Log information management method and system

[0042] The present invention will be further described in detail below in conjunction with the drawings and specific embodiments.

[0043] The present invention provides a log information management system, which includes a log request processing module and a log information processing module. The log request processing module is responsible for constructing a log detection request and output to the log information processing module; the log information processing module completes the log detection processing according to the received log detection request, and detects that the log information storage state exceeds the preset log When the status threshold is stored, unimportant log information is deleted. Wherein, the log request processing module can be further used to construct a log access request and output to the log information processing module, and the log information processing module can be further used to access the log information database according to the received log access request; here, The log request processing module includes: an access request module and a detection request module, and the log information processing module includes: a log access module and a log detection module.

[0044] Because, when the log request processing module concurrently constructs a large number of log access requests and/or log detection requests, if the constructed request is directly sent to the log information processing module, it is difficult for the log information processing module to process a large number of requests in time. In this way, There will be cases where the request is lost, or even the system is paralyzed due to insufficient resources. Therefore, the log request processing module further includes: a log request caching module for caching log access requests and/or log detection requests, and the log information processing module further includes: for extracting from the log request caching module Log request monitoring module for log access request and/or log detection request.

[0045] figure 1 It is a schematic diagram of the composition structure of a preferred embodiment of the system of the present invention. Such as figure 1 As shown, the system includes: a log request processing module 110 and a log information processing module 120; the log request processing module 110 includes: an access request module 111, a detection request module 112, and a log request cache module 113; the log information processing module 120 includes: a log access module 121, a log detection module 122, and a log request monitoring module 123. In this embodiment, since the log access module 121 and the log detection module 122 will respectively return the access result and the detection result of the log information after completing the log information access and detection tasks; therefore, the log information processing module 120 further The log feedback caching module 124 is included, and the log request processing module 110 further includes a log feedback monitoring module 114. The log feedback caching module 124 and the log feedback monitoring module 114 can respectively send the access result and the detection result to the access request Module 111 and detection request module 112.

[0046] Among them, the access request module 111 is used to construct a log access request according to the access request received from an external application and output to the log request caching module 113; the detection request module 112 is used to periodically construct a log detection request and output it to the log request caching module 113; The log request caching module 113, upon receiving a log access request and/or a log detection request, caches the request and sends a notification message to the log request monitoring module 123. The log request monitoring module 123 is used to extract log access requests and/or log detection requests from the log request cache module 113 after receiving the notification from the log request cache module 113, identify the extracted requests and output them to the log access module 121 and/or log detection module 122; log detection module 122, used to detect the log information database after receiving a log detection request from the log request monitoring module 123, and delete when the log information storage status exceeds the log storage status threshold Part or all of the unimportant log information, and when necessary, the detection result of the log information is sent to the log feedback cache module 124; the log access module 121 is used to perform the log information database according to the log access request from the log request cache module 123 The access includes operations such as creation, modification, and query, and the access result, especially the result of querying log information, is sent to the log feedback cache module 124. The log feedback caching module 124 receives the access results and/or detection results from the log access module 121 and/or the log detection module 122, caches and sends a notification message to the log feedback monitoring module 114; the log feedback monitoring module 114 receives After the notification from the log feedback cache module 124, the access result and/or detection result are extracted from the log feedback cache module 124, the extracted information is identified and sent to the access request module 111 and/or the detection request module 112.

[0047] Based on the above composition structure of the log information management system of the present invention, the processing of the method of the present invention includes two relatively independent processes: a log detection process and a log access process. The log detection process is mainly completed by a detection request module, a log request caching module, a log request monitoring module, and a log detection module; the log access process is mainly completed by an access request module, a log request caching module, a log request monitoring module, and Log access module to complete. Wherein, the information exchanged between the modules, such as log access requests, log detection requests, etc., can be carried by log message frames, and the log request buffer module can receive/send log message frames using the buffer mechanism of the message queue.

[0048] When the log information management system is started, it will automatically read the configuration information related to the log, including: the classification of the log, the log storage status threshold of various logs, the log detection cycle, etc., and the detection timer and initialization message are started according to the log detection cycle. Queue and so on, and then the system begins to prepare to execute the log access and/or log detection process. Here, how to complete the relevant information configuration and initialization process when the system is started is a well-known technology and will not be described in detail here. Combine below Figure 2 to Figure 4 The log access and log detection process of the method of the present invention will be described in detail.

[0049] figure 2 It is a schematic diagram of the processing flow of a preferred embodiment of the log access process in the method of the present invention. Such as figure 2 As shown, the specific processing includes:

[0050] Step 201: The access request module starts the log access process after receiving the access request of the external application. The module constructs the log access request according to the received access request, and the request is carried by the log access message frame.

[0051] Among them, the access request sent by the application includes at least: the nature of the access and the content of the log information. The access nature is information indicating what kind of operation is performed on the log information database, and the operation can be: creation, query, or modification, etc., wherein the so-called creation is to add a new log information record in the log information database, the so-called Query refers to matching the log information records that meet the query conditions from the log information database, and the so-called modification refers to modifying the value of a record item in the log information record in the log information database. The log information content is information indicating which content of the log information database is to be accessed, for example: for an access request indicating creation, the log information content is the log information record content that needs to be added; for an access request indicating a query In other words, the log information content indicates the query conditions and the log information record items that are required to be output; for the access request that indicates modification, the log information content indicates which log information records are modified and the value after the modification. .

[0052] The log access message frame constructed in this step should at least contain the access nature and log information content of the access request sent by the application, and the message frame also contains the identity of the module from which it originated, that is, the identity of the access request module.

[0053] Step 202: The access request module outputs the log access message frame constructed by itself to the log request buffer module, and the log request buffer module adds the message frame to the message queue.

[0054] Step 203: When the message frame in step 202 is added to the message queue, the notification event of the log request buffer module will be triggered, and the module will immediately send a notification to the log request monitoring module. The log request monitoring module extracts log message frames from the log request caching module after receiving the notification.

[0055] Step 204: The log request monitoring module determines whether the log message frame extracted in step 203 is a log access message frame, and if it is, execute step 205; otherwise, the current process is ended.

[0056] Here, it can be judged whether the message frame is a log access message frame according to whether the log message frame contains the identifier of the access request module.

[0057] Step 205: The log request monitoring module sends the log access message frame to the log access module, and the log access module operates the log information database according to the received log access message frame.

[0058] Here, the access nature and log information content contained in the log access message frame will instruct the log access module to create, modify, or query the log information table in the log information database. How to complete this processing is a well-known technology. This article will not describe it further.

[0059] image 3 It is a schematic diagram of the processing flow of a preferred embodiment of the log detection process in the method of the present invention. Such as image 3 As shown, the specific processing includes:

[0060] Step 301: The detection timer in the detection request module periodically constructs a log access request according to a pre-configured detection period. The request is carried by a log detection message frame, and the log detection message frame contains the identification of the detection request module.

[0061] Step 302: The detection request module outputs the log detection message frame constructed by itself to the log request buffer module, and the log request buffer module adds the message frame to the message queue.

[0062] Step 303: When the message frame in step 302 is added to the message queue, the notification event of the log request buffer module will be triggered, and the module will immediately send a notification to the log request monitoring module. The log request monitoring module extracts log message frames from the log request caching module after receiving the notification.

[0063] Step 304: The log request monitoring module determines whether the log message frame extracted in step 303 is a log detection message frame, and if so, execute step 305; otherwise, end the current process. Here, it can be judged whether the message frame is a log detection message frame according to whether the log message frame contains the identification of the detection request module.

[0064] when figure 2 The log access process described is the same as image 3 When the log detection process is processed in parallel, the log request buffer module buffers the received log access message frames and log detection message frames in the message queue, and sends a message frame to the log request monitoring module every time a message frame is received Notification, the log request monitoring module extracts the log message frame from the message queue every time it receives the message frame notification, and identifies whether the log message frame is a log access message frame or a log detection message frame according to the module identifier carried in the log message frame. Thereby choosing whether to send the message frame to the log access module or the log detection module. In this way, the loss of message frames can be basically avoided, and each message frame can be processed in time. In addition, because the log request monitoring module uniformly calls the log access module and the log detection module by identifying the log message frame, it can also avoid the deadlock that is prone to occur when the log access module and the log detection module access the log information database at the same time, thereby ensuring the log The security of the information system.

[0065] Step 305: The log request monitoring module sends the log detection message frame to the log detection module, and the log detection module detects the log information table in the log information library, and when the storage status of the log information exceeds the pre-configured log storage status gate Within a limited time, delete some or all of the unimportant log information.

[0066] Among them, the log information is stored in the log information database in the form of a log information table. Every time an application program sends an access request indicating creation to the log information management system, the system adds a log information record to the log information table. The record items included in the log information record include information such as storage time, equipment, command, command processing status, etc., and the log information record item may indicate the attribute of the log information. The pre-configured log storage state threshold may be a storage time threshold and/or a record number threshold. According to the log storage state threshold, the log detection module can directly query the log information database by configuring query conditions to determine whether there is a storage time for log information Exceeding the threshold or whether the number of log information records exceeds the threshold. In addition, when it is detected that the current log information storage status exceeds the log storage status threshold, delete log information whose log information attributes are not important. For example, generally, the earlier the log information is saved, the less important it is. You can save according to the log information attributes. Time, delete one or more log information records with the earliest storage time according to the principle of deleting the earliest storage time first.

[0067] Here, the specific processing procedures of the configuration query condition querying the log information database, determining whether the log information storage status exceeds the log storage status threshold, and deleting the log information according to the log information attributes are known technologies and will not be described in further detail here.

[0068] In order to make log information management more flexible, the present invention also saves the characteristics of different types of log information, divides the log information into several categories in advance, and configures the log storage status thresholds of each type of log information respectively, and then according to the log information of various types The log storage status threshold classifies and detects log information. In this way, the log storage status thresholds of several types of more important log information can be set higher, and the log information library can store more and/or longer time important log information, thereby making full use of the limited storage space. Among them, the log information can be classified according to the attributes of the log information, for example, by storage time period, or by device type, or by command type, or by command processing status, or by a combination of the four. Combine below Figure 4 The process of classifying and detecting log information by the log detection module in step 305 is described in detail.

[0069] Figure 4 for image 3 The processing flow diagram of a preferred embodiment of the processing of the detection log information. Such as Figure 4 As shown, the specific processing includes:

[0070] Step 401: The log detection module queries the log information database according to the pre-configured record quantity threshold of various types of log information, and judges whether one or more types of log information exceeds the record quantity threshold of its own category, and if so, execute step 402; Otherwise, step 403 is executed.

[0071] Step 402: According to the storage time of the log information, delete one or more log information records with the earliest storage time among the log information that exceeds the threshold of the number of records of this type. Here, the system is configured to specifically delete several pieces of log information in advance, and all the log information that exceeds the record number threshold can be deleted, or part of the log information can be deleted, which is not limited by the present invention.

[0072] Step 403: The log detection module queries the log information database according to the pre-configured storage time thresholds of various types of log information, and determines whether one or more types of log information exceeds the storage time threshold of its own category, and if so, execute step 404; Otherwise, the current processing ends.

[0073] Step 404: According to the storage time of the log information, delete one or more log information records with the earliest storage time among the log information that exceeds the storage time threshold of this type. Here, the system is configured to specifically delete several pieces of log information in advance, and all the log information that exceeds the storage time threshold can be deleted, or part of the log information can be deleted, which is not limited by the present invention.

[0074] Figure 4 In the described embodiment, the log storage state threshold includes: a record number threshold and a storage time threshold. In the actual processing process, the present invention does not limit whether to judge the record number threshold or the storage time threshold first. Therefore, step 403 and step 404 can also be performed first, and then step 401 and step 402; or, step 401 and step 402, It is executed in parallel with step 403 and step 404. In addition, the log storage state threshold may also be only: the number of records threshold or the storage time threshold, correspondingly, only step 401 and step 402 are executed, or only step 403 and step 404 are executed.

[0075] Above image 3 with Figure 4 In the process, the detection request module periodically constructs a log detection message frame, thereby initiating the log detection process. The system can also pre-configure the trigger condition of the log detection process, and start to execute the log detection process when the trigger condition is met. For example: You can set the trigger condition to reconfigure the log storage status threshold. Since, when the log storage state threshold is modified, the existing log information is likely to exceed the modified log storage state threshold, so a log detection process needs to be performed. Therefore, the trigger condition is usually set to log storage state threshold reconfiguration, and the detection request module constructs a log detection message frame after learning that the log storage state threshold is reconfigured, thereby triggering image 3 with Figure 4 In the log detection process, the log information is detected and cleared again according to the updated log storage state threshold. Here, how the detection request module learns the log storage state threshold reconfiguration method is a well-known technology and is not the focus of the present invention, so it will not be described in detail.

[0076] In the processing of the log access process and the log detection process described above, the processing result information is not returned to the user, which is feasible for general creation, modification, and normal detection operations. But for the query operation, the system must return the query result to the user; and when a serious problem is detected, it also needs to return the test result to the user. Therefore, after the log access module and the log detection module respectively complete the log access processing and the log detection processing, the access results and the detection results can be further constructed into log message frames and sent to the log feedback cache module, and the log feedback cache module Add the log message frame to its own message queue, and send the message frame notification to the log feedback monitoring module. The log feedback monitoring module then extracts the log message frame from the message queue of the log feedback cache module, and identifies whether it is an access result message frame or a detection result message frame according to the content of the message frame, and then sends the access result message frame and the detection result message frame separately To the access request module and the detection request module, the access request module and the detection request module respectively display the received access result and detection result to the user. Here, the specific method of returning the access result and the detection result to the user is a well-known technology, so no further description will be given.

[0077] Since the existing log information is usually stored in the same database as other configuration information of the application software system, when the system is uninstalled or upgraded, the log information will also be deleted along with other configuration information. In this way, after the system is uninstalled or upgraded, the log information before the uninstallation or upgrade cannot be obtained, so that the system failures after the uninstallation or upgrade cannot be analyzed based on the log information before the uninstallation or upgrade, and the system failures after the uninstallation or upgrade cannot be analyzed. problem. Therefore, the log information database of the present invention is an independently set database, and the log information database is still retained when the application software system is uninstalled or upgraded; and when the application software system is installed, the application software installation module automatically determines whether there is a log currently Information database, if yes, use the existing log information database; otherwise, create a log information database. Here, how the application software installation module performs the judgment and the method of establishing the log information database is a well-known technology and will not be described in detail in this article.

[0078] In summary, the application of the method and system of the present invention can realize the detection of log information, and can automatically delete unimportant log information when it detects that the storage state of the log information exceeds the log storage state threshold, and the log information detection mechanism is here. The access to log information can be facilitated on the basis of. Among them, the detection of log information can be triggered regularly or by conditions, and classification detection can be realized, so that the detection process can be flexibly started, and different log storage status thresholds can be set according to the characteristics of various log information, and the database storage space can be effectively used Save log information.

[0079] The above descriptions are only preferred embodiments of the present invention, and are not used to limit the protection scope of the present invention. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present invention are all included in the protection scope of the present invention.