An audit system operation and maintenance log automatic generation method and device

Abstract

The present application relates to the technical field of log analysis, and particularly relates to a kind of audit system operation and maintenance log automatic generation method and equipment.The method parses log stream to distinguish business log entries from unassociated abnormal entries, constructs thread execution sequence and calculates the idle time slice between adjacent business log entries in thread execution sequence;Load the resource constraint mapping table defining hardware resource type and minimum duration;Get the candidate business entries of unassociated abnormal entries, and perform mutual exclusivity and capacity physical verification using the resource constraint mapping table to filter out effective candidate business entries;According to the time difference between unassociated abnormal entries and its effective candidate business entries, filter out the best matching business entries, and then backtrack the business context, inject the exception stack and correct the state to generate structured audit records.The present application realizes non-invasive and high-precision exception attribution based on the rules of runtime resource constraints, and improves the integrity and accuracy of audit data.

Description

Technical Field

[0001] This invention relates to the field of log analysis technology, specifically to a method and device for automatically generating operation and maintenance logs for an audit system. Background Technology

[0002] In modern distributed computing and microservice architectures, asynchronous non-blocking I / O models and multi-core concurrent processing architectures are widely used in various high-performance servers and middleware to maximize hardware resource utilization and improve system concurrency throughput. In modern distributed computing and microservice architectures, the execution flow of business logic no longer follows the traditional synchronous sequential execution mode. Instead, it is divided into multiple discrete instruction fragments (such as callback functions, Promise chains, or coroutines), and frequent context switching occurs between different kernel threads of the operating system. When business logic triggers underlying network transmissions (such as RPC calls or database queries) or disk read / write operations, the current worker thread immediately releases control to handle other concurrent requests. Execution resumes only when the underlying hardware operation completes or an exception occurs, through interrupt or event notification mechanisms.

[0003] Low-level system-level exceptions typically occur when the thread context that initiated the business request is separated from the thread context in both time and space. They are captured by the low-level I / O thread or daemon thread. Moreover, the exception logs themselves often lack key business tracking identifiers because they are detached from the application layer's call stack. As a result, although the auditing system can record a large number of low-level exception logs, it cannot know which specific user operation or business transaction caused these exceptions.

[0004] Existing methods employ end-to-end tracing, which involves intrusively passing context objects within the code to enable auditing systems to connect cross-service call chains. However, end-to-end tracing struggles to cover third-party components whose source code cannot be modified, legacy systems, or operating system kernel-level errors, resulting in monitoring blind spots. Furthermore, while time-window-based correlations can be used to infer errors based on temporal proximity, in high-concurrency scenarios, hundreds or even thousands of concurrent requests may occur within the same millisecond. Correlation based solely on timestamp proximity leads to extremely high false positive rates, failing to meet the stringent requirements of financial-grade or compliance-grade auditing systems for accurate and non-repudiable evidence. Therefore, existing methods cannot solve the problem of accurately attributing underlying anomalies in high-concurrency environments without intrusion, impacting the integrity of operational audit data and the efficiency of fault diagnosis. They also struggle to build a credible chain of fault evidence, ultimately hindering the stability and compliance security of critical business systems. Summary of the Invention

[0005] To address the technical problem that existing methods cannot resolve inaccurate attribution of underlying anomalies in high-concurrency environments without intrusion, the present invention aims to provide an automatic generation method and device for audit system operation and maintenance logs. The specific technical solution adopted is as follows:

[0006] In a first aspect, one embodiment of the present invention provides a method for automatically generating audit system operation and maintenance logs, the method comprising the following steps:

[0007] The log stream is parsed to distinguish between business log entries and unrelated exception entries. A thread execution sequence is constructed using the kernel thread identifier as the key, and the idle time slice between adjacent business log entries in the thread execution sequence is calculated. The resource constraint mapping table is loaded to define the hardware resource type and its minimum duration corresponding to the exception type.

[0008] In the thread execution sequence, candidate business entries that are not associated with exception entries are identified based on a preset time window. Then, using a resource constraint mapping table, physical verification is performed based on hardware resource type and minimum duration to obtain valid candidate business entries that are not associated with exception entries. Based on the time difference between the unassociated exception entries and their valid candidate business entries, the best matching business entry for the unassociated exception entries is obtained.

[0009] Retrieve the complete business context based on the best-matching business entry, inject the exception stack and update the business status information to generate structured audit records.

[0010] Furthermore, the method for distinguishing business log entries from unassociated exception entries in the parsed log stream is as follows:

[0011] Real-time parsing of log text, conversion of log printing time into nanosecond-level absolute timestamps, and extraction of kernel thread identifiers;

[0012] If the log contains a global request identifier, then construct a business log entry containing the thread identifier, request identifier, operation type, start time, and end time;

[0013] If the log lacks a global request identifier but contains exception stack traces, then an unassociated exception entry containing the thread identifier, exception type, and the time the exception was caught is constructed.

[0014] Furthermore, the method for obtaining the idle time slice is as follows:

[0015] Insert business log entries into the thread execution sequence in ascending time order, traverse the thread execution sequence, and calculate the difference between the end time of the i-th business log entry and the start time of the (i+1)-th business log entry as the first duration analysis value.

[0016] When the first duration analysis value is greater than 0, the first duration analysis value is marked as the idle time slice between the i-th business log entry and the (i+1)-th business log entry;

[0017] When the first duration analysis value is less than or equal to 0, 0 is marked as an idle time slice between the i-th business log entry and the (i+1)-th business log entry.

[0018] Furthermore, the method for loading the resource constraint mapping table is as follows:

[0019] The system reads a pre-configured configuration file and constructs a global read-only rule object in memory to form a resource constraint mapping table. The global read-only rule object contains mappings from exception types to hardware resource types, from hardware resource types to minimum duration, and from business operation types to thread operation states.

[0020] Furthermore, the method for obtaining the candidate service entries is as follows:

[0021] For any unrelated anomaly entry, a time interval is determined with the anomaly capture time of the unrelated anomaly entry as the center and the duration of the preset time window as the radius, which serves as the time retrieval interval for the unrelated anomaly entry.

[0022] Business log entries whose business execution time interval overlaps with the time retrieval interval in the thread execution sequence, as well as business log entries located to the left of the time retrieval interval and whose end time differs from the left boundary time of the time retrieval interval by no more than twice the duration of the preset time window, are all considered as candidate business entries for the unassociated exception entry.

[0023] Furthermore, the method for obtaining the valid candidate service entries is as follows:

[0024] For any unassociated exception entry, compare the hardware resource type corresponding to the exception type of the unassociated exception entry with the thread operation state corresponding to the operation type of each candidate business entry. If the hardware resource type and the thread operation state are mutually exclusive, then the corresponding candidate business entry will be eliminated.

[0025] The remaining candidate business entries after removal will all be used as reference candidate business entries for the unassociated abnormal entry.

[0026] The minimum duration corresponding to the hardware resource type of the exception type of the unassociated exception entry is taken as the target duration.

[0027] Obtain the idle time slice between each reference candidate service entry and its next adjacent service log entry, and use it as the reference duration for each reference candidate service entry;

[0028] When the reference duration is less than the target duration, the corresponding reference candidate business item will be removed.

[0029] All remaining reference candidate business entries after removal will be considered as valid candidate business entries for the unassociated abnormal entry.

[0030] Furthermore, the method for obtaining the best matching business entry is as follows:

[0031] For any unrelated anomaly entry and any valid candidate service entry of that unrelated anomaly entry, the result of negatively correlating the difference between the anomaly capture time of the unrelated anomaly entry and the end time of the valid candidate service entry is taken as the degree of matching between the unrelated anomaly entry and the valid candidate service entry.

[0032] The valid candidate business entry with the highest matching degree is taken as the best matching business entry for the unrelated exception entry.

[0033] Furthermore, the method for injecting the exception stack and updating the business status information is as follows:

[0034] For any unrelated exception entry, inject the unrelated exception entry as an execution exception detail into its best matching business entry;

[0035] If the original business status of the best-matching business entry is characterized as successful or unknown, then the business status field of the best-matching business entry will be updated to an abnormal status.

[0036] Furthermore, the method for generating structured audit records is as follows:

[0037] For any unrelated anomaly entry, the normalized result of the time difference between the anomaly capture time of the unrelated anomaly entry and the end time of its best matching business entry is used as the correlation analysis value.

[0038] When the correlation analysis value is less than the preset correlation analysis threshold, the best matching business entry after injecting the exception stack and updating the business status information will be encapsulated to generate a structured audit record.

[0039] When the correlation analysis value is greater than or equal to the preset correlation analysis threshold, the uncorrelated abnormal entry is marked as system background noise.

[0040] Secondly, another embodiment of the present invention provides an automatic generation device for auditing system operation and maintenance logs. The device includes: a memory, a processor, and a computer program stored in the memory and running on the processor. When the processor executes the computer program, it implements the steps of any of the above methods.

[0041] The present invention has the following beneficial effects:

[0042] This invention first analyzes the log stream to distinguish between business log entries and unrelated exception entries, which helps eliminate differences in heterogeneous log formats and extract unified spatiotemporal coordinates. It then constructs a thread execution sequence using kernel thread identifiers as keys and calculates the idle time slices between adjacent business log entries in the thread execution sequence, achieving digital reconstruction of micro-level business trajectories and quantification of physical capacity. Next, it loads a resource constraint mapping table, defines the hardware resource types corresponding to exception types and their minimum durations, and establishes objective runtime resource constraint rule criteria that do not rely on historical statistical data. To ensure retrieval coverage and compensate for clock jitter, it further identifies candidate business entries for unrelated exception entries in the thread execution sequence based on a preset time window, effectively preventing the omission of the true cause business. Finally, to eliminate pseudo-related requests that are temporally close but mechanistically conflicting at the micro-scale, it utilizes the resource constraint mapping table to execute based on hardware resource types and minimum durations. The system performs rigorous verification to accurately analyze the physical compatibility between business operations and abnormal attributes, thereby accurately identifying valid candidate business entries for unrelated abnormal entries. This significantly reduces the attribution misjudgment rate in high-concurrency scenarios. To pinpoint the most probable causal relationship, the system obtains the best-matching business entry for unrelated abnormal entries based on the time difference between them and their valid candidate business entries, adhering to the principle of temporal locality of reference in program execution. Furthermore, the system retrieves the complete business context based on the best-matching business entry, effectively reconstructing the business semantics behind the technical failure. To correct state inconsistencies and preserve a complete chain of evidence, the system injects the abnormal stack and updates business state information, accurately and explicitly marking physical failure states. Finally, the system accurately generates structured audit logs, effectively improving the signal-to-noise ratio and accuracy of audit data. This ensures high-precision anomaly tracing without intrusion, contributing to the auditability and compliance security of critical business systems. Attached Figure Description

[0043] To more clearly illustrate the technical solutions and advantages in the embodiments of the present invention or the prior art, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0044] Figure 1 A schematic flowchart illustrating an automatic generation method for audit system operation and maintenance logs provided in one embodiment of the present invention;

[0045] Figure 2 A system structure diagram for automatically generating audit system operation and maintenance logs is provided as an embodiment of the present invention;

[0046] Figure 3This is a schematic diagram of a computer device provided according to an embodiment of the present invention. Detailed Implementation

[0047] To further illustrate the technical means and effects adopted by the present invention to achieve its intended purpose, the following, in conjunction with the accompanying drawings and preferred embodiments, details the specific implementation, structure, features, and effects of an automatic generation method and device for audit system operation and maintenance logs proposed according to the present invention. In the following description, different "one embodiment" or "another embodiment" do not necessarily refer to the same embodiment. Furthermore, specific features, structures, or characteristics in one or more embodiments can be combined in any suitable form.

[0048] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this invention pertains.

[0049] The following description, in conjunction with the accompanying drawings, details a specific solution for an automatic generation method and device for audit system operation and maintenance logs provided by the present invention.

[0050] Example 1:

[0051] This invention proposes a method for automatically generating operation and maintenance logs for an audit system. Please refer to [link / reference]. Figure 1 The diagram illustrates a schematic flowchart of an automatic generation method for audit system operation and maintenance logs according to an embodiment of the present invention. The method includes the following steps:

[0052] Step S1: Parse the log stream to distinguish between business log entries and unassociated exception entries, construct a thread execution sequence using the kernel thread identifier as the key, and calculate the idle time slice between adjacent business log entries in the thread execution sequence; load the resource constraint mapping table and define the hardware resource type and its minimum duration corresponding to the exception type.

[0053] Specifically, to achieve unified and standardized processing of heterogeneous and semi-structured log data, this embodiment parses the log stream to distinguish between business log entries and unrelated exception entries, which helps to eliminate differences in the original log format and extract key spatiotemporal coordinate information. To reconstruct the business execution trajectory at a micro-time scale, this embodiment constructs a thread execution sequence using the kernel thread identifier as the key, thereby accurately defining the business occupancy interval of each thread on the time axis. To quantify the physical capacity of threads during business gaps, this embodiment calculates the idle time slices between adjacent business log entries in the thread execution sequence, thereby providing an accurate data foundation for subsequent anomaly attribution based on physical spatiotemporal factors. Knowing that different types of anomalies necessarily depend on specific hardware resources and consume a certain amount of physical time, this embodiment loads a resource constraint mapping table to define the hardware resource types corresponding to the anomaly types and their minimum duration, thereby ensuring that subsequent logical verification has an objective basis.

[0054] It should be noted that, in order to ensure the effectiveness of physical verification at the micro-time scale, the log streams processed in this embodiment should come from the same operating system kernel or a shared monotonic clock source; if the logs come from different nodes, high-precision clock offset correction should be performed in advance to eliminate the impact of clock jitter on physical gap calculation in a distributed environment.

[0055] The specific method for parsing log streams to distinguish between business log entries and unrelated exception entries is as follows: The system collects the server's standard output stream or log file in real time, parses each log text, converts the log print time into a nanosecond-level absolute timestamp, and extracts the kernel thread identifier allocated by the operating system kernel from the log metadata. Based on this, the system classifies and constructs entries according to whether the log content carries an identifier: If the log contains a global request identifier, it is identified as a standard business log, and a business log entry containing the thread identifier, request identifier, operation type, start time, and end time is constructed. It should be noted that a business log entry represents an atomic execution segment or an uninterruptible micro-execution interval in which a thread continuously holds the CPU, rather than the entire logical lifecycle of the business request. The operation type is used for subsequent inference of the thread state; if the log lacks a global request identifier but contains exception stack traces, it is identified as an exception to be attributed, and an unrelated exception entry containing the thread identifier, exception type, and exception capture time is constructed.

[0056] The specific method for obtaining idle time slices is as follows: The system dynamically inserts the parsed business log entries into the corresponding thread execution sequence in ascending time order. Then, it iterates through the thread execution sequence. For two adjacent business log entries in the sequence, such as the i-th business log entry and the (i+1)-th business log entry, the difference between the end time of the i-th business log entry and the start time of the (i+1)-th business log entry is calculated and recorded as the first duration analysis value. When the first duration analysis value is greater than 0, it indicates that there is a real physical gap between the operations of the i-th business log entry and the (i+1)-th business log entry. At this point, the first duration analysis value is marked as the idle time slice between the i-th business log entry and the (i+1)-th business log entry. When the first duration analysis value is less than or equal to 0, it indicates that there is a time overlap between the operations of the i-th and (i+1)-th business log entries (such as asynchronous callbacks or nested calls). In this case, there is no gap at the physical level that can accommodate independent exceptions, and 0 is directly marked as the idle time slice between the i-th and (i+1)-th business log entries. This effectively avoids negative value calculation errors caused by time overlap in concurrent scenarios and ensures the robustness of the physical verification logic. It should be noted that the last business log entry in the thread execution sequence does not have a next adjacent business log entry, and therefore the last business log entry in the thread execution sequence is not analyzed.

[0057] In this embodiment, the specific method for loading the resource constraint mapping table is as follows: During the system startup phase, the system reads the preset configuration file and constructs a global read-only rule object in memory to form the resource constraint mapping table. The global read-only rule object contains the following three key physical constraint definitions: 1. Mapping relationship from exception type to hardware resource type: defining the hardware resource (e.g., network I / O resource) type that a specific exception depends on; 2. Mapping relationship from hardware resource type to minimum duration: defining the lower limit of physical time required for a specific hardware resource to experience an exception (e.g., network I / O exceptions take at least 1ms, while CPU exceptions take close to 0ms). It should be noted that the minimum duration does not refer to the purely theoretical physical duration at the hardware level, but rather to the observed statistical values ​​obtained from system benchmark tests, comprehensively considering actual environmental factors such as operating system scheduling latency, log framework writing overhead, and system clock accuracy, to ensure the effectiveness and robustness of the physical verification logic in a non-real-time operating system; 3. Mapping relationship from business operation type to thread operation state: defining the thread micro-state (e.g., waiting state) corresponding to a business operation (e.g., SQL query). Specifically, to prevent misjudgment of complex asynchronous business operations, for business operations that may involve asynchronous callbacks or multi-stage execution, their states are defined as composite states in the mapping table. This means that the operation may be in a computation or waiting state at a microscopic level, and strict single-state mutual exclusion checks are not performed on it; only explicit synchronous blocking operations are defined with a single mutual exclusion state. The above static rules provide deterministic logical criteria for subsequent steps that do not rely on historical statistical data.

[0058] Step S2: In the thread execution sequence, candidate business entries that are not associated with exception entries are selected based on a preset time window. Using the resource constraint mapping table, physical verification is performed based on hardware resource type and minimum duration to obtain valid candidate business entries for unassociated exception entries. Based on the time difference between unassociated exception entries and their valid candidate business entries, the best matching business entry for unassociated exception entries is obtained.

[0059] Specifically, considering that the logging time often has a slight system lag (such as system scheduling delay or log I / O write delay) relative to the actual physical time of the exception, in order to ensure that no real causal business requests are missed and to prevent missed judgments due to strict time alignment, candidate business entries without associated exception entries are selected in the thread execution sequence based on a preset time window. This is beneficial for accurately analyzing the potential causal range of each unassociated exception entry and ensuring retrieval coverage. In this embodiment, the duration of the preset time window is set to be based on the average write latency jitter or NTP synchronization accuracy statistics of the log system (e.g., 1ms to 5ms). The duration of the preset time window should cover the clock uncertainty during normal system operation. Implementers can set the duration of the preset time window according to the actual situation, and it is not limited here.

[0060] To accurately identify and eliminate pseudo-related business requests that are close in time but cannot generate corresponding anomalies in terms of physical mechanism, and to ensure that the attribution results conform to the physical axioms of the underlying computer operation, a resource constraint mapping table is used to perform physical verification based on hardware resource type and minimum duration. This is because different instruction flow states (such as CPU computation) and specific hardware resources (such as network I / O) are physically mutually exclusive, and the occurrence of any hardware anomaly must consume an incompressible physical time. This allows for the acquisition of valid candidate business entries that are not associated with anomaly entries, effectively improving the logical confidence and noise resistance of the attribution analysis.

[0061] Considering that in a single-threaded model, exceptions are usually triggered by the last failed instruction, the exception capture time and the end time of the causal business are highly close in time. Therefore, based on the time difference between the unrelated exception entry and its valid candidate business entry, the best matching business entry of the unrelated exception entry can be obtained, and the business operation with the strongest causal relationship with the exception can be accurately determined, which is conducive to the subsequent construction of an accurate fault evidence chain.

[0062] Preferably, in one implementable method of this embodiment, the method for obtaining candidate business entries is as follows: For any unassociated exception entry, a time interval is determined with the exception capture time of the unassociated exception entry as the center and the duration of a preset time window as the radius, which serves as the time retrieval interval for the unassociated exception entry. It should be noted that the design of this time retrieval interval fully considers the bidirectional clock drift phenomenon in the distributed system, that is, it not only covers the general case where the exception occurs after the business ends, but also covers the special case where the exception record timestamp is earlier than the business end timestamp due to the clock of the node recording the exception being ahead. Thus, business log entries in the thread execution sequence where the business execution time interval and the time retrieval interval overlap are all taken as candidate business entries for the unassociated exception entry, minimizing the risk of missed judgment caused by clock asynchrony.

[0063] Furthermore, considering that anomalies may occur during the callback phase immediately after a business operation ends, and that clock drift may cause the business end time recorded in the log to be earlier than the retrieval interval, this embodiment further includes business log entries located to the left of the time retrieval interval whose end time differs from the left boundary of the time retrieval interval by no more than twice the preset time window length as candidate business entries for the unassociated anomaly entry. The purpose of setting the preset time window length to twice the preset time window length in this embodiment is to compensate for the maximum possible bidirectional clock drift between the business end time and the anomaly capture time, ensuring that even in extreme clock asynchrony scenarios where business logs are recorded earlier and anomaly logs are recorded later, the actual causative business located on the preceding timeline can be included in the retrieval scope, preventing missed detections.

[0064] Preferably, in one feasible implementation of this embodiment, the method for obtaining valid candidate service entries is as follows: For any unassociated exception entry, the hardware resource type corresponding to the exception type of the unassociated exception entry is compared with the thread operation state corresponding to the operation type of each candidate service entry. This is because the execution state of the underlying computer instruction is exclusive, that is, the CPU can only execute one type of instruction operation at the same micro-moment (for example, it cannot handle IO interrupts at the same time when performing arithmetic logic operations). Furthermore, if the hardware resource type and the thread operation state are mutually exclusive and the thread operation state is not a composite state, the corresponding candidate service entry is eliminated, because a thread in a pure computing state cannot physically generate an exception that depends on external devices (such as a network IO interrupt) at the same time. The remaining candidate service entries after elimination are all used as reference candidate service entries for the unassociated exception entry, which is beneficial for subsequent fine-grained verification based on time capacity and reduces computational overhead.

[0065] Meanwhile, considering that the occurrence of any physical anomaly must occupy a certain amount of physical time, in order to eliminate pseudo-related services where the physical gap is insufficient to accommodate the occurrence of the anomaly, the minimum duration corresponding to the hardware resource type of the anomaly type of the unrelated anomaly entry is taken as the target duration. Then, the idle time slice between each reference candidate service entry and its next adjacent service log entry is obtained as the reference duration of each reference candidate service entry. When the reference duration is less than the target duration, it means that the physical idle time after the service operation of the corresponding reference candidate service entry is too short and insufficient to support the complete occurrence process of the type anomaly of the unrelated anomaly entry at the physical level. Therefore, the corresponding reference candidate service entry is removed to avoid misjudging adjacent services due to time coincidence as anomaly attribution. Finally, the remaining reference candidate service entries after removal are all taken as valid candidate service entries for the unrelated anomaly entry.

[0066] Preferably, in one feasible embodiment of this invention, the method for obtaining the best matching business entry is as follows: for any unrelated anomaly entry and any valid candidate business entry of that unrelated anomaly entry, the absolute value of the difference between the anomaly capture time of the unrelated anomaly entry and the end time of the valid candidate business entry is negatively correlated, and the result is used as the matching degree between the unrelated anomaly entry and the valid candidate business entry; the greater the matching degree, the closer the unrelated anomaly entry and the valid candidate business entry are in time sequence, and the higher the probability of causal association; this embodiment uses... The absolute value of the difference between the anomaly capture time of the unassociated anomaly entry and the end time of the valid candidate service entry is negatively correlated. Here, norm is the max-min normalization function, and x represents the absolute value of the difference between the anomaly capture time of the unassociated anomaly entry and the end time of the valid candidate service entry. The max-min normalization method is a well-known technique and will not be elaborated further. It should be noted that when using max-min normalization, if there is only one element in the candidate set, or the time difference values ​​of all elements are the same (i.e., the maximum value equals the minimum value), in order to avoid the calculation error of zero denominator, the system directly sets the matching degree to the preset default maximum value (such as 1), or skips the normalization step and directly uses the original time difference for threshold determination.

[0067] In order to follow the principle of temporal locality of program execution, the most likely causative operation is identified, so that the attribution result focuses on the most recent execution behavior. Then, the valid candidate business entry corresponding to the highest degree of matching is taken as the best matching business entry for the unrelated exception entry.

[0068] At this point, the best matching business entry for each unassociated exception entry is obtained. It should be noted that if there is no candidate business entry for an unassociated exception entry, the unassociated exception entry is determined to be system-level background noise unrelated to the current business flow (such as an exception caused by the operating system kernel's heartbeat detection timeout or background garbage collection), and the unassociated exception entry is marked as an unassociated exception, without being forcibly associated with any business operation, to prevent the generation of incorrect causal chains.

[0069] Step S3: Retrieve the complete business context based on the best matching business entry, inject the exception stack and update the business status information, and generate a structured audit record.

[0070] Specifically, to convert the physical attribution results at the technical level into audit credentials with business semantics, ensuring that auditors can trace the complete business scenario in which the anomaly occurred, and then retrieve the complete business context based on the best-matching business entries, the index built in step S1 is used to quickly trace back the operation subject, parameters, and resource objects of each request without associated anomaly entries; to correct the inconsistency between the original log state and the physical execution result caused by asynchronous execution, anomaly stacks are injected and business state information is updated, error details captured at the physical layer are supplemented to the business logic layer, and successful or unknown intermediate states are corrected and marked, ultimately generating structured audit records, forming compliant audit data containing the real execution result and a complete chain of evidence, ensuring that the generated logs truly reflect the final physical state of the business transaction, which is conducive to meeting the stringent requirements of compliance audits for data integrity and accuracy.

[0071] Preferably, in one feasible manner of this embodiment, the method for injecting the exception stack and updating the business status information is as follows: For any unassociated exception entry, the unassociated exception entry is injected as execution exception details into its best-matching business entry to enrich the error details of the business context; at the same time, the original business status of the best-matching business entry is checked to determine whether it is consistent with the actual physical execution result; if the original business status of the best-matching business entry represents success or unknown, it means that the original business log corresponding to the best-matching business entry failed to capture the underlying asynchronous exception. At this time, the system does not directly overwrite the original state, but updates the business status field of the best-matching business entry to the exception state, so that while retaining the original evidence, the final physical failure state of the business request of the best-matching business entry is explicitly marked.

[0072] Preferably, in one feasible manner of this embodiment, the method for generating structured audit records is as follows: for any unassociated anomaly entry, the result of linearly normalizing the time difference between the anomaly capture time of the unassociated anomaly entry and the end time of its best-matching business entry is used as the correlation analysis value (the normalization benchmark is a preset maximum tolerable delay duration, such as 100ms), which accurately reflects the temporal confidence of the attribution determination; wherein, the linear normalization method is a well-known technique and will not be described in detail; in order to ensure the accuracy of correlation while taking into account the tolerance for anomaly delay, this embodiment sets a preset correlation analysis threshold (e.g., 0.8) based on the business's sensitivity to delay. The preset correlation analysis threshold corresponds to the effective correlation interval on the physical time axis (e.g., if the benchmark is 100ms, then 0.8 corresponds to a delay within 80ms being considered a valid correlation). The implementer can set the size of the preset correlation analysis threshold according to the actual situation, which is not limited here;

[0073] When the correlation analysis value is less than the preset correlation analysis threshold, it indicates that the business operation of the unrelated anomaly entry is tightly coupled in time with its best-matching business entry, and the attribution result is highly credible. In order to solidify this high-confidence evidence, the best-matching business entry, based on the injected anomaly stack and updated business status information, is then encapsulated to generate a structured audit record. When the correlation analysis value is greater than or equal to the preset correlation analysis threshold, it indicates that the occurrence time of the unrelated anomaly entry is too far from the business end time of its best-matching business entry, and has deviated from the reasonable causal context. In order to prevent low-confidence erroneous correlations from polluting the audit data, the unrelated anomaly entry is then marked as system background noise, ensuring that the correlation records output by the audit system have a high degree of causal certainty and effectively avoiding misleading the troubleshooting direction of maintenance personnel.

[0074] In summary, this embodiment parses the log stream to distinguish between business log entries and unassociated exception entries, constructs a thread execution sequence, and calculates the idle time slices between adjacent business log entries in the thread execution sequence; it loads a resource constraint mapping table that defines hardware resource types and minimum durations; it identifies candidate business entries for unassociated exception entries based on time windows, and uses the resource constraint mapping table to perform physical checks on mutual exclusion and capacity to filter out valid candidate business entries; based on the time difference between unassociated exception entries and their valid candidate business entries, it filters the best-matching business entry, then backtracks the business context, injects the exception stack and corrects the state, generating structured audit records. This invention achieves non-intrusive and high-precision exception attribution based on runtime resource constraint rules, improving the integrity and accuracy of audit data.

[0075] Example 2:

[0076] This invention also proposes an automatic generation system for audit system operation and maintenance logs; please refer to [link / reference]. Figure 2 The diagram illustrates an automatic generation system structure for audit system operation and maintenance logs provided by an embodiment of the present invention. The system includes: a data acquisition module 10, a business matching module 20, and a data processing module 30.

[0077] The data acquisition module 10 is used to parse the log stream to distinguish between business log entries and unassociated exception entries, construct a thread execution sequence with the kernel thread identifier as the key, and calculate the idle time slice between adjacent business log entries in the thread execution sequence; load the resource constraint mapping table and define the hardware resource type and its minimum duration corresponding to the exception type.

[0078] The business matching module 20 is used to identify candidate business entries that are not associated with exception entries in the thread execution sequence based on a preset time window, and to perform physical verification based on hardware resource type and minimum duration using a resource constraint mapping table to obtain valid candidate business entries for unassociated exception entries; and to obtain the best matching business entry for unassociated exception entries based on the time difference between the unassociated exception entries and their valid candidate business entries.

[0079] The data processing module 30 is used to retrieve the complete business context based on the best matching business entry, inject the exception stack and update the business status information, and generate structured audit records.

[0080] It should be noted that the system provided in the above embodiments is only an example of the division of the above functional modules. In practical applications, the above functions can be assigned to different functional modules as needed, that is, the internal structure of the computer device can be divided into different functional modules to complete all or part of the functions described above. In addition, the automatic generation system for audit system operation and maintenance logs and the automatic generation method for audit system operation and maintenance logs provided in the above embodiments belong to the same concept, and their specific implementation process is detailed in the method embodiments, which will not be repeated here.

[0081] Example 3:

[0082] This invention also proposes an automatic generation device for audit system operation and maintenance logs. The device includes a memory and a processor. The memory stores executable program code, and the processor calls and executes the executable program code to perform an automatic generation method for audit system operation and maintenance logs provided in the embodiments of this application. Specifically, the device may be a chip, component, or module. The chip may include a connected processor and memory; the memory stores instructions, and when the processor calls and executes the instructions, the chip can execute the automatic generation method for audit system operation and maintenance logs provided in the above embodiments.

[0083] In addition, this embodiment also protects a computer device; please refer to [link to relevant documentation]. Figure 3 The computer device includes a memory 401, a processor 402, and a computer program 403 stored in the memory 401 and running on the processor 402. When the processor 402 executes the computer program 403, the computer device can execute any of the aforementioned methods for automatically generating audit system operation and maintenance logs.

[0084] Example 4:

[0085] The present invention also provides a computer-readable storage medium storing computer program code, which, when executed on a computer, causes the computer to perform the aforementioned method steps to implement the automatic generation method for audit system operation and maintenance logs provided in the above embodiments.

[0086] Example 5:

[0087] The present invention also provides a computer program product that, when run on a computer, causes the computer to perform the aforementioned related steps to realize the automatic generation method for audit system operation and maintenance logs provided in the above embodiments.

[0088] In this embodiment, the device, computer-readable storage medium, computer program product, or chip are all used to execute the corresponding methods provided above. Therefore, the beneficial effects they can achieve can be referred to the beneficial effects in the corresponding methods provided above, and will not be repeated here.

[0089] It should be noted that the order of the above embodiments of the present invention is merely for descriptive purposes and does not represent the superiority or inferiority of the embodiments. The processes depicted in the accompanying drawings do not necessarily require a specific or sequential order to achieve the desired result. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0090] The various embodiments in this specification are described in a progressive manner. The same or similar parts between the various embodiments can be referred to each other. Each embodiment focuses on describing the differences from other embodiments.

Claims

1. A method for automatically generating operation and maintenance logs of an audit system, characterized in that, The method includes the following steps: The log stream is parsed to distinguish between business log entries and unrelated exception entries. A thread execution sequence is constructed using the kernel thread identifier as the key, and the idle time slice between adjacent business log entries in the thread execution sequence is calculated. The resource constraint mapping table is loaded to define the hardware resource type and its minimum duration corresponding to the exception type. In the thread execution sequence, candidate business entries that are not associated with exception entries are identified based on a preset time window. Then, using a resource constraint mapping table, physical verification is performed based on hardware resource type and minimum duration to obtain valid candidate business entries that are not associated with exception entries. Based on the time difference between the unassociated exception entries and their valid candidate business entries, the best matching business entry for the unassociated exception entries is obtained. Retrieve the complete business context based on the best-matching business entry, inject the exception stack and update the business status information to generate structured audit records; The method for obtaining the valid candidate service entries is as follows: For any unassociated exception entry, compare the hardware resource type corresponding to the exception type of the unassociated exception entry with the thread operation state corresponding to the operation type of each candidate business entry. If the hardware resource type and the thread operation state are mutually exclusive, then the corresponding candidate business entry will be eliminated. The remaining candidate business entries after removal will all be used as reference candidate business entries for the unassociated abnormal entry. The minimum duration corresponding to the hardware resource type of the exception type of the unassociated exception entry is taken as the target duration. Obtain the idle time slice between each reference candidate service entry and its next adjacent service log entry, and use it as the reference duration for each reference candidate service entry; When the reference duration is less than the target duration, the corresponding reference candidate business item will be removed. All remaining reference candidate business entries after removal will be considered as valid candidate business entries for the unassociated abnormal entry.

2. The method for automatically generating audit system operation and maintenance logs as described in claim 1, characterized in that, The method for distinguishing business log entries from unrelated exception entries in the parsed log stream is as follows: Real-time parsing of log text, conversion of log printing time into nanosecond-level absolute timestamps, and extraction of kernel thread identifiers; If the log contains a global request identifier, then construct a business log entry containing the thread identifier, request identifier, operation type, start time, and end time; If the log lacks a global request identifier but contains exception stack traces, then an unassociated exception entry containing the thread identifier, exception type, and the time the exception was caught is constructed.

3. The method for automatically generating audit system operation and maintenance logs as described in claim 1, characterized in that, The method for obtaining the idle time slice is as follows: Insert business log entries into the thread execution sequence in ascending time order, traverse the thread execution sequence, and calculate the difference between the end time of the i-th business log entry and the start time of the (i+1)-th business log entry as the first duration analysis value. When the first duration analysis value is greater than 0, the first duration analysis value is marked as the idle time slice between the i-th business log entry and the (i+1)-th business log entry; When the first duration analysis value is less than or equal to 0, 0 is marked as an idle time slice between the i-th business log entry and the (i+1)-th business log entry.

4. The method for automatically generating audit system operation and maintenance logs as described in claim 1, characterized in that, The method for loading the resource constraint mapping table is as follows: The system reads a pre-configured configuration file and constructs a global read-only rule object in memory to form a resource constraint mapping table. The global read-only rule object contains mappings from exception types to hardware resource types, from hardware resource types to minimum duration, and from business operation types to thread operation states.

5. The method for automatically generating audit system operation and maintenance logs as described in claim 2, characterized in that, The method for obtaining the candidate service entries is as follows: For any unrelated anomaly entry, a time interval is determined with the anomaly capture time of the unrelated anomaly entry as the center and the duration of the preset time window as the radius, which serves as the time retrieval interval for the unrelated anomaly entry. Business log entries whose business execution time interval overlaps with the time retrieval interval in the thread execution sequence, as well as business log entries located to the left of the time retrieval interval and whose end time differs from the left boundary time of the time retrieval interval by no more than twice the duration of the preset time window, are all considered as candidate business entries for the unassociated exception entry.

6. The method for automatically generating audit system operation and maintenance logs as described in claim 1, characterized in that, The method for obtaining the best matching business entry is as follows: For any unrelated anomaly entry and any valid candidate service entry of that unrelated anomaly entry, the result of negatively correlating the difference between the anomaly capture time of the unrelated anomaly entry and the end time of the valid candidate service entry is taken as the degree of matching between the unrelated anomaly entry and the valid candidate service entry. The valid candidate business entry with the highest matching degree is taken as the best matching business entry for the unrelated exception entry.

7. The method for automatically generating audit system operation and maintenance logs as described in claim 1, characterized in that, The method for injecting the exception stack and updating the business status information is as follows: For any unrelated exception entry, inject the unrelated exception entry as an execution exception detail into its best matching business entry; If the original business status of the best-matching business entry is characterized as successful or unknown, then the business status field of the best-matching business entry will be updated to an abnormal status.

8. The method for automatically generating audit system operation and maintenance logs as described in claim 1, characterized in that, The method for generating structured audit records is as follows: For any unrelated anomaly entry, the normalized result of the time difference between the anomaly capture time of the unrelated anomaly entry and the end time of its best matching business entry is used as the correlation analysis value. When the correlation analysis value is less than the preset correlation analysis threshold, the best matching business entry after injecting the exception stack and updating the business status information will be encapsulated to generate a structured audit record. When the correlation analysis value is greater than or equal to the preset correlation analysis threshold, the uncorrelated abnormal entry is marked as system background noise.

9. An automatic generation device for auditing system operation and maintenance logs, comprising a memory, a processor, and a computer program stored in the memory and running on the processor, characterized in that, When the processor executes the computer program, it implements the steps of the automatic generation method for audit system operation and maintenance logs as described in any one of claims 1-8.

Images