate the exception code and its position includes:

[0022] Accessing a code repository according to the code features;

[0023] Determine the exception code file name and code line number according to the exception stack information, construct an exception code location rule according to the exception code file name, and generate an exception code query condition;

[0024] A distributed computing framework is used to perform parallel search on the code repository, and the abnormal code query condition is used to match the code files in the code repository to obtain a list of suspected abnormal code files;

[0025] Perform secondary filtering on the suspected abnormal code file list, extract the features of each file in the suspected abnormal code file list through static code analysis technology, and calculate the similarity with the abnormal stack information. If the similarity exceeds the set threshold, it is determined to be an abnormal code file;

[0026] According to the code line number, the abnormal code and the specific position of the abnormal code in the abnormal code file are located to generate an abnormal code location result.

[0027] Furthermore, the step of obtaining the code change history data of the abnormal code, locating the developer information before the abnormality occurred based on the code change history data, and taking the corresponding developer as the target object includes:

[0028] Obtaining, through the API interface of the code repository, the version change history data of the code, wherein the version change history data at least includes the code submission record, the developer and the submission time;

[0029] According to the time point when the exception occurred, a search is performed in the iteration history data to locate multiple code submission records before the exception occurred;

[0030] Determine whether the interval between the submission time of each code submission record and the time point when the exception occurred exceeds a set time threshold, and mark the code submission record whose time interval is less than the set time threshold as a suspected exception introduction point;

[0031] Obtain developer information of suspected anomaly introduction points, calculate weighted scores for developers based on their code submission frequency, submitted code volume, and historical anomaly rate, and identify developers whose scores exceed the set score threshold as target objects.

[0032] Furthermore, the step of rating the anomaly according to the target parsing result, generating notification information according to the rating, the anomaly code and its location, and sending the notification information to the target object includes:

[0033] Determine the severity and impact of the anomaly based on the target analysis results, use the rule engine to grade the anomaly and obtain the anomaly rating results;

[0034] Match the preset notification method strategy based on the abnormal rating results to determine the appropriate notification channel;

[0035] Extract key segments of the exception code and location information of the key segments and automatically construct exception notification information using natural language generation technology;

[0036] The generated exception notification information is matched with the notification channel, and the target object is distributed through the message queue of the notification channel.

[0037] In order to solve the above technical problems, the embodiment of the present application also provides a system abnormality location notification device, which adopts the following technical solution:

[0038] A system abnormality positioning notification device, the device comprising:

[0039] A log acquisition module is used to acquire the log information of the target system, determine the integrity of the log information, re-acquire if it is incomplete, and temporarily store the complete log information at the target location;

[0040] A log parsing module, used to obtain log extraction parameters, screen target log information from the target location according to the log extraction parameters, perform multi-channel log parsing on the target log information, and integrate the multi-channel parsing results to obtain a target parsing result;

[0041] An exception locating module is used to obtain exception feature information according to the target parsing result, obtain code features based on the exception feature information, read exception stack information corresponding to the exception feature information, and access the code repository based on the exception stack information and the code features to locate the exception code and its position;

[0042] An object determination module is used to obtain the code change history data of the abnormal code, locate the developer information before the abnormality occurs based on the code change history data, and take the corresponding developer as the target object;

[0043] A notification sending module rates the anomaly according to the target parsing result, generates notification information according to the rating, the anomaly code and its location, and sends the notification information to the target object.

[0044] In order to solve the above technical problems, the embodiment of the present application further provides a computer device, which adopts the following technical solution:

[0045] A computer device comprises a memory and a processor, wherein the memory stores computer-readable instructions, and when the processor executes the computer-readable instructions, the steps of the system abnormality location notification method as described in any one of the above are implemented.

[0046] In order to solve the above technical problems, the embodiment of the present application further provides a computer-readable storage medium, which adopts the following technical solution:

[0047] A computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the steps of the system abnormality location notification method as described in any one of the above.

[0048] Compared with the prior art, the embodiments of the present application have the following beneficial effects:

[0049] This application obtains exception feature information by performing multi-channel analysis on the complete log information, and then determines the exception code based on the exception feature information. By obtaining the code change history data of the exception code, the developer information before the exception occurred can be traced back, and targeted notifications and reminders can be made to improve the efficiency of solving exception problems and ensure the convenience of exception management. BRIEF DESCRIPTION OF THE DRAWINGS

[0050] In order to more clearly illustrate the scheme in the present application, a brief introduction is given below to the drawings required for use in the description of the embodiments of the present application. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0051] Figure 1 is an exemplary system architecture diagram to which the present application may be applied;

[0052] Figure 2 A flowchart of an embodiment of the system abnormality location notification method of the present application;

[0053] Figure 3 A schematic diagram of the structure of an embodiment of the system abnormality location notification device of the present application;

[0054] Figure 4 A schematic diagram of the structure of a computer device according to an embodiment of the present application. DETAILED DESCRIPTION

[0055] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as those commonly understood by technicians in the technical field of the present application; the terms used in the specification of the application herein are only for the purpose of describing specific embodiments and are not intended to limit the present application; the terms "including" and "having" and any variations thereof in the specification and claims of the present application and the above-mentioned drawings are intended to cover non-exclusive inclusions. The terms "first", "second", etc. in the specification and claims of the present application or the above-mentioned drawings are used to distinguish different objects, not to describe a specific order.

[0056] Reference to "embodiments" herein means that a particular feature, structure, or characteristic described in conjunction with the embodiments may be included in at least one embodiment of the present application. The appearance of the phrase in various locations in the specification does not necessarily refer to the same embodiment, nor is it an independent or alternative embodiment that is mutually exclusive with other embodiments. It is explicitly and implicitly understood by those skilled in the art that the embodiments described herein may be combined with other embodiments.

[0057] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the accompanying drawings.

[0058] like Figure 1 As shown, the system architecture 100 may include a terminal device 101, a network 102 and a server 103. The terminal device 101 may be a laptop 1011, a tablet computer 1012 or a mobile phone 1013. The network 102 is used to provide a medium for a communication link between the terminal device 101 and the server 103. The network 102 may include various connection types, such as wired, wireless communication links or optical fiber cables.

[0059] The user can use the terminal device 101 to interact with the server 103 through the network 102 to receive or send messages, etc. Various communication client applications, such as web browser applications, instant messaging tools, etc., can be installed on the terminal device 101.

[0060] The terminal device 101 may be any electronic device having a display screen and supporting web browsing. In addition to a notebook computer 1011 , a tablet computer 1012 or a mobile phone 1013 , the terminal device 101 may also be a laptop computer, a desktop computer, and the like.

[0061] The server 103 may be a server that provides various services, such as a background server that provides support for a web page displayed on the terminal device 101 .

[0062] It should be understood that Figure 1The number of terminal devices 101, networks 102 and servers 103 in the embodiment is only for illustration. Any number of terminal devices 101, networks 102 and servers 103 may be provided according to implementation requirements.

[0063] Continue to refer Figure 2 , shows a flow chart of an embodiment of a method for locating and notifying a system abnormality according to the present application. The method for locating and notifying a system abnormality includes the following steps S201 to S208:

[0064] S201, obtaining log information of a target system, determining the integrity of the log information, re-obtaining the log information if it is incomplete, and temporarily storing the complete log information at a target location;

[0065] S202, obtaining log extraction parameters, screening target log information from the target location according to the log extraction parameters, performing multi-channel log analysis on the target log information, integrating the multi-channel analysis results, and obtaining a target analysis result;

[0066] S203, acquiring abnormal feature information according to the target parsing result, acquiring code features based on the abnormal feature information, reading abnormal stack information corresponding to the abnormal feature information, accessing the code repository based on the abnormal stack information and the code features, so as to locate the abnormal code and its position;

[0067] S204, obtaining code change history data of the abnormal code, locating the developer information before the abnormality occurred based on the code change history data, and taking the corresponding developer as the target object;

[0068] S205, rating the exception according to the target parsing result, generating notification information according to the rating, the exception code and its location, and sending the notification information to the target object.

[0069] This application obtains exception feature information by performing multi-channel analysis on the complete log information, and then determines the exception code based on the exception feature information. By obtaining the code change history data of the exception code, the developer information before the exception occurred can be traced back, and targeted notifications and reminders can be made to improve the efficiency of solving exception problems and ensure the convenience of exception management.

[0070] For step S2O1, when the target system is running, the running process of all programs will be generated into corresponding running logs. The original log information can be obtained from the target system according to the preset log extraction rules to obtain preliminary log information, and the key information of the preliminary log information is screened for integrity. If it is incomplete, the original log information is re-obtained until the complete log information is obtained, and it is temporarily stored in the designated target location. By performing integrity check on the log information, it can be ensured that the log information is intact during transmission and storage. For example, by extracting the log timestamp, the original log information is obtained from the target system, and the log content that meets the extraction parameters is screened to obtain preliminary log information. The log timestamp is used as an identifier to check whether it is continuous, whether the missing rate exceeds 5%, etc. If it is incomplete, it is re-obtained until the complete log information is obtained, and it is temporarily stored in a cache such as Redis.

[0071] For step S202, when obtaining log extraction parameters, the time range, log level, keywords and other screening conditions of the target log can be obtained through configuration files or user interface input, and the target log information is screened from the target location according to these log extraction parameters.

[0072] In one embodiment, the step of obtaining log extraction parameters and screening target log information from the target location according to the log extraction parameters includes:

[0073] According to the preset log extraction parameters, the original log information is obtained from the target location, and the log content that meets the log extraction parameters is screened out by using a regular expression matching method to obtain preliminary target log information; the preliminary target log information is secondary filtered, and the keyword score of each log is calculated by setting keyword weights. If the score exceeds the set threshold, the log is retained, otherwise it is eliminated to obtain accurate target log information.

[0074] In this embodiment, regular expression matching, keyword indexing and other methods can be used to perform targeted extraction from the massive log data at the target location, quickly locate and extract the target log information, and trigger a secondary filtering process for the extracted log information based on the extraction results. Specifically, according to preset log extraction parameters, such as keywords "abnormal", "error", etc., regular expressions can be used to match the frequency of keyword occurrence of each log to perform weighted calculation to obtain the keyword score of each log, and logs with scores exceeding the threshold are retained.

[0075] In one embodiment, the step of performing multi-channel log parsing on the target log information includes: using a distributed computing framework to perform multi-channel parallel parsing on the target log information, extracting log features from the time dimension, space dimension, and business dimension, and obtaining multi-channel parsing results. For example, using a MapReduce distributed computing framework, multi-channel parsing of logs is performed with a preset time length as the time window, a server IP address as the space dimension, and a business module as the business dimension, to extract features such as timestamps, host names, and thread IDs.

[0076] Accordingly, before the step of integrating the multi-channel analysis results, the method further includes: cross-validating the initial multi-channel analysis results with the historical abnormal data, determining whether there is a disagreement by similarity calculation, and if there is a disagreement, re-analyzing the target log information, iteratively eliminating special invalid information, until there is no disagreement between the multi-channel analysis results and the historical abnormal data, thereby obtaining the final multi-channel analysis results.

[0077] In this embodiment, historical abnormal data is obtained, and feature matching is performed between the multi-channel analysis results and the historical abnormal data, and similarity calculation is used to determine whether there is a disagreement. If there is a disagreement in the comparison, the target log information is subjected to a secondary analysis, and special invalid information is excluded through rules, and the iterative process is performed until there is no disagreement between the multi-channel analysis results and the historical abnormal data. Specifically, the analysis results and the historical abnormal data can be vectorized using methods such as TF-IDF and Word2Vec, and cosine similarity calculation is used to determine whether there is a disagreement. If the similarity is lower than a preset value, it is considered that there is a disagreement. For cases where there is a disagreement, a secondary analysis can be performed by constructing an abnormal dictionary, optimizing the analysis rules, etc., and special invalid information such as date format errors and invalid characters is iteratively excluded. Finally, the parsed information is integrated and converted into the system standard format for transmission.

[0078] For step S203, the code features in the code repository are connected through the exception feature information, and the code location that caused the exception is determined by analyzing the file name and line number and other information in the exception stack, and then the code location where the exception occurred in the code repository is located.

[0079] In one embodiment, the step of accessing the code warehouse based on the exception stack information and the code features to locate the abnormal code and its position includes: accessing the code warehouse according to the code features; determining the abnormal code file name and code line number according to the exception stack information, constructing abnormal code location rules according to the abnormal code file name, and generating abnormal code query conditions; using a distributed computing framework to perform parallel retrieval on the code warehouse, using the abnormal code query conditions to match the code files in the code warehouse to obtain a list of suspected abnormal code files; performing secondary filtering on the list of suspected abnormal code files, extracting the features of each file in the list of suspected abnormal code files through static code analysis technology, and performing similarity calculation with the exception stack information. If the similarity exceeds a set threshold, it is determined to be an abnormal code file; locating the abnormal code and the specific position of the abnormal code in the abnormal code file according to the code line number, and generating an abnormal code location result. Specifically, this embodiment uses the MapReduce distributed computing framework to perform parallel retrieval on the code repository, uses the TF-IDF algorithm to calculate the similarity between the query conditions and the code files, selects files with a similarity greater than a preset value as suspected abnormal code files, and then performs static code analysis on the suspected abnormal code files. By extracting code features such as code complexity and cyclomatic complexity, the cosine similarity algorithm is used to calculate the similarity with the exception stack information. If the similarity exceeds the preset value, it is determined to be an abnormal code file, and then the specific position of the abnormal code in the file is located according to the code line number in the exception stack.

[0080] This embodiment automatically accesses the code repository based on exception stack information and code features, and uses a distributed computing framework to perform parallel retrieval of the code repository, which can quickly and accurately locate the specific code line that causes the exception, and at the same time perform secondary filtering on the list of suspected abnormal code files. Through static code analysis technology and similarity calculation, the position of the abnormal code can be accurately located, which can effectively reduce false alarms and improve accuracy.

[0081] For step S204, the person who handles the exception is determined through the code change history record, which facilitates targeted notification reminders at a later stage and ensures the convenience of exception management.

[0082] In one embodiment, the steps of obtaining code iteration history data of the abnormal code, locating the developer information before the abnormality occurs based on the code iteration history data, and taking the corresponding developer as the target object include: obtaining the iteration history data of the code version through the API interface of the code repository, the iteration history data at least including the code submission record, the developer and the submission time; searching in the iteration history data according to the time point when the abnormality occurs, and locating multiple code submission records before the abnormality occurs; determining whether the interval between the submission time of each of the code submission records and the time point when the abnormality occurs exceeds a set time threshold, and marking the code submission record with a time interval less than the set time threshold as a suspected abnormality introduction point; obtaining the developer information of the suspected abnormality introduction point, calculating the weight score for the developer according to the code submission frequency, the amount of submitted code, and the historical abnormality rate, and determining the developer with a score exceeding the set score threshold as the target object.

[0083] Specifically, this embodiment obtains the code version change history data through the API interface provided by the code repository. For example, GitHub, GitLab, Gitee and other code repositories all provide rich API interfaces, which can be used to obtain code submission records, developer information, submission time and other data. The code submission record contains the content of each code change and can trace the code modification history. The developer information can help understand which developers participated in the code modification, and the submission time records the time point when each modification occurred. By calling the API interface, the version history data of a project in a code repository can be easily obtained. According to the time point when the exception occurred, searching in the iteration history data is done to locate the code submission records that may cause the exception. According to the interval between the submission time of the code submission record and the time point when the exception occurred, multiple submission records with an interval less than the set time threshold are obtained and marked as suspected exception introduction points, which effectively narrows the scope of investigation and improves the efficiency of investigation. By analyzing the developer information of the suspected exception introduction point, the developer's code quality is evaluated based on indicators such as the developer's code submission frequency, submitted code volume, and historical exception rate. The developer's weight score is calculated based on these indicators, and then the developer whose score exceeds the set score threshold is identified as the target object based on the developer's weight score. The set score threshold can be adjusted according to the actual situation and the team's code quality standards, thereby quickly locating the developer who may introduce the exception, and conducting subsequent code review and problem troubleshooting.

[0084] As for step S205, this embodiment obtains a target parsing result after parsing, and performs anomaly rating by extracting key information from the result. The anomaly rating can be used to determine the generation mode of the notification.

[0085] In one embodiment, the steps of rating the anomaly according to the target parsing result, generating notification information according to the rating, the anomaly code and its location, and sending the notification information to the target object include: determining the severity and impact range of the anomaly according to the target parsing result, and using a rule engine to perform a graded assessment of the anomaly to obtain an anomaly rating result; matching a preset notification method strategy based on the anomaly rating result to determine an adapted notification channel; extracting key fragments of the anomaly code and the location information of the key fragment, and automatically constructing the anomaly notification information using natural language generation technology; matching the generated anomaly notification information with the notification channel, and distributing the target object through the message queue of the notification channel. Specifically, according to the target parsing result, the dimensional information such as the severity of the anomaly and the scope of influence is extracted, and the rule engine is used to perform a hierarchical evaluation of the anomaly, such as dividing the severity of the anomaly into grades, and dividing the scope of influence into three levels: individual, department, and company. The anomaly rating result is obtained by weighted calculation, and then the preset notification method strategy is matched based on the anomaly rating result, such as the anomaly rating result 1-2 level anomaly uses email notification, the anomaly rating result 3-4 level anomaly uses SMS + email, and the anomaly rating result 5 level anomaly uses phone + SMS + email; then the abnormal code location information in the target parsing result is obtained, and the abnormal code snippet and its context content are accessed through the code warehouse API interface, and the key code snippet is extracted. Combined with the abnormal stack information, abnormal rating and other contents, the sequence-to-sequence model is used to automatically generate abnormal notification information, and finally the generated abnormal notification information is matched and distributed with the notification channel. In addition, the sending status and receiving feedback of the notification information can also be monitored, and the notification that fails to be sent for multiple consecutive times or is not read within a predetermined time is retried or upgraded. This embodiment not only improves the efficiency and accuracy of exception handling, but also optimizes resource allocation.

[0086] In one embodiment, before the step of sending the notification information to the target object, the method further includes: accessing an abnormal case library according to the abnormal feature information, searching the abnormal case library for a processing solution corresponding to the abnormal feature information, and if so, adding the processing solution to the notification information. This embodiment can directly provide a solution in the notification information by searching the processing solution in the abnormal case library in advance, helping developers or other relevant personnel to quickly understand and process the abnormal code, avoiding repeated analysis and resolution processes caused by multiple occurrences of the same or similar problems, saving time and resources, and improving the practicality of the system.

[0087] Correspondingly, after the step of sending the notification information to the target object, the method further includes: in the process of the target processing handling the exception, recording log information, the location information of the exception, the original code information that caused the exception, and the corresponding processing method, obtaining a new processing solution and storing it in the exception case library. Specifically, this embodiment records the processing process on the one hand to obtain a specific processing solution, and on the other hand records log information, the location information of the exception, and the original code information that caused the exception, maps and associates them with the recorded processing solution, generates retrieval keywords and stores them centrally, which can be stored locally or in a cloud server. After the exception is detected later, the historical processing solution stored locally or in the cloud is called by comparing the abnormal features, and the processing solution is sent to the developer synchronously, which can provide a convenient auxiliary solution, speed up the processing efficiency of high-frequency exception codes, and improve the practicality of the system.

[0088] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiments can be implemented by instructing the relevant hardware through a computer program, and the computer program can be stored in a computer-readable storage medium. When the program is executed, it can include the processes of the embodiments of the above-mentioned methods. Among them, the aforementioned storage medium can be a non-volatile storage medium such as a disk, an optical disk, a read-only memory (ROM), or a random access memory (RAM).

[0089] It should be understood that, although the steps in the flowchart of the accompanying drawings are displayed in sequence as indicated by the arrows, these steps are not necessarily executed in sequence in the order indicated by the arrows. Unless otherwise specified herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least a part of the steps in the flowchart of the accompanying drawings may include multiple sub-steps or multiple stages, and these sub-steps or stages are not necessarily executed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be executed in turn or alternately with other steps or at least a part of the sub-steps or stages of other steps.

[0090] Further references Figure 3 , as a response to the above Figure 2 The present application provides an embodiment of a system abnormality location notification device, and the device embodiment is similar to Figure 2 The method embodiment shown corresponds to the embodiment shown in FIG. Figure 3As shown, the system abnormality location notification device described in this embodiment includes: a log acquisition module 301, a log parsing module 302, an abnormality location module 303, an object determination module 304 and a notification sending module 305; wherein:

[0091] The log acquisition module 301 is used to acquire the log information of the target system, determine the integrity of the log information, re-acquire if it is incomplete, temporarily store the complete log information in the target location, acquire log extraction parameters, and screen the target log information from the target location according to the log extraction parameters; the log parsing module 302 is used to perform multi-channel log parsing on the target log information, integrate the multi-channel parsing results, and obtain the target parsing result; the exception positioning module 303 is used to acquire exception feature information according to the target parsing result, acquire code features based on the exception feature information, read the exception stack information corresponding to the exception feature information, access the code repository based on the exception stack information and the code features, so as to locate the exception code and its location; the object determination module 304 is used to acquire the code iteration history data of the exception code, locate the developer information before the exception occurs based on the code iteration history data, and take the corresponding developer as the target object; the notification sending module 305 rates the exception according to the target parsing result, generates notification information according to the rating, the exception code and its location, and sends the notification information to the target object.

[0092] The system exception location notification device provided in the present application obtains exception feature information by performing multi-channel analysis on the complete log information, and then determines the exception code based on the exception feature information. By obtaining the code change history data of the exception code, it can trace back to the developer information before the exception occurred, and provide targeted notifications and reminders, thereby improving the efficiency of solving exception problems and ensuring the convenience of exception management.

[0093] In one embodiment, the log acquisition module 301 acquires log extraction parameters, and when the target log information is screened from the target location according to the log extraction parameters, it is specifically used to: acquire the original log information from the target location according to the preset log extraction parameters, and use regular expression matching to screen out the log content that meets the log extraction parameters to obtain preliminary target log information; perform secondary filtering on the preliminary target log information, calculate the keyword score of each log by setting keyword weights, and if the score exceeds the set threshold, retain the log, otherwise eliminate it to obtain accurate target log information.

[0094] In one embodiment, when the log parsing module 302 performs multi-channel log parsing on the target log information, it is specifically used to: use a distributed computing framework to perform multi-channel parallel parsing on the target log information, extract log features from the time dimension, space dimension, and business dimension, and obtain multi-channel parsing results.

[0095] Accordingly, before the step of integrating the multi-channel analysis results, the log analysis module 302 is also used to: cross-validate the initial multi-channel analysis results with the historical abnormal data, determine whether there is a disagreement through similarity calculation, and if there is a disagreement, re-parse the target log information, iteratively eliminate special invalid information, until there is no disagreement between the multi-channel analysis results and the historical abnormal data, and obtain the final multi-channel analysis results.

[0096] In one embodiment, when the exception location module 303 accesses the code warehouse based on the exception stack information and the code features to locate the exception code and its location, it is specifically used to: access the code warehouse according to the code features; determine the exception code file name and code line number according to the exception stack information, build an exception code location rule according to the exception code file name, and generate an exception code query condition; use a distributed computing framework to perform parallel retrieval on the code warehouse, use the exception code query condition to match the code files in the code warehouse, and obtain a list of suspected exception code files; perform secondary filtering on the list of suspected exception code files, extract the features of each file in the list of suspected exception code files through static code analysis technology, and calculate the similarity with the exception stack information. If the similarity exceeds a set threshold, it is determined to be an abnormal code file; locate the exception code and the specific location of the exception code in the exception code file according to the code line number, and generate an abnormal code location result.

[0097] In one embodiment, the object determination module 304 obtains the code iteration history data of the abnormal code, locates the developer information before the abnormality occurs based on the code iteration history data, and takes the corresponding developer as the target object, which is specifically used to: obtain the version iteration history data of the code through the API interface of the code repository, and the iteration history data at least includes the code submission record, the developer and the submission time; according to the time point when the abnormality occurs, search in the iteration history data to locate multiple code submission records before the abnormality occurs; determine whether the interval between the submission time of each of the code submission records and the time point when the abnormality occurs exceeds a set time threshold, and mark the code submission record with a time interval less than the set time threshold as a suspected abnormality introduction point; obtain the developer information of the suspected abnormality introduction point, calculate the weight score for the developer according to its code submission frequency, submitted code amount, and historical abnormality rate, and determine the developer whose score exceeds the set score threshold as the target object.

[0098] In one embodiment, the notification sending module 305 rates the anomaly according to the target analysis result, generates notification information according to the rating, the anomaly code and its location, and when sending the notification information to the target object, is specifically used to: determine the severity and impact range of the anomaly according to the target analysis result, and use a rule engine to perform a graded assessment of the anomaly to obtain an anomaly rating result; match a preset notification method strategy based on the anomaly rating result to determine an adapted notification channel; extract key fragments of the anomaly code and the location information of the key fragment, and use natural language generation technology to automatically construct the anomaly notification information; match the generated anomaly notification information with the notification channel, and distribute the target object through the message queue of the notification channel.

[0099] In one embodiment, before the notification sending module 305 sends the notification information to the target object, it is also used to: access the abnormal case library according to the abnormal feature information, and search the abnormal case library for a processing solution corresponding to the abnormal feature information; if so, add the processing solution to the notification information.

[0100] Correspondingly, the device also includes a case collection module (not shown), which is used to record log information, location information of the exception, original code information that caused the exception, and corresponding processing methods after the notification sending module 305 sends the notification information to the target object during the process of the target processing handling the exception, obtain a new processing plan and store it in the exception case library.

[0101] It should be noted that the beneficial effects of the system abnormality positioning notification device can be referred to the above method embodiment, which will not be expanded here.

[0102] To solve the above technical problems, the present application also provides a computer device. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0103] The computer device 4 includes a memory 41, a processor 42, and a network interface 43 that are interconnected through a system bus. It should be noted that the figure only shows a computer device 4 having a memory 41, a processor 42, and a network interface 43, but it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented instead. Among them, those skilled in the art can understand that the computer device here is a device that can automatically perform numerical calculations and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to a microprocessor, an application specific integrated circuit (ASIC), a field-programmable gate array (FPGA), a digital processor (DSP), an embedded device, etc.

[0104] The computer device may be a computing device such as a desktop computer, a notebook, a PDA, a cloud server, etc. The computer device may interact with a user through a keyboard, a mouse, a remote controller, a touch pad, or a voice control device.

[0105] The memory 41 includes at least one type of readable storage medium, and the readable storage medium includes flash memory, hard disk, multimedia card, card-type memory (for example, SD or DX memory, etc.), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, disk, optical disk, etc. In some embodiments, the memory 41 can be an internal storage unit of the computer device 4, such as a hard disk or memory of the computer device 4. In other embodiments, the memory 41 can also be an external storage device of the computer device 4, such as a plug-in hard disk equipped on the computer device 4, a smart memory card (Smart Med ia Card, SMC), a secure digital (Secure Digital, SD) card, a flash card (Flash Card), etc. Of course, the memory 41 can also include both the internal storage unit of the computer device 4 and its external storage device. In this embodiment, the memory 41 is generally used to store the operating system and various application software installed on the computer device 4, such as the program code of the system abnormality positioning notification method, etc. In addition, the memory 41 can also be used to temporarily store various types of data that have been output or are to be output.

[0106] The processor 42 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chips in some embodiments. The processor 42 is generally used to control the overall operation of the computer device 4. In this embodiment, the processor 42 is used to run the program code stored in the memory 41 or process data, such as running the program code of the system abnormality location notification method.

[0107] The network interface 43 may include a wireless network interface or a wired network interface. The network interface 43 is generally used to establish a communication connection between the computer device 4 and other electronic devices.

[0108] The present application also provides another embodiment, namely, providing a computer-readable storage medium, wherein the computer-readable storage medium stores computer-readable instructions, and the computer-readable instructions can be executed by at least one processor to enable the at least one processor to perform the steps of the system abnormality location notification method as described above.

[0109] Through the description of the above implementation methods, those skilled in the art can clearly understand that the above-mentioned embodiment methods can be implemented by means of software plus a necessary general hardware platform, and of course by hardware, but in many cases the former is a better implementation method. Based on such an understanding, the technical solution of the present application, or the part that contributes to the prior art, can be embodied in the form of a software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes a number of instructions for a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in each embodiment of the present application.

[0110] Obviously, the embodiments described above are only some embodiments of the present application, rather than all embodiments. The preferred embodiments of the present application are given in the accompanying drawings, but they do not limit the patent scope of the present application. The present application can be implemented in many different forms. On the contrary, the purpose of providing these embodiments is to make the understanding of the disclosure of the present application more thorough and comprehensive. Although the present application is described in detail with reference to the aforementioned embodiments, for those skilled in the art, it is still possible to modify the technical solutions recorded in the aforementioned specific implementation methods, or to perform equivalent replacement of some of the technical features therein. Any equivalent structure made using the contents of the specification and drawings of this application, directly or indirectly used in other related technical fields, is similarly within the scope of patent protection of this application.

Claims

1. A method for notifying system abnormality location, characterized in that: include: Obtaining log information of the target system, determining the integrity of the log information, re-obtaining it if it is incomplete, and temporarily storing the complete log information at the target location; Obtaining log extraction parameters, screening target log information from the target location according to the log extraction parameters, performing multi-channel log analysis on the target log information, and integrating the multi-channel analysis results to obtain a target analysis result; Acquire exception feature information according to the target parsing result, acquire code features based on the exception feature information, read exception stack information corresponding to the exception feature information, and access the code repository based on the exception stack information and the code features to locate the exception code and its position; Obtain code change history data of the abnormal code, locate the developer information before the abnormality occurs based on the code change history data, and take the corresponding developer as the target object; The anomaly is rated according to the target parsing result, notification information is generated according to the rating, the anomaly code and its location, and the notification information is sent to the target object.

2. The system abnormality location notification method according to claim 1, characterized in that: The step of performing multi-channel log parsing on the target log information includes: A distributed computing framework is used to perform multi-channel parallel analysis on the target log information, log features are extracted from the time dimension, space dimension, and business dimension, and a multi-channel analysis result is obtained; Before the step of integrating the multi-channel analysis results, the method further includes: The initial multi-channel analysis results are cross-validated with the historical abnormal data, and similarity calculation is used to determine whether there is a disagreement. If there is a disagreement, the target log information is re-parsed, and special invalid information is iteratively eliminated until there is no disagreement between the multi-channel analysis results and the historical abnormal data, thereby obtaining the final multi-channel analysis results.

3. The system abnormality location notification method according to claim 1 or 2, characterized in that: Before the step of sending the notification information to the target object, the method further includes: Accessing an abnormal case library according to the abnormal characteristic information, searching in the abnormal case library whether there is a processing solution corresponding to the abnormal characteristic information, and if so, adding the processing solution to the notification information; After the step of sending the notification information to the target object, the method further includes: in the process of the target processing handling the exception, recording log information, location information of the exception, original code information causing the exception and corresponding processing method, obtaining a new processing solution and storing it in the exception case library.

4. The system abnormality location notification method according to claim 3, characterized in that: The step of obtaining log extraction parameters and screening target log information from the target location according to the log extraction parameters includes: According to the preset log extraction parameters, original log information is obtained from the target location, and the log content that meets the log extraction parameters is screened out by using a regular expression matching method to obtain preliminary target log information; The preliminary target log information is filtered twice, and the keyword score of each log is calculated by setting the keyword weight. If the score exceeds the set threshold, the log is retained, otherwise it is removed to obtain accurate target log information.

5. The system abnormality location notification method according to claim 4, characterized in that: The step of accessing the code repository based on the exception stack information and the code features to locate the exception code and its position includes: Accessing a code repository according to the code features; Determine the exception code file name and code line number according to the exception stack information, construct an exception code location rule according to the exception code file name, and generate an exception code query condition; A distributed computing framework is used to perform parallel search on the code repository, and the abnormal code query condition is used to match the code files in the code repository to obtain a list of suspected abnormal code files; Perform secondary filtering on the suspected abnormal code file list, extract the features of each file in the suspected abnormal code file list through static code analysis technology, and calculate the similarity with the abnormal stack information. If the similarity exceeds the set threshold, it is determined to be an abnormal code file; According to the code line number, the abnormal code and the specific position of the abnormal code in the abnormal code file are located to generate an abnormal code location result.

6. The system abnormality location notification method according to claim 5, characterized in that: The step of obtaining the code change history data of the abnormal code, locating the developer information before the abnormality occurred based on the code change history data, and taking the corresponding developer as the target object includes: Obtaining the code version change history data through the API interface of the code repository, wherein the code version change history data at least includes the code submission record, developer and submission time; According to the time point when the exception occurred, a search is performed in the iteration history data to locate multiple code submission records before the exception occurred; Determine whether the interval between the submission time of each code submission record and the time point when the exception occurred exceeds a set time threshold, and mark the code submission record whose time interval is less than the set time threshold as a suspected exception introduction point; Obtain developer information of suspected anomaly introduction points, calculate weighted scores for developers based on their code submission frequency, submitted code volume, and historical anomaly rate, and identify developers whose scores exceed the set score threshold as target objects.

7. The system abnormality location notification method according to claim 6, characterized in that: The step of rating the anomaly according to the target parsing result, generating notification information according to the rating, the anomaly code and its location, and sending the notification information to the target object comprises: Determine the severity and impact of the anomaly based on the target analysis results, use the rule engine to grade the anomaly and obtain the anomaly rating results; Match the preset notification method strategy based on the abnormal rating results to determine the appropriate notification channel; Extract key segments of the exception code and location information of the key segments and automatically construct exception notification information using natural language generation technology; The generated exception notification information is matched with the notification channel, and the target object is distributed through the message queue of the notification channel.

8. A system abnormality location notification device, characterized in that: The device comprises: A log acquisition module is used to acquire the log information of the target system, determine the integrity of the log information, re-acquire if it is incomplete, and temporarily store the complete log information at the target location; A log parsing module, used to obtain log extraction parameters, screen target log information from the target location according to the log extraction parameters, perform multi-channel log parsing on the target log information, and integrate the multi-channel parsing results to obtain a target parsing result; An exception locating module is used to obtain exception feature information according to the target parsing result, obtain code features based on the exception feature information, read exception stack information corresponding to the exception feature information, and access the code repository based on the exception stack information and the code features to locate the exception code and its position; An object determination module is used to obtain the code change history data of the abnormal code, locate the developer information before the abnormality occurs based on the code change history data, and take the corresponding developer as the target object; A notification sending module rates the anomaly according to the target parsing result, generates notification information according to the rating, the anomaly code and its location, and sends the notification information to the target object.

9. A computer device, characterized in that: The method comprises a memory and a processor, wherein the memory stores computer-readable instructions, and the processor implements the system abnormality location notification method as claimed in any one of claims 1 to 7 when executing the computer-readable instructions.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer-readable instructions, and when the computer-readable instructions are executed by a processor, the system abnormality location notification method according to any one of claims 1 to 7 is implemented.

Images