Statistical method and system for system events and application events

Abstract

The application relates to the technical field of computer event statistics, in particular to a system event and application event statistics method and system, which comprises the following steps: presetting an event string based on an event definition rule and integrating the event string into an event list; receiving a local socket to collect event messages, and performing split processing on the event messages to obtain a plurality of event sub-strings; performing first and second mapping on the event sub-strings in the event list to obtain a matched main type segment and a sub-scene segment; performing event statistics after the mapping is matched to accumulate the number in the corresponding statistical group of different statistical time periods based on the event message segmentation; clearing and / or recording the count in the statistical group based on a timer in each statistical group; responding to a real-time data request, and outputting current statistical information according to the time period requirement of the real-time data request. The application has the effect of realizing high-speed statistics of event occurrence in a resource-limited embedded device.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer event statistics, and in particular to a system event and application event statistics method and system. BACKGROUND

[0002] In the field of energy storage, a large number of system and business events may be generated (in a short period of time) on a resource-limited embedded device due to changes in the external environment, such as network disconnection and connection, operation of peripheral devices timeout, power on and off of energy storage devices, and off-grid, etc.

[0003] These events are time-dependent, and these events are very important for observing the running state of the embedded device. Quantitative and concentrated information can help field engineers quickly determine whether the device is abnormal.

[0004] Current system and business application event statistics are all performed by traversing and searching for field information related to events in the system operation log. This approach has two problems. On the one hand, the log needs to occupy a large amount of resources, which cannot be matched on a resource-limited embedded device. On the other hand, the log cannot be directly written into the Flash, and needs to be compressed. If an abnormal situation such as power failure occurs during the compression process, the log will be lost, which will affect the accuracy of the event statistics result. SUMMARY

[0005] In order to realize high-speed statistics of event occurrence in a resource-limited embedded device, the present application provides a system event and application event statistics method and system.

[0006] In a first aspect, the present application provides a system event and application event statistics method, which adopts the following technical solution:

[0007] A system event and application event statistics method, comprising the following steps:

[0008] An event string is preset based on an event definition rule and is integrated into an event list, the event string at least including a main type segment, a sub-scene segment, and a separator;

[0009] A local socket is received to collect event messages, and the event messages are split to obtain a plurality of event substrings;

[0010] The event substrings are first mapped in the event list to obtain a matched main type segment, and secondly mapped in the main type segment to obtain a matched sub-scene segment;

[0011] After the mapping is matched, event statistics are performed to accumulate the number in the corresponding statistics group based on the event message segmentation, wherein different statistics groups are distinguished based on a statistics time period.

[0012] Clearing and / or recording the count in the statistical group based on the timer in the statistical group;

[0013] Responding to a real-time data request and outputting current statistical information according to the time period requirement of the real-time data request.

[0014] In some embodiments, the event string is preset based on the event definition rule and integrated into an event list, and the method further comprises the following steps:

[0015] Separating the main type segment and the sub-scene segment by the interval symbol;

[0016] Determining whether the event corresponding to the event string is a periodic state, and adding a state prefix symbol in the event string based on the determination result, the state prefix symbol being used to distinguish between a persistent event and a one-time event;

[0017] Adding an attribute segment in the event string, the attribute segment being used to add context attribute content corresponding to the event, and the attribute segment and the sub-scene segment being separated by an attribute suffix symbol.

[0018] In some embodiments, the event string is preset based on the event definition rule and integrated into an event list, and the method further comprises the following steps:

[0019] Configuring a format checking rule in the event list, periodically checking the format of the event string in the event list based on the format checking rule, and if there is an event string that does not pass the format checking, generating an abnormal alarm and marking the corresponding event string and count in the event list and the statistical group.

[0020] In some embodiments, when the first mapping or the second mapping does not match, the event is defined as an unknown event and the unknown event is not counted.

[0021] In some embodiments, the event message is a structure containing an event string and a system startup time, a local socket is received to collect the event message, and the event message is split to obtain a plurality of event sub-strings, and the method comprises the following steps:

[0022] Synchronously obtaining the current system action time when the event information is split;

[0023] Calculating the difference between the current system action time and the system startup time in the event information, and discarding the event information when the difference is greater than a preset value.

[0024] In some embodiments, after the mapping is matched, event statistics are performed to accumulate the number in the corresponding statistical group based on the event message segment, including the following steps:

[0025] The statistical time period corresponding to each statistical group is obtained and arranged in sequence;

[0026] When there is one mapping matched event message, the number is added by one in the statistical group with the shortest statistical time period;

[0027] If the statistical time reaches the shortest statistical time period, the statistical number in the statistical group is added to the statistical group with a longer statistical time period and adjacent to the statistical group, and after the addition, the statistical number in the current statistical group is cleared.

[0028] In some embodiments, after the mapping is matched, event statistics are performed to accumulate the number in the corresponding statistical group based on the event message segment, including the following steps:

[0029] The statistical time period corresponding to each statistical group is obtained;

[0030] When there is one mapping matched event message, the number is added by one in all statistical groups;

[0031] When the statistical time reaches each statistical time period, the statistical number in the corresponding statistical group is cleared.

[0032] In some embodiments, the statistical time period includes minute, hour and day, and the timer in each statistical group is used to clear and / or record the count in the statistical group, including the following steps:

[0033] The statistical time period n in minute is obtained, and the statistical time period m in hour is obtained, wherein n is less than 60, and m is greater than or equal to 60;

[0034] The timer is triggered every preset time to make each statistical group compare the time condition, specifically,

[0035] For the statistical group in minute:

[0036] The minute information of the current time is obtained, and it is judged whether the minute information can be divided by n, if yes, all the statistical numbers in the statistical group are cleared;

[0037] For the statistical group in hour:

[0038] It is calculated whether m / 60 is an integer;

[0039] If yes, minute information of the current time is acquired and it is determined whether it is zero, if zero, hour information of the current time is acquired and it is determined whether it is divisible by m / 60, if yes, all the statistical quantities in the statistical group are cleared;

[0040] If no, minute information of the current time is acquired and it is determined whether it is divisible by the remainder of m / 60, if yes, hour information of the current time is acquired and it is determined whether it is divisible by the quotient of m / 60, if yes, all the statistical quantities in the statistical group are cleared;

[0041] For the statistical group made on the same day:

[0042] Minute and hour information of the current time are acquired and it is determined whether they are both zero, if yes, all the statistical quantities in the statistical group are recorded to a statistical file, and after recording, the statistical quantities are cleared.

[0043] In some embodiments, when the event corresponding to the event string is a periodic state, the following steps are further included:

[0044] The system startup time corresponding to the event string is acquired and recorded, and when the event of the periodic state ends, the system startup time is stopped to be recorded;

[0045] The system startup events corresponding to the event are integrated as a duration and associated to the event.

[0046] In a second aspect, the application provides a statistical system of system events and application events, which adopts the following technical solution:

[0047] A statistical system of system events and application events, comprising:

[0048] An event predefinition module, configured to preset event strings and integrate them into an event list based on event definition rules, wherein the event strings at least include a main type segment, a sub-scene segment and a separator;

[0049] An event receiving module, configured to receive a local socket to collect event messages, and split the event messages to acquire a plurality of event sub-strings;

[0050] The event sub-strings are firstly mapped in the event list to acquire matched main type segments, and secondly mapped in the main type segments to acquire matched sub-scene segments;

[0051] An event statistical module, configured to perform event statistics after the mapping is completed to accumulate quantities in corresponding statistical groups based on the event message segments, wherein different statistical groups are distinguished based on statistical time periods;

[0052] a timer for timing triggering to clear and / or record the count in the statistics group;

[0053] an output module for outputting current statistics information according to a time period requirement of a real-time data request in response to the real-time data request.

[0054] The technical scheme provided by the embodiment of the present application has the following technical effects:

[0055] Various known events are defined in the manner of predefined strings; a local inter-process communication mode and communication protocol are designed to quickly forward events generated by other services or applications to the statistics service, and the statistics service records the time and quantity of the events, and this process does not excessively use system resources with the large quantity of events, and can quickly count various system and business events in a period of time on a resource-limited embedded device. BRIEF DESCRIPTION OF DRAWINGS

[0056] Figure 1 is a step schematic diagram of a system event and application event statistics method provided by the embodiment.

[0057] Figure 2 is a module connection schematic diagram of a system event and application event statistics system provided by the present application. DETAILED DESCRIPTION

[0058] In order to more clearly understand the purpose, technical scheme and advantages of the present application, the present application is described and explained below in connection with the drawings and embodiments. However, it should be understood by those of ordinary skill in the art that the present application can be implemented without these details. In some cases, in order to avoid unnecessary description and make aspects of the present application obscure, well-known methods, processes, systems, components and / or circuits that have been described at a high level will not be described in detail. It is obvious to those of ordinary skill in the art that various changes can be made to the embodiments disclosed in the present application, and the general principles defined in the present application can be applied to other embodiments and application scenarios without deviating from the principles and scope of the present application. Therefore, the present application is not limited to the shown embodiments, but conforms to the broadest scope of the claimed range.

[0059] It should be noted that the description of these embodiments is used to help understand the present application, but does not constitute a limitation on the present application. In addition, the technical features involved in each embodiment of the present application described below can be combined with each other as long as they do not conflict with each other.

[0060] In the description of the present application, the meaning of several is one or more, the meaning of multiple is more than two, greater than, less than, more than, etc. are understood as not including the number, above, below, within, etc. are understood as including the number. If it is described to the first, second, only for the purpose of distinguishing technical features, and cannot be understood as indicating or implying relative importance or implicitly indicating the number of indicated technical features or the sequence of indicated technical features.

[0061] In the description of the present application, the description of the terms "one embodiment", "some embodiments", "exemplary embodiment", "example", "specific example", or "some examples" means that the specific features, structures, materials or characteristics described in connection with the embodiment or example are included in at least one embodiment or example of the present application. In the description, the description of the above terms does not necessarily refer to the same embodiment or example. Moreover, the described specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a combined manner.

[0062] As shown in Figure 1 The embodiments of the present application disclose a statistical method of system events and application events, comprising the following steps:

[0063] S100, preset event string based on event definition rule and integrate into event list.

[0064] When a normal running embedded device occurs an exception, the exception is known and can be predefined, so for this kind of known exception, the counting method can be used for classification and grouping counting.

[0065] The present application does not concern unknown exceptions, which cannot be known and need not be counted due to the properties of the event itself.

[0066] Therefore, the first need is to predefine the known events based on the naming rule, so as to refine a kind of event and give the event string which can be read and judged by the system.

[0067] The event string at least includes a main type segment, a sub-scene segment and a separator. The main type segment represents the overall category name of the event type, such as the main type segment is "network4g", which represents the abnormal event related to 4G network, and the sub-scene segment represents the detailed event scene name, such as "nosimcard", which represents that the 4G network module does not detect the SIM card. The separator is between the main type segment and the sub-scene segment, which is used to separate the two different string components.

[0068] Through the above event definition rule, different events can be defined based on type and scene, and event strings with the following event definition meanings can be generated:

[0069] network4g.nosimcard-“4G network module does not detect SIM card”, network4g.signallow-“4G network module detects low 4G signal (so it fails to register with the base station)”, network4g.registerfail-“fails to register with the 4G base station (may be due to the SIM card being locked)”

[0070] For example, there is an application on the device that reads ModBus data, and the main type section is predefined as “modbus”. The corresponding event string can include: modbus.tty1openerror-“first serial port open fails”, modbus.tty2openerror-“second serial port open fails”, modbus.tty3nodata-“third serial port opens, but no data is read”.

[0071] The event list is obtained by integrating a plurality of event strings, and the event list includes event string names corresponding to various main types and sub-scenarios.

[0072] The configuration file content of the event list is relatively simple, and in the embodiment of the present application, it is organized in json format. The event list is used to statically specify which events (events included in the event list) should be recorded and which events (events not included in the event list) should not be recorded when subsequent events are counted.

[0073] The event list does not include the complete string of a certain event definition, but is stored by grouping and splicing. Specifically:

[0074] {

[0075] "events" : {

[0076] "network4g" : [ "nosimcard", "signallow", "registerfail" ],

[0077] "modbus" : [ "tty1openerror", "tty2openerror", "tty3nodata" ]

[0078] }

[0079] }

[0080] Wherein, event represents an event, network4g and modbus are main type segments, and each main type segment can record and store a matched sub-scene segment, so that the system does not need to store each event string completely when storing the event list, and only needs to place the corresponding string of the sub-scene segment when a new event exists. It is convenient to add and delete events of a certain embedded device, and accelerates the development of business functions.

[0081] S200, receiving a local socket to collect event messages, and performing splitting processing on the event messages to obtain a plurality of event sub-strings.

[0082] Receiving event information sent by other applications and services, and performing splitting processing on the received event information, so as to split the received complete event string into a sub-string matched with the main type segment and the sub-scene segment in the event string.

[0083] S300, performing first mapping of the event sub-string in the event list to obtain a matched main type segment, and performing second mapping in the main type segment to obtain a matched sub-scene segment.

[0084] Mapping and comparing the plurality of sub-strings of the received event with the main type segment and the sub-scene segment respectively, and judging whether there is a field matched successfully in the event list, if all are matched, considering that the event occurred is a known event, and performing subsequent statistics, but if there is any one of the matching conditions, such as the first mapping is not matched, considering that there is no matched event type in the event list, such as the first mapping is matched but the second mapping is not matched, considering that there is no subdivided event scene in the event list of this type. Any condition represents that the received event is an unknown event, and no statistics is performed.

[0085] Wherein, as a data input interface of the event statistics service, when receiving the event, the "UNIX" local datagram socket is used to receive the event generated by other services and applications. The socket has the characteristics of low system resource occupation, automatic packeting, high receiving efficiency, and is suitable for frequently launched application scenarios.

[0086] S400, performing event statistics after mapping all matches to accumulate the number in the corresponding statistical group based on the event message segmentation, wherein different statistical groups are distinguished based on the statistical time period.

[0087] A plurality of statistical groups are set, and the setting of the statistical group is distinguished based on different statistical time, such as a statistical group corresponding to the events received within tens of minutes, a statistical group corresponding to the events received within several hours, and a statistical group corresponding to the events received within a day.

[0088] When there is event information that matches a known event through mapping, the number of occurrences of the corresponding event is accumulated in the corresponding statistical group.

[0089] S500, based on the timer in each statistical group, the count in the statistical group is cleared and / or recorded.

[0090] For the timer in the module corresponding to the event statistics, the timer is set to trigger every 60s, when triggered, the count in each statistical group that meets the time requirement is cleared and / or recorded, clearing means deleting all statistical counts in the statistical group to zero, and recording means recording the current statistical count in the statistical group.

[0091] By periodically cleaning the count in each statistical group, on the one hand, it avoids the occurrence time of the events counted in a statistical group exceeding the statistical time period corresponding to the statistical group, for example, a statistical group is used to count the number of events within ten minutes, if the events in the statistical group are not periodically cleaned, it will cause the statistical group to exist more than ten minutes of event number, which will cause errors and exceptions for subsequent number statistics query. On the other hand, it can reduce the memory occupation and avoid increasing the content resource consumption due to too many events.

[0092] S600, responding to the real-time data request, and outputting the current statistical information according to the time period requirement of the real-time data request.

[0093] The user makes the system module output the event statistical record within a period of time through the command line tool, and the system module responds to the real-time data request and outputs the statistical information that meets the time period requirement.

[0094] Specifically, the command line tool establishes a connection with the event statistical main module through a TCP socket to obtain the current statistical situation of all events. The output result is the same as the statistical data written into the file every day, and the data format at least corresponds to the event string of each event and the number of occurrences. Subsequently, it can also include some maintenance events of the event.

[0095] The specific format is, for example:

[0096] network4g.nosimcard: 20;

[0097] modbus.tty1openerror: 25.

[0098] In this way, the operation and maintenance personnel accessing the system can understand the count situation of known events that have occurred in the past tens of minutes, hours, and days, which provides great convenience for understanding the running state of the embedded device with limited system resources.

[0099] By the above scheme, various known events are defined in a predefined string manner; a local inter-process communication manner and communication protocol are designed to quickly forward events generated by other services or applications to the statistics service, which records the time and number of event generation. This process does not excessively use system resources with the large number of events, and can quickly count various system and business events in a period of time on a resource-limited embedded device.

[0100] Through testing, the event statistics method based on the application can achieve an event statistics effect of more than 1000 events per second on an embedded device with 128 MB memory.

[0101] In other embodiments, the event string is preset based on the event definition rule and integrated into an event list, and the method further includes the following steps:

[0102] S110, separating the main type segment and the sub-scene segment by a separator.

[0103] S120, judging whether the event corresponding to the event string is a periodic state, and adding a state prefix symbol in the event string based on the judgment result, the state prefix symbol being used to distinguish between persistent events and one-off events.

[0104] Persistent events are characterized by the existence of persistence of corresponding data or services, such as "nosimcard" representing that the 4G network module does not detect a SIM card, and this event is a persistent state of the device's 4G network; while for example, the registration behavior is a single operation attempt, and one failure of registration corresponds to one failure event, and for this kind of event, it corresponds to a one-off event.

[0105] Because the number statistics method of persistent events and one-off events should exist certain differences, such as one-off events are recorded once each time, and for persistent events, the triggered mode, frequency, and maintenance time of the event need to be considered, therefore, in the application, whether the event has a periodic state in time is judged to determine its specific type, and a state prefix symbol is added in the event string based on the judgment result.

[0106] The role of the state prefix symbol is to distinguish the specific type of an event, and in the application, the state prefix symbol is "@state", if the state prefix symbol exists in the event string, it corresponds to a persistent event, and if the state prefix symbol does not exist, it corresponds to a one-off event.

[0107] For example, for the "4G network module does not detect a SIM card" event, the corresponding event string is network4g.nosimcard@state.

[0108] S130, adding an attribute segment in the event string, the attribute segment being used to add context attribute content corresponding to the event, the attribute segment and the sub-scene segment being separated by an attribute suffix symbol.

[0109] In the embodiments of the present application, an attribute segment can also be added in the event string, the attribute segment representing additional context attributes corresponding to the event, which can be used to obtain a subdivided scene corresponding to an event reason based on attribute extraction of the event.

[0110] The attribute segment contains context attribute content corresponding to the event, mainly in the form of character + value, and the attribute segment is in the rear segment of the event string, which is separated from the sub-scene segment by an attribute suffix symbol, which is “#” in the embodiments of the present application.

[0111] For example, in the application of reading ModBus data on a device, if the first serial port fails to open, and the attribute state of the event indicates that the serial port fails to open at a baud rate of 9600, the attribute can be associated with the event string to generate an attribute segment of “baud9600”, and separated and associated by “#”. The final event string is “modbus.tty1openerror#baud9600”.

[0112] Through the above method, the self-defined field is personalized and customized, different character definitions are made for different data information based on the use scene, use requirement and use precision, and other attributes and types of events can be further embodied in the string while the number of event occurrences is counted, which does not affect the original technical logic, and other additional content can be added to the event, and more subdivided scenes can be queried through a filtering tool subsequently.

[0113] In other embodiments, the event definition rule can also contain other personalized customization schemes. For example, when the event definition rule needs to be iterated (such as interface change and scene upgrade), a version number (such as V1, V2) can be added in the string, the statistical service can count events of different versions respectively, and can also realize aggregate statistics through fuzzy matching, and is compatible with the transition scene of new and old systems; for devices deployed in multiple regions, a language identifier (such as zh and en) can also be added in the event string, multiple language versions can be stored in the event list, the statistical result is automatically matched with the event string in the corresponding language according to the region where the device is located when output, and the event description in the corresponding language is output, and the ease of use of the operation and maintenance tool is improved.

[0114] In some other embodiments, a format checking rule is configured in the event list, the event strings in the event list are periodically checked based on the format checking rule, if there is an event string that does not pass the format checking, an abnormal alarm is generated and the corresponding event string in the event list and the statistical group is marked.

[0115] The above-mentioned custom rules are selected and configured based on actual scenarios, but regardless of the event definition method, it is necessary to match the standardized requirements, such as each string must be a pre-defined module name, customizing the string name is not allowed, the total length of the event string is not more than 64 characters, and long strings are avoided to occupy the content.

[0116] If there is a non-standard event string definition, the system will generate an alarm to remind the operation and maintenance personnel to check whether there is an error in the event definition rule, and at the same time mark the abnormal string in the event list, and mark the count value related to the abnormal string in the statistical group, so as to facilitate the operation and maintenance personnel to check.

[0117] In some other embodiments, when the first mapping or the second mapping does not match, the event is defined as an unknown event and the unknown event is not counted.

[0118] If any one mapping does not pass, the event corresponding to the event string is defined as an unknown event, and the unknown event does not belong to the event statistics process category of the present application, so the unknown event is not counted.

[0119] In some other embodiments, the event message is a structure containing an event string and a system startup time, a local socket is received to collect the event message, and the event message is split to obtain a plurality of event substrings, including the following steps:

[0120] S210, synchronously obtaining the current system action time when splitting the event information.

[0121] When receiving the event, the format of the obtained event information is also defined, in order to improve the data parsing efficiency, the message format encapsulation of data serialization such as JSON is not used, but a simple structure is directly defined:

[0122] struct event_message {

[0123] char eventid

[128] ;

[0124] time_t uptime;

[0125] }

[0126] Wherein, eventid in the structure is the event string of a certain event, such as "network4g.nosimcard", and the length of the event string is represented by "uptime", and the system startup time of the event is represented by "uptime" in seconds.

[0127] S220, the current system action time is subtracted from the system startup time in the event information, and the event information is discarded when the difference is greater than a preset value.

[0128] The system startup time is mainly used to prevent too many event information from being generated in a short time, and the service processing is not timely, and the time generated a few minutes ago is incorrectly taken as the current generation.

[0129] In other words, when receiving an event, not only the system time corresponding to the event generation is obtained, but also the current system time is obtained and compared. If the "uptime" in a certain event information is too different (for example, three minutes), the event will be discarded and not enter the statistical count.

[0130] Because different statistical groups have corresponding statistical period time requirements, if the time of event generation is incorrectly obtained, the final count of the target statistical group of the event will be deviated, resulting in the influence of the accuracy of the final count.

[0131] In other embodiments, after the mapping is matched, the event statistics are performed to accumulate the number in the corresponding statistical group based on the event message segmentation, including the following steps:

[0132] S410, the statistical time period corresponding to each statistical group is obtained and sequentially arranged.

[0133] Based on the length of the statistical time period corresponding to each statistical group, the statistical groups are sequentially arranged, and in this application, the order from short to long is arranged.

[0134] S420, the number in the statistical group with the shortest statistical time period is added by one for each event message that matches the mapping.

[0135] Whenever a known event is received, the number in the statistical group with the shortest statistical time period is added by one, and other length statistical groups are not counted.

[0136] S430, if the statistical time reaches the shortest statistical time period, the statistical number in the statistical group is added to the statistical group with longer statistical time period and adjacent to the statistical group, and after the addition, the statistical number in the current statistical group is cleared.

[0137] When the statistical time reaches the shortest statistical time period, such as the statistical time period of the statistical group A is 10 minutes, the number of events occurring ten minutes before the current time is counted in the statistical group A, and when the statistical time exceeds 10 minutes, the time corresponding to the newly received event does not match the statistical group A, and then the statistical number in the statistical group A needs to be added to the statistical group B with a longer statistical time period, such as the statistical time period of the statistical group B is 1 hour, and even if the statistical time exceeds 10 minutes, it is still within the time range corresponding to the statistical group B.

[0138] At the same time, the statistical number in the statistical group A is cleared to start the next 10-minute event number statistics, and the current event statistics count is added to the statistical group B every ten minutes.

[0139] Similarly, when the statistical time reaches one hour, the statistical number in the statistical group B is added to the statistical group C with a statistical time period of 1 day.

[0140] Through the above method, the incremental snapshot mechanism of the counter is realized, the accumulation of the event value only acts on one statistical group each time, and the incremental recording function is provided, the data in the statistical group with a long statistical period is independently added in batches by the statistical group with a short statistical period, the deviation of all data counting caused by the loss of events at the moment of timer triggering is avoided, the statistical accuracy is improved, and the memory occupation of the embedded device is less because the data increment of each statistical group is independently performed.

[0141] In some other embodiments, after the mapping is matched, the event statistics are performed to accumulate the number in the corresponding statistical group based on the event message segmentation, including the following steps:

[0142] S440, the statistical time period corresponding to each statistical group is obtained.

[0143] S450, the number is added by one in all statistical groups for each event message with a matched mapping.

[0144] S460, when the statistical time reaches each statistical time period, the statistical number in the corresponding statistical group is cleared.

[0145] In the embodiments of the present application, in addition to the above-mentioned incremental snapshot mechanism, a synchronous incremental mechanism can also be used.

[0146] Under the synchronous incremental mechanism, the event statistics service synchronously performs multiple statistics on an event after monitoring the event information, that is, each event will increase the statistical count in multiple statistical groups.

[0147] For example, after monitoring the event information, the counting is synchronized and increased by one in the statistical group A with a statistical time period of ten minutes, the statistical group B with a statistical time period of one hour, and the statistical group C with a statistical time period of one day.

[0148] Under the synchronization increment mechanism, the redundant counting of the event can be realized, so that when a statistical anomaly occurs in a statistical group, the statistical accuracy in other statistical groups will not be affected.

[0149] In some other embodiments, the statistical time periods include minute, hour and day, and the counting in the statistical groups is cleared and / or recorded based on the timer in the statistical groups, including the following steps:

[0150] S510, a statistical time period n in minute is obtained, and a statistical time period m in hour is obtained, where n is less than 60 and m is greater than or equal to 60.

[0151] All the times in the timer are in minute, so the different statistical groups in the embodiments of the present application are classified based on minute, hour and day, the overall statistical time of the statistical group in minute is the shortest and is less than 60 minutes, the overall statistical time of the statistical group in hour is longer and is more than 60 minutes, and the overall statistical time of the statistical group in day is generally one day.

[0152] S520, the timer triggers every preset time to make the statistical groups compare the time conditions.

[0153] The main function of the timer is to determine whether the current statistical time reaches the matching condition of the statistical time period by triggering, for example, the number of times of occurrence in the past 10 minutes, which needs to be cleared once every 10 minutes to perform the statistical work in the next 10-minute period.

[0154] Therefore, the timer triggers once every 60 seconds in the triggering period to compare the event conditions of the statistical groups to determine whether the statistical values in one or more statistical groups need to be cleared and / or recorded.

[0155] Specifically,

[0156] For the statistical group in minute:

[0157] S530, the minute information of the current time is obtained, and it is determined whether the minute information can be divided by n, if yes, all the statistical values in the statistical group are cleared.

[0158] For the statistical group in minute, the statistical time will not exceed one hour, so the day and hour are always 0, and therefore only the minute information needs to be concerned.

[0159] Timer triggers every minute, as long as the current minute information can be divided by n, it is judged that the statistical group has reached the time to clear zero, at this time, all statistical quantities in the statistical group are cleared.

[0160] If the statistical group A counts the number of times in 10 minutes, then n = 10, as long as the current time minute information can be divided by 10, it is judged that the current time is 10 or an integer multiple of 10, but since it directly clears zero when the minute information is 10, the minute information will not exceed 10 min.

[0161] For the statistical group of the hour system:

[0162] S540, calculate whether m / 60 is an integer.

[0163] S541, if yes, get the minute information of the current time and judge whether it is zero, if zero, get the hour information of the current time and judge whether it can be divided by m / 60, if yes, clear all statistical quantities in the statistical group.

[0164] S542, if not, get the minute information of the current time and judge whether it can be divided by the remainder of m / 60, if yes, get the hour information of the current time and judge whether it can be divided by the quotient of m / 60, if yes, clear all statistical quantities in the statistical group.

[0165] For the statistical group of the hour system, because the unit of the timer is default minute, and the current time format is "hour minute second", the units are inconsistent, so first need to judge whether the statistical time period m of a statistical group can be divided by 60, if can be divided, it means that the corresponding statistical time period is integer hour, if can not be divided, it means that the corresponding statistical time period is x hours xx minutes.

[0166] For integer hours, first need to judge whether the minute information of the current time is zero, if not equal to zero, it means that the current statistical time is not the whole point, which does not meet the requirements, at this time, no need to compare the hour information.

[0167] If equal to zero, it means that the current statistical time is the whole point, at this time, judge whether the hour information of the current time can be divided by m / 60, that is, integer hour, if yes, clear the statistical count in the statistical group.

[0168] If not equal to zero, need to determine its corresponding hour value and minute value based on m, when m is divided by 60, the quotient represents the hour data, and the remainder represents the minute value. For example, when m is 150 minutes, the quotient is 2 and the remainder is 30, which matches 2 hours and 30 minutes.

[0169] Therefore, firstly, it is judged whether the minute information of the current time can be divided by the remainder of m / 60, and whether the minute information of the current time and the minute value corresponding to m are matched, and if matched, the hour information is compared to judge whether the hour information can be divided by the quotient of m / 60, and whether the hour information can be matched with the hour value corresponding to m.

[0170] If all are matched, all the statistical counts currently existing in the statistical group are cleared.

[0171] For the statistical group made on the same day:

[0172] In S550, the minute information and the hour information of the current time are obtained, and it is judged whether both are 0, and if yes, all the statistical quantities in the statistical group are recorded to the statistical file, and after recording, the statistical quantities are cleared.

[0173] The current table represents all the event quantities counted in one day, and it only needs to judge whether the hour information and the minute information of the current time are both 0.

[0174] As for the hour information, it needs to record all the data currently counted in the statistical file for storage while clearing the statistical quantities, and further, the system will delete the record files before 15 days to reduce the storage content.

[0175] It should be noted that when the event statistics is just started, the counts of various events are 0, and it will allocate memory for each event, and after initialization, when the event statistics is performed, no memory will be allocated again, because the consumption of content resources will not be increased due to too many events.

[0176] In some other embodiments, when the event string corresponds to a periodic state, the following steps are further included:

[0177] In S121, the system startup time corresponding to the event string is obtained and recorded, and when the periodic state ends, the recording of the system startup time is stopped.

[0178] When the event corresponds to a persistent event, in order to facilitate the maintenance personnel to view and analyze the state information corresponding to the event, in the present application, the time maintained by the event is counted while counting the number of events.

[0179] For example, for the state of "4G network module does not detect SIM card", it is a persistent state of 4G network, and how to analyze the event occurrence frequency and the maintenance time is that the dialing service based on the 4G network reads the state of the 4G module every certain time (for example, two minutes), and if no SIM card is found once, an event is generated.

[0180] S122, integrating the system startup time corresponding to the event as a duration and associating it to the event.

[0181] The number of times the event occurs each time is counted as a statistical number, and the system startup time corresponding to each event occurrence is integrated and recorded until the event ends to calculate the maintenance time.

[0182] After calculating the maintenance time, the time is associated with the event, so that the user can query based on the command line to generate the occurrence number and maintenance time of the persistent event.

[0183] The application also discloses a system for counting system events and application events, comprising:

[0184] An event predefinition module is configured to preset event strings based on event definition rules and integrate them into an event list, wherein the event strings at least include a main type segment, a sub-scene segment, and a separator;

[0185] An event receiving module is configured to receive local sockets to collect event messages and split the event messages to obtain a plurality of event substrings;

[0186] The event substrings are mapped in the event list for the first time to obtain a matched main type segment, and are mapped in the main type segment for the second time to obtain a matched sub-scene segment;

[0187] An event counting module is configured to count events after the mapping to accumulate the number in the corresponding statistical group based on the event message segmentation, wherein different statistical groups are distinguished based on a statistical time period;

[0188] A timer is configured to trigger at a regular time to clear and / or record the count in the statistical group;

[0189] An output module is configured to respond to a real-time data request and output current statistical information according to the time period requirement of the real-time data request.

[0190] The implementation principle is:

[0191] Various known events are defined in the form of predefined strings; a local inter-process communication method and communication protocol are designed to quickly forward events generated by other services or applications to the statistical service, and the statistical service records the time and number of event generation. This process does not use too many system resources with the large number of events, and can quickly count various system and business events in a period of time on resource-limited embedded devices.

[0192] It should be understood that, while the steps in the flow diagrams of the drawings are shown in sequential order, such need not be the order in which they are performed. Unless otherwise explicitly stated, the steps can be performed in any order, and need not be performed in the order shown.

[0193] The above are only preferred embodiments of the present application, not intended to limit the protection scope of the present application, therefore: any equivalent changes made according to the structure, shape, principle of the present application should be covered within the protection scope of the present application.

Claims

1. A statistical method for system events and application events, characterized in that: The following steps are involved: Based on the event definition rules, event strings are preset and integrated into an event list. The event string includes at least a main type segment, a sub-scene segment, and a separator. Specifically, Separating the main type segment and the sub-scene segment by the separator; Determine whether the event corresponding to the event string is a periodic state, and add a state prefix to the event string based on the determination result, wherein the state prefix is ​​used to distinguish between a continuous event and a one-time event; Adding an attribute segment to the event character string, wherein the attribute segment is used to add context attribute content corresponding to the event, and the attribute segment and the sub-scenario segment are separated by an attribute suffix; receiving a local socket to collect event messages, and splitting the event messages to obtain a plurality of event substrings; Performing a first mapping on the event substring in the event list to obtain a matching main type segment, and performing a second mapping on the main type segment to obtain a matching sub-scene segment; After all mappings are matched, event statistics are performed to accumulate the number of events in corresponding statistical groups based on the event message segments, wherein different statistical groups are distinguished based on statistical time periods; clearing and / or recording the counts in the statistical groups based on the timers in the statistical groups; Respond to real-time data requests and output current statistical information according to the time period requirements of the real-time data requests.

2. The statistical method for system events and application events according to claim 1, characterized in that: Presetting event strings based on event definition rules and integrating them into an event list also includes the following steps: Format verification rules are configured in the event list, and format checks are performed on the event strings in the event list regularly based on the format verification rules. If the event strings fail the format check, an abnormal alarm is generated and the corresponding event strings and counts in the event list and the statistical group are marked.

3. The statistical method for system events and application events according to claim 1, characterized in that: When the first mapping or the second mapping does not match, the event is defined as an unknown event and statistics of the unknown event are not collected.

4. The statistical method for system events and application events according to claim 1, characterized in that: The event message is a structure containing an event string and system startup time. The local socket is received to collect the event message, and the event message is split to obtain several event substrings, including the following steps: Synchronously obtaining the current system action time when splitting the event information; The difference between the current system action time and the system startup time in the event information is calculated, and the event information is discarded when the difference is greater than a preset value.

5. The statistical method for system events and application events according to claim 1, characterized in that: After all mappings are matched, event statistics are performed to accumulate the number of event message segments in the corresponding statistical groups, including the following steps: Obtaining the statistical time periods corresponding to the statistical groups and arranging them in sequence; For each event message that has a mapping match, the number of the event message in the statistical group with the shortest statistical time period is increased by one; If the statistical time reaches the shortest statistical time period, the statistical quantity in the statistical group is added to the statistical group with a longer and adjacent statistical time period, and the statistical quantity in the current statistical group is cleared after the addition.

6. The method for counting system events and application events according to claim 1, characterized in that: After all mappings are matched, event statistics are performed to accumulate the number of event message segments in the corresponding statistical groups, including the following steps: Obtaining the statistical time period corresponding to each statistical group; For each event message that has a mapping match, the number of events in all statistical groups is increased by one; When the statistical time reaches each statistical time period, the statistical quantity in the corresponding statistical group is cleared.

7. The method for counting system events and application events according to claim 5 or 6, characterized in that: The statistical time period includes a minute system, an hour system, and a daily system, and clearing and / or recording the counts in the statistical group based on the timer in each statistical group includes the following steps: Obtain the statistical time period n in minute format, and obtain the statistical time period m in hour format, where n is less than 60 and m is greater than or equal to 60; The timer is triggered every time a preset time passes so that each statistical group performs a time condition comparison. Specifically, For the minute-based statistical group: Obtaining minute information of the current time, and determining whether the minute information can divide n, and if so, clearing all the statistical quantities in the statistical group to zero; For the statistical group of the hourly system: Calculate whether m / 60 is an integer; If yes, then obtain the minute information of the current time and determine whether it is zero; if it is zero, then obtain the hour information of the current time and determine whether it can be divided by m / 60; if so, then clear all the statistical quantities in the statistical group to zero; If not, obtain the minute information of the current time and determine whether the remainder can be divided evenly by m / 60; if so, obtain the hour information of the current time and determine whether the quotient can be divided evenly by m / 60; if so, clear all the statistical quantities in the statistical group; For the statistical group of the current day: Obtain the minute information and hour information of the current time and determine whether both are 0; if so, record all the statistical quantities in the statistical group into a statistical file, and clear the statistical quantities after recording.

8. The method for counting system events and application events according to claim 4, characterized in that: When the event corresponding to the event string is a periodic state, the following steps are also included: Obtaining and recording the system startup time corresponding to the event character string, and stopping recording the system startup time when the event in the periodic state ends; A plurality of system startup times corresponding to the event are integrated to form a duration and associated with the event.

9. A statistical system for system events and application events, characterized in that: include: The event pre-definition module is used to pre-set event strings based on event definition rules and integrate them into an event list. The event string includes at least a main type segment, a sub-scene segment, and a separator. Specifically, Separating the main type segment and the sub-scene segment by the separator; Determine whether the event corresponding to the event string is a periodic state, and add a state prefix to the event string based on the determination result, wherein the state prefix is ​​used to distinguish between a continuous event and a one-time event; Adding an attribute segment to the event character string, wherein the attribute segment is used to add context attribute content corresponding to the event, and the attribute segment and the sub-scenario segment are separated by an attribute suffix; An event receiving module, configured to receive a local socket to collect event messages, and split the event messages to obtain a plurality of event substrings; The event substring is first mapped in the event list to obtain a matching main type segment, and then a second mapping is performed in the main type segment to obtain a matching sub-scene segment. An event statistics module, configured to perform event statistics after all mappings are matched, so as to accumulate the number of event message segments in corresponding statistical groups, wherein different statistical groups are distinguished based on a statistical time period; A timer, configured to trigger at regular intervals to clear and / or record the counts in the statistical group; The output module is used to respond to real-time data requests and output current statistical information according to the time period requirements of the real-time data requests.

Images