Log monitoring adding method and device, computer device and storage medium

Abstract

Embodiments of the present application disclose a log monitoring adding method and device, computer equipment and a storage medium, relating to the technical field of computer data processing. The method comprises: receiving a monitoring template submitted by a target user; identifying the monitoring template to obtain monitoring configuration information; generating a target monitoring item according to the monitoring configuration information; scanning a server to query an initial monitoring item currently running, comparing the target monitoring item with the initial monitoring item, and judging whether the target monitoring item already exists in the initial monitoring item; and if not, establishing a log monitoring task based on the target monitoring item. The method provides a monitoring template, realizes front-end and back-end interaction, can automatically establish a log monitoring task after a user batch imports monitoring information, does not need to manually add a large number of monitoring items, reduces the workload of the user, and prevents repeated addition of log monitoring tasks by checking the monitoring information, thereby avoiding waste of system resources and improving monitoring efficiency and effectiveness.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computer data processing, and in particular to a log monitoring adding method and device, computer equipment and a storage medium. BACKGROUND

[0002] Log monitoring maintenance is an important part of operation and maintenance work. At present, there are various log monitoring platforms in the operation and maintenance field, which are mainly used to access various business systems, monitor system logs, and help operation and maintenance personnel discover system abnormalities in time through emails or telephone calls, facilitate operation and maintenance personnel to query required logs, and count log data. In order to obtain system abnormal information in time through log alarms, operation and maintenance personnel need to add a large number of monitoring items to monitor all log contents that need to be concerned, and at the same time, these monitoring items also need to be effectively managed to achieve accurate and efficient monitoring and alarming.

[0003] At present, the method for adding log monitoring is basically manual import of monitoring information by operation and maintenance personnel, and the added monitoring information cannot be effectively identified and deduplicated, resulting in the existence of some repeated monitoring in the log system, reducing the effectiveness of monitoring, increasing the probability of repeated alarms, and also increasing the work burden of operation and maintenance personnel. SUMMARY

[0004] The technical problem to be solved by the embodiments of the present application is to provide a log monitoring adding method, device, computer equipment and storage medium, to reduce the workload when establishing log monitoring, and to improve the monitoring efficiency and effectiveness.

[0005] In order to solve the above technical problem, the embodiments of the present application provide a log monitoring adding method, which adopts the following technical solution:

[0006] A log monitoring adding method comprises the following steps:

[0007] Receiving a monitoring template submitted by a target user, wherein the monitoring template has been filled out by the target user;

[0008] Identifying the content of the monitoring template to obtain monitoring configuration information therein;

[0009] Generating a target monitoring item according to the monitoring configuration information;

[0010] Scanning a server to query initial monitoring items currently running, to compare the target monitoring item with the initial monitoring items, and to determine whether the target monitoring item exists in the initial monitoring items;

[0011] If it is confirmed that the target monitoring item does not exist in the initial monitoring items, establishing a log monitoring task based on the target monitoring item.

[0012] To solve the above technical problems, the embodiment of the present application also provides an adding device of log monitoring, which adopts the technical scheme as follows:

[0013] An adding device of log monitoring comprises:

[0014] A template receiving module is configured to receive a monitoring template submitted by a target user, wherein the monitoring template has been filled out by the target user;

[0015] A template identifying module is configured to identify the content of the monitoring template to obtain monitoring configuration information therein;

[0016] A monitoring item generating module is configured to generate a target monitoring item according to the monitoring configuration information;

[0017] A monitoring duplication checking module is configured to scan a server to query initial monitoring items currently running, to compare the target monitoring item with the initial monitoring items, and to determine whether the target monitoring item already exists in the initial monitoring items;

[0018] A task creating module is configured to create a log monitoring task based on the target monitoring item if it is confirmed that the target monitoring item does not exist in the initial monitoring items.

[0019] To solve the above technical problems, the embodiment of the present application also provides a computer device, which adopts the technical scheme as follows:

[0020] A computer device comprises a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to realize the steps of the adding method of log monitoring according to any one of the above technical solutions.

[0021] To solve the above technical problems, the embodiment of the present application also provides a computer readable storage medium, which adopts the technical scheme as follows:

[0022] A computer readable storage medium stores a computer program, and the computer program is executed by a processor to realize the steps of the adding method of log monitoring according to any one of the above technical solutions.

[0023] Compared with the prior art, the embodiment of the present application has the following beneficial effects:

[0024] The embodiment of the application discloses a log monitoring adding method, device, computer equipment and storage medium. The log monitoring adding method provided by the embodiment of the application comprises the following steps: after receiving a monitoring template submitted by a target user; identifying the content of the monitoring template to obtain monitoring configuration information therein; generating a target monitoring item according to the monitoring configuration information; scanning a server to query an initial monitoring item currently running, and comparing the target monitoring item with the initial monitoring item to determine whether the target monitoring item exists in the initial monitoring item; and if the target monitoring item does not exist in the initial monitoring item, establishing a log monitoring task based on the target monitoring item. The method can realize front-end and back-end interaction by providing a monitoring template, can automatically establish a log monitoring task after a user batch imports monitoring information, does not need to manually add a large number of monitoring items, reduces the workload of the user, and prevents repeated addition of log monitoring tasks by checking the monitoring information, so that system resources are not wasted, and the monitoring efficiency and effectiveness are improved. BRIEF DESCRIPTION OF DRAWINGS

[0025] In order to more clearly illustrate the technical solutions in the embodiments of the present application, the drawings needed to be used in the embodiments will be briefly introduced. Obviously, the drawings in the following description are only some embodiments of the present application, and other drawings can be obtained by those skilled in the art without creative labor.

[0026] Figure 1 An exemplary system architecture diagram to which the embodiments of the present application can be applied;

[0027] Figure 2 A flowchart of one embodiment of the log monitoring adding method described in the embodiments of the present application;

[0028] Figure 3 A structural schematic diagram of one embodiment of the log monitoring adding device described in the embodiments of the present application;

[0029] Figure 4 A structural schematic diagram of one embodiment of the computer equipment in the embodiments of the present application. DETAILED DESCRIPTION

[0030] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application belongs. The terminology used in the description herein is for the purpose of describing particular embodiments only and is not intended to be limiting of the application.

[0031] It should be noted that the terms "comprise", "comprising", "include", "including", and "has" and "having" as used herein are intended to cover a non-exclusive inclusion. For example, a process, method, system, product, or device that comprises a list of steps or units are not necessarily limited to those listed steps or units, but can optionally include other steps or units not expressly listed or inherent to such process, method, system, product, or device. In the claims, specification, and drawings of the present application, terms such as "first" and "second" and the like are used merely to distinguish one entity / operation / element from another entity / operation / element, and do not necessarily require or imply any actual relationship or order between such entities / operations / elements.

[0032] Reference herein to "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment can be included in at least one embodiment of the application. The appearances of the phrase that the phrase in various places in the specification are not necessarily all referring to the same embodiment, nor are they necessarily mutually exclusive of other embodiments. It is explicitly contemplated that embodiments described herein can be combined with other embodiments.

[0033] In order to better understand the scheme of the present application, the technical solutions in the embodiments of the present application will be described clearly and completely in conjunction with the relevant drawings in the embodiments of the present application below.

[0034] As shown in Figure 1 The system architecture 100 can include a first terminal device 101, a second terminal device 102, a third terminal device 103, a network 104, and a server 105. The network 104 is a medium for providing a communication link between the first terminal device 101, the second terminal device 102, the third terminal device 103, and the server 105. The network 104 can include various connection types, such as wired, wireless communication links, or optical fiber cables, etc.

[0035] A user can use the first terminal device 101, the second terminal device 102, and the third terminal device 103 to interact with the server 105 through the network 104 to receive or send messages, etc. Various communication client applications can be installed on the first terminal device 101, the second terminal device 102, and the third terminal device 103, such as web browser applications, shopping applications, search applications, instant messaging tools, email clients, social platform software, etc.

[0036] The first terminal device 101, the second terminal device 102 and the third terminal device 103 can be various electronic devices with display screens and supporting web browsing, including but not limited to smart phones, tablet computers, e-book readers, MP3 (Moving Picture Experts Group Audio Layer III) players, MP4 (Moving Picture Experts Group Audio Layer IV) players, laptop computers and desktop computers, and the like.

[0037] The server 105 can be a server providing various services, for example, a background server supporting the pages displayed on the first terminal device 101, the second terminal device 102 and the third terminal device 103.

[0038] It should be noted that the log monitoring adding method provided in the embodiments of the present application is generally executed by a server / terminal device, and accordingly, the log monitoring adding apparatus is generally arranged in a server / terminal device.

[0039] It should be understood that, Figure 1 The number of terminal devices, networks and servers in

[0040] With reference to Figure 2 , a flow chart of one embodiment of the log monitoring adding method in the embodiments of the present application is shown. The log monitoring adding method comprises the following steps:

[0041] Step 201: receiving a monitoring template submitted by a target user, the monitoring template having been filled in by the target user.

[0042] In the process of log monitoring maintenance work, if the target user (such as an operation and maintenance personnel) needs to add new monitoring items, the target user fills in the relevant monitoring template in the server front end of the log monitoring platform, and after the filling is completed, the monitoring template is submitted as feedback information. The server back end imports the monitoring template and then performs further processing. When the target user fills in the monitoring template, the target user can fill in the configuration information about several monitoring items at one time to realize batch import.

[0043] In some embodiments of the present application, before step 201, the log monitoring adding method further comprises:

[0044] receiving a calling instruction for a preset monitoring template, the template calling instruction indicating the type of the monitoring template to be called;

[0045] sending a monitoring template of a specified type in response to the calling instruction;

[0046] The step of receiving the monitoring template feedback information submitted by the target user in step 201 comprises:

[0047] receiving a submission request of the target user for the monitoring template;

[0048] determining whether the monitoring template has been filled out completely;

[0049] If yes, importing the monitoring template submitted by the target user in response to the submission request.

[0050] Different types of monitoring templates are preset in the log monitoring platform. When the target user operates in the front-end interface of the platform, the target user sets the type of the monitoring template to be called, and then sends a calling instruction for the monitoring template to the server back-end through the server front-end. After the server back-end receives the calling instruction, the corresponding monitoring template is called from the database according to the calling instruction and is sent to the front-end user interface, so as to facilitate the user to fill in the monitoring configuration information.

[0051] The target user fills in the monitoring template according to the current monitoring requirement in the front-end user interface, and submits the filled monitoring template as monitoring template feedback information from the front-end user interface. After the server back-end receives the submission request of the target user, the user permission of the target user is identified to determine whether the target user has the related operation and maintenance permission and whether the monitoring template has been filled out completely. If both are determined to be yes, the monitoring template submitted by the target user is imported to the back-end in response to the submission request. In this way, simple permission control is performed and the error rate of identification after the template is imported is reduced.

[0052] In the embodiments of the present application, the electronic device (for example, the server / terminal device shown in the figure) on which the log monitoring adding method runs can receive the monitoring template submitted by the target user through a wired connection mode or a wireless connection mode.It should be noted that the wireless connection mode can include but is not limited to 3G / 4G connection, WiFi connection, Bluetooth connection, WiMAX connection, Zigbee connection, UWB (ultra wideband) connection, and other now known or future developed wireless connection modes. Figure 1

[0053] Step 202: identifying the content of the monitoring template to obtain the monitoring configuration information therein.

[0054] When filling in the monitoring template, the target user can customize and edit under different configuration items of the monitoring template according to the current monitoring requirement, and the filled-in content can include other data information in addition to the monitoring configuration information, such as identification information related to the target user.

[0055] In a specific implementation manner of the embodiments of the present application, the item parameters to be configured in the monitoring template include a monitoring system, a monitoring item index, a monitoring keyword, a monitoring frequency, an alarm receiving mode, and an alarm receiver, etc. The above parameters all belong to the monitoring configuration information, wherein the monitoring system is understood as an object server to be monitored, and is generally the current server; the monitoring index means an index to be monitored, such as a memory usage, whether a network connection timeout occurs, a network connection timeout time / number, a number of busy threads, etc.; and the monitoring keyword can be understood as a keyword printed in a log when the system monitors a certain monitoring index, and is used to mark and represent the monitoring content related to the monitoring index.

[0056] Step 203: generating a target monitoring item according to the monitoring configuration information.

[0057] The monitoring configuration information is essentially data information of a plurality of configuration items in the monitoring template related to establishing a monitoring task. By way of example, in some embodiments of the present application, such as the content described in the above specific implementation manner, when the target monitoring item is generated, the following items in the monitoring configuration information are mainly based on: a monitoring system, a monitoring item index, a monitoring keyword, a monitoring frequency, an alarm receiving mode, and an alarm receiver, etc.

[0058] Further understanding the generated target monitoring item: when the log monitoring platform runs a monitoring task, for the target monitoring item, the monitoring item index under the monitoring system is taken as the monitoring content, the monitoring keyword in the monitoring log generated thereby is taken as the monitoring object, and when a related alarm is generated, the alarm receiving mode and the alarm receiver are used for notification.

[0059] Step 204: scanning a server to query an initial monitoring item currently running, so as to compare the target monitoring item with the initial monitoring item, and to judge whether the target monitoring item already exists in the initial monitoring item.

[0060] If the generated target monitoring item conflicts with an established log monitoring task, establishing a new log monitoring task for the target monitoring item will waste system resources and affect the monitoring efficiency, and therefore the target monitoring item needs to be checked for duplication, so as to judge whether it is a new log monitoring task, and to prevent repeated addition of monitoring.

[0061] The monitoring information stored in the server database of the scanning log monitoring platform is monitored to query and acquire the initial monitoring item currently running, and then the target monitoring item is compared with the initial monitoring item to determine whether the target monitoring item already exists in the initial monitoring item, thereby confirming whether the target monitoring item is a new log monitoring task.

[0062] In some embodiments of the present application, the step 204 comprises:

[0063] The basic monitoring configuration item is read to identify the basic monitoring configuration item in the target monitoring item to acquire the first comparison item and identify the basic monitoring configuration item in the initial monitoring item to acquire the second comparison item.

[0064] The target monitoring item is compared with the initial monitoring item by sequentially comparing the parameter values of the first comparison item and the second comparison item to determine whether the target monitoring item is repeated in the initial monitoring item.

[0065] In the monitoring configuration information associated with the monitoring item, the item used to determine whether the monitoring items are repeated is recorded as a basic monitoring configuration item. The monitoring configuration information associated with the target monitoring item and the initial monitoring item is matched according to the basic monitoring configuration item to acquire the first comparison item and the second comparison item, respectively.

[0066] The parameter values of the first comparison item and the second comparison item are compared to conveniently determine whether the corresponding target monitoring item and the initial monitoring item belong to the repeated log monitoring task. If the parameter values of the first comparison item and the second comparison item are the same, it indicates that the target monitoring item is repeated in the initial monitoring item and already exists in the initial monitoring item.

[0067] Further, the log monitoring adding method further comprises: if it is determined that the target monitoring item is repeated in the initial monitoring item, updating the initial monitoring item matched with the target monitoring item based on the monitoring configuration information of the target monitoring item determined to be repeated.

[0068] According to the basic monitoring configuration item, it is determined that the target monitoring item already exists in the initial monitoring item, but other monitoring configuration information of the target monitoring item except the basic monitoring configuration item can be different from the initial monitoring item determined to be repeated. At this time, the current monitoring task can be updated according to the latest monitoring configuration information to maintain that the initial monitoring item can meet the current monitoring requirement.

[0069] In an embodiment of the present application, the basic monitoring configuration items include monitoring system, monitoring item index, monitoring keyword, and monitoring frequency, etc. In addition to the above basic monitoring configuration items, the monitoring configuration information also includes alarm receiving mode and alarm receiver, etc. It can be understood that when the initial monitoring items are updated, the parameter values of the items in the monitoring configuration information other than the basic monitoring configuration items, such as alarm receiving mode and alarm receiver, are updated.

[0070] Step 205: If it is confirmed that the target monitoring item does not exist in the initial monitoring items, a monitoring task is established based on the target monitoring item.

[0071] If the target monitoring item does not exist in the initial monitoring items, it means that the target monitoring item belongs to a new monitoring task, and therefore a monitoring task based on the target monitoring item is newly added in the server to perform log monitoring by the initial monitoring items and the target monitoring item together. In this way, the above steps realize the interaction between the front end and the back end of the log monitoring platform and the batch import of monitoring items, and the corresponding monitoring task is established after the monitoring information is checked and de-duplicated, thereby avoiding the waste of system resources and improving the monitoring efficiency.

[0072] In some embodiments of the present application, after step 205, the log monitoring adding method further includes:

[0073] setting a monitoring period and reading a preset abnormal log keyword set, the abnormal log keyword set including a plurality of abnormal log keywords;

[0074] acquiring monitoring logs in the monitoring period;

[0075] counting the number of occurrences of each abnormal log keyword in the monitoring logs;

[0076] if the number of occurrences of the abnormal log keyword is greater than a preset alarm threshold, an alarm message based on the abnormal log keyword is generated and sent to a target user.

[0077] The abnormal log keyword refers to a keyword printed in the log by the log monitoring platform when a certain type of abnormal condition or error occurs. Different errors correspond to different abnormal keywords. For example, when a connection timeout is detected, the log monitoring platform prints a log content including "connection timeout" to indicate the error of connection timeout. The server database pre-stores a set of abnormal log keywords, i.e., a log keyword set.

[0078] The number of occurrences of the abnormal log keyword in a set monitoring period is counted to distinguish whether the system error corresponding to the abnormal log keyword is a normal error or an abnormal error. If the number of occurrences is greater than a certain value, the abnormal error is determined, and an alarm message is generated and sent to the target user for timely reminding.

[0079] In a specific embodiment, the log monitoring adding method further includes:

[0080] If the number of occurrences of the abnormal log keyword is greater than a preset alarm threshold, the monitoring configuration information corresponding to the target monitoring item and the initial monitoring item is identified based on the abnormal log keyword, and it is determined whether a log monitoring task matching the abnormal log keyword already exists;

[0081] If no log monitoring task matching the abnormal log keyword exists, a new log monitoring task based on the abnormal log keyword is established.

[0082] When the number of occurrences of the abnormal log keyword is greater than a certain value, it indicates that an abnormal error occurs in the system. By identifying whether a monitoring item for monitoring the abnormal error exists in the existing monitoring task or whether an alarm message about the abnormal error is received, it is determined whether the log monitoring task in the current system server is significantly missing. If the log monitoring task for monitoring the abnormal error is missing in the system, a monitoring item based on the abnormal log keyword is automatically added in the manner of adding a monitoring item for the same type of keyword, so as to establish a new log monitoring task, fill the monitoring gap, and improve the security and reliability of monitoring.

[0083] Further, after the step of establishing a new log monitoring task based on the abnormal log keyword, the log monitoring adding method further includes:

[0084] Receiving a target abnormal keyword and a target time interval;

[0085] Calling a target log monitoring task matching the target abnormal keyword;

[0086] Obtaining an alarm level of the target abnormal keyword in the target log monitoring task, a first level threshold and a second level threshold of a preset intelligent adjustment instruction, and an average monitoring frequency of the target abnormal keyword in the target time interval;

[0087] Identifying a preset alarm threshold matching the alarm level of the target abnormal keyword;

[0088] Comparing the average monitoring frequency and the alarm threshold;

[0089] If the average monitoring frequency is less than the alarm threshold and the alarm level is greater than or equal to the first level threshold, a preset intelligent adjustment instruction is activated to adjust the alarm threshold to the average monitoring frequency;

[0090] If the average monitoring frequency is greater than the alarm threshold and the alarm level is less than or equal to the second level threshold, a preset intelligent adjustment instruction is activated to adjust the alarm threshold to the average monitoring frequency.

[0091] When the log system performs monitoring and alarm after establishing a log monitoring task, for some monitoring information, if the monitoring frequency thereof is greater than the alarm threshold, the server will automatically generate an alarm message to perform alarm. However, in fact, the monitoring frequency thereof often fails to reach the normal alarm threshold, resulting in failure to normally perform alarm, or the monitoring frequency thereof is always greater than the alarm threshold by a certain amount, resulting in too frequent alarm. Therefore, sometimes, the alarm threshold needs to be intelligently adjusted and optimized to ensure the timeliness of alarm and effectively control the number of alarms.

[0092] The alarm level corresponding to the alarm message of the log monitoring task can be divided into five levels of debug, info, warn, error and fatal from low to high according to the importance of the alarm message. Different adjustment schemes can be adopted to adjust the alarm threshold for the alarm message with a high alarm level and the alarm message with a low alarm level.

[0093] By pre-setting an intelligent adjustment instruction in the server and setting the activation condition of the intelligent adjustment instruction, that is, the size relationship between the alarm level and the level threshold, in the specific adjustment, the target abnormal keyword to be monitored and the target time interval are determined, and the alarm threshold of the target abnormal keyword and the average monitoring frequency in the target time interval are obtained, and then the size of the average monitoring frequency and the alarm threshold is compared.

[0094] If the average monitoring frequency is less than the alarm threshold, it indicates that the number of occurrences of the target abnormal keyword to be monitored in the system is generally difficult to reach the degree of activating alarm, but the alarm level thereof is high enough, which belongs to an important monitoring item. At this time, the alarm threshold thereof can be lowered to the average monitoring frequency to timely send an alarm to the operation and maintenance personnel to prompt the operation and maintenance personnel to find problems. If the average monitoring frequency is greater than the alarm threshold, it indicates that the number of occurrences of the target abnormal keyword to be monitored in the system is easy to meet the condition of activating alarm, but the alarm level thereof is low, which belongs to an unimportant monitoring item. At this time, the alarm threshold thereof can be raised to the average monitoring frequency to reduce the number of alarms sent to the operation and maintenance personnel.

[0095] The log monitoring adding method provided in the embodiments of the present application can realize front-end and back-end interaction by providing a monitoring template, can automatically establish a log monitoring task after a user batch imports monitoring information, does not need to manually add a large number of monitoring items, reduces the workload of the user, and prevents repeated addition of log monitoring tasks by checking the monitoring information, thereby avoiding waste of system resources and improving monitoring efficiency and effectiveness.

[0096] Those skilled in the art can understand that all or part of the processes in the above-mentioned embodiment methods can be completed by a computer program instructing related hardware, and the computer program can be stored in a computer readable storage medium. When the program is executed, the processes of the above-mentioned embodiments of the methods can be included. The storage medium can be a non-volatile storage medium such as a magnetic disc, an optical disc, a read-only memory (ROM), or a random access memory (RAM).

[0097] It should be understood that, although each step in the flowchart of the accompanying drawings is shown in sequence according to the arrow, these steps are not necessarily executed in sequence according to the arrow. Unless otherwise specified herein, the execution of these steps is not strictly limited in sequence, and they can be executed in other sequences. Moreover, at least part of the steps in the flowchart of the accompanying drawings can include multiple sub-steps or multiple stages, which are not necessarily executed at the same time, but can be executed at different times, and the execution sequence is not necessarily sequential, but can be executed in rotation or alternation with at least part of other steps or sub-steps or stages of other steps.

[0098] Further reference is made to Figure 3 , Figure 3 An embodiment of a structure of a log monitoring adding device is shown. As an implementation of the method shown in the above Figure 2 , the present application provides an embodiment of a log monitoring adding device. The device embodiment corresponds to the method embodiment shown in the above Figure 2 , and the device can be specifically applied to various electronic devices.

[0099] As shown in the above Figure 3 , the log monitoring adding device provided in the embodiments of the present application comprises:

[0100] A template receiving module 301 is configured to receive a monitoring template submitted by a target user, wherein the monitoring template has been filled in by the target user.

[0101] A template identifying module 302 is configured to identify the content of the monitoring template to obtain monitoring configuration information therein.

[0102] The monitoring item generation module 303 is configured to generate a target monitoring item according to the monitoring configuration information.

[0103] The monitoring duplication checking module 304 is configured to scan a server to query initial monitoring items currently running, and compare the target monitoring item with the initial monitoring items to determine whether the target monitoring item already exists in the initial monitoring items.

[0104] The task creation module 305 is configured to create a log monitoring task based on the target monitoring item if it is determined that the target monitoring item does not exist in the initial monitoring items.

[0105] In some embodiments of the present application, the log monitoring adding apparatus further comprises a template sending module. The template sending module is configured to receive a calling instruction of a preset monitoring template, and send a monitoring template of a specified type in response to the calling instruction. The template calling instruction indicates a type of monitoring template to be called. The template receiving module 301 is further configured to receive a submission request of the target user for the monitoring template, determine whether the monitoring template has been filled out completely, and import the monitoring template submitted by the target user in response to the submission request if the monitoring template has been filled out completely.

[0106] In some embodiments of the present application, the monitoring duplication checking module 304 is further configured to read a basic monitoring configuration item, identify the basic monitoring configuration item in the target monitoring item to obtain a first comparison item, identify the basic monitoring configuration item in the initial monitoring items to obtain a second comparison item, and determine whether the target monitoring item is duplicated in the initial monitoring items by successively comparing parameter values of the first comparison item and the second comparison item.

[0107] Further, the monitoring duplication checking module 304 is further configured to update the initial monitoring item matched with the target monitoring item if it is determined that the target monitoring item is duplicated in the initial monitoring items, based on the monitoring configuration information of the target monitoring item determined to be duplicated.

[0108] In some embodiments of the present application, the log monitoring adding apparatus further comprises a log monitoring alarm module. The log monitoring alarm module is configured to set a monitoring period, read a preset set of abnormal log keywords, the set of abnormal log keywords comprising a plurality of abnormal log keywords, obtain monitoring logs in the monitoring period, count occurrence times of each abnormal log keyword in the monitoring logs, and generate an alarm message based on the abnormal log keyword and send the alarm message to a target user if the occurrence times of the abnormal log keyword is greater than a preset alarm threshold.

[0109] In a specific implementation, if the number of occurrences of the abnormal log keyword is greater than a preset alarm threshold, the monitoring duplication checking module 304 is further configured to identify, based on the abnormal log keyword, monitoring configuration information corresponding to the target monitoring item and the initial monitoring item, determine whether a log monitoring task matching the abnormal log keyword already exists, and if no log monitoring task matching the abnormal log keyword exists, establish, by the task creation module 305, a new log monitoring task based on the abnormal log keyword.

[0110] Further, the log monitoring adding apparatus further comprises an alarm adjustment module. The alarm adjustment module is configured to receive a target abnormal keyword and a target time interval, call a target log monitoring task matching the target abnormal keyword, acquire an alarm level of the target abnormal keyword in the target log monitoring task, a first level threshold and a second level threshold of a preset intelligent adjustment instruction, and an average monitoring frequency of the target abnormal keyword in the target time interval, identify a preset alarm threshold matching the alarm level of the target abnormal keyword, compare the average monitoring frequency and the alarm threshold, if the average monitoring frequency is less than the alarm threshold and the alarm level is greater than or equal to the first level threshold, activate the preset intelligent adjustment instruction to adjust the alarm threshold to the average monitoring frequency, and if the average monitoring frequency is greater than the alarm threshold and the alarm level is less than or equal to the second level threshold, activate the preset intelligent adjustment instruction to adjust the alarm threshold to the average monitoring frequency.

[0111] The log monitoring adding apparatus provided in the embodiments of the present application can automatically establish log monitoring tasks after a user imports monitoring information in batches, without manually adding a large number of monitoring items, thereby reducing the workload of the user, preventing repeated addition of log monitoring tasks by checking the monitoring information, avoiding waste of system resources, and improving monitoring efficiency and effectiveness.

[0112] To solve the above technical problems, the embodiments of the present application further provide a computer device. For details, please refer to Figure 4 , Figure 4 The basic structure block diagram of the computer device of the present embodiment is shown in FIG. 1.

[0113] The computer device 6 includes a memory 61, a processor 62, and a network interface 63, which are communicatively connected by a system bus. It should be noted that only the computer device 6 with components 61-63 is shown in the figure, but it should be understood that not all of the shown components are required to be implemented, and more or fewer components can be alternatively implemented. Among them, those skilled in the art can understand that the computer device herein is a device capable of automatically performing numerical calculation and / or information processing according to pre-set or stored instructions, and its hardware includes but is not limited to microprocessors, application specific integrated circuits (ASICs), field programmable gate arrays (FPGAs), digital signal processors (DSPs), embedded devices, etc.

[0114] The computer device can be a desktop computer, a notebook computer, a palm computer, a cloud server, and the like. The computer device can interact with the user through a keyboard, a mouse, a remote controller, a touchpad, a voice control device, and the like.

[0115] The memory 61 includes at least one type of readable storage medium, including a flash memory, a hard disk, a multimedia card, a card-type memory (e.g., an SD or DX memory, etc.), a random access memory (RAM), a static random access memory (SRAM), a read-only memory (ROM), an electrically erasable programmable read-only memory (EEPROM), a programmable read-only memory (PROM), a magnetic memory, a magnetic disk, an optical disk, and the like. In some embodiments, the memory 61 can be an internal storage unit of the computer device 6, such as a hard disk or a memory of the computer device 6. In other embodiments, the memory 61 can also be an external storage device of the computer device 6, such as a plug-in hard disk, a smart media card (SMC), a secure digital (SD) card, a flash card, and the like. Of course, the memory 61 can also include both the internal storage unit and the external storage device of the computer device 6. In this embodiment, the memory 61 is generally used to store an operating system and various application software installed in the computer device 6, such as program codes of the log monitoring addition method, and the like. In addition, the memory 61 can also be used to temporarily store various data that have been output or will be output.

[0116] The processor 62 may be a Central Processing Unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip in some embodiments. The processor 62 is generally used to control the overall operation of the computer device 6. In the present embodiment, the processor 62 is configured to run program codes or process data stored in the memory 61, such as program codes of the log monitoring adding method.

[0117] The network interface 63 may include a wireless network interface or a wired network interface, and is generally used to establish a communication connection between the computer device 6 and other electronic devices.

[0118] The computer device provided in the embodiments of the present application, when adding log monitoring by executing the computer program stored in the memory by the processor, provides a monitoring template to realize front-end and back-end interaction, can automatically establish a log monitoring task after a user batch imports monitoring information, does not need to manually add a large number of monitoring items, reduces the workload of the user, and prevents repeated addition of log monitoring tasks by checking the monitoring information, thereby avoiding waste of system resources, improving monitoring efficiency and effectiveness of monitoring.

[0119] The present application also provides another implementation, that is, a computer readable storage medium storing a log monitoring adding program, the log monitoring adding program can be executed by at least one processor to enable the at least one processor to perform the steps of the log monitoring adding method as described above.

[0120] The computer device and the storage medium provided in the embodiments of the present application, when adding log monitoring by executing the computer program stored therein, provide a monitoring template to realize front-end and back-end interaction, can automatically establish a log monitoring task after a user batch imports monitoring information, does not need to manually add a large number of monitoring items, reduces the workload of the user, and prevents repeated addition of log monitoring tasks by checking the monitoring information, thereby avoiding waste of system resources, improving monitoring efficiency and effectiveness of monitoring.

[0121] Those skilled in the art can clearly understand the method of the above-mentioned embodiments can be realized by means of software and necessary general hardware platform, of course, can also be realized by hardware, but in many cases, the former is a better embodiment. Based on such understanding, the technical solutions of the present application can be embodied in the form of software product, which is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk) and includes a plurality of instructions for making a terminal device (which can be a mobile phone, computer, server, air conditioner, or network device) execute the method described in each embodiment of the present application.

[0122] In the above-mentioned embodiments provided by the present application, it should be understood that the disclosed device and method can be implemented in other ways. For example, the device embodiments described above are only schematic. The division of the modules is only a logical function division. There can be another division manner in actual implementation. For example, a plurality of modules or components can be combined or integrated into another system, or some features can be ignored or not executed.

[0123] The modules or components can or can not be physically separate, and the components shown as modules or components can or can not be physical modules. They can be located in one place or distributed on a plurality of network units. Part or all of the modules or components can be selected according to actual needs to achieve the purpose of the embodiments.

[0124] The present application is not limited to the above-mentioned embodiments, and the above-mentioned embodiments are preferred embodiments of the present application. The embodiments are only used to illustrate the present application and not to limit the scope of the present application. It should be pointed out that for ordinary skilled in the art, without departing from the principles of the present application, they can make some improvements and modifications to the technical solutions recorded in the above-mentioned embodiments, or make equivalent replacement to some technical features. Any equivalent structure made by using the contents of the specification and drawings, directly or indirectly applied to other related technical fields, should be regarded as included in the protection scope of the present application.

[0125] Obviously, the above-described embodiments are only some embodiments but not all the embodiments of the present application, the preferred embodiments of the present application are shown in the drawings, but do not limit the patent scope of the present application. The present application can be implemented in many different forms, and conversely, the purpose of providing these embodiments is to make the disclosure of the present application more thorough and comprehensive. Although the present application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions recorded in the foregoing specific embodiments, or make equivalent replacements to some technical features, based on the embodiments in the present application, without making creative labor. All other embodiments obtained by those skilled in the art, and any equivalent structures made by using the contents of the specification and drawings, directly or indirectly applied to other related technical fields, are also within the scope of the patent protection of the present application.

Claims

1. A method for adding log monitoring, characterized in that, include: Receive a monitoring template submitted by the target user, which has been filled out by the target user; Identify the content of the monitoring template to obtain the monitoring configuration information therein; Generate target monitoring items based on the monitoring configuration information; The scanning server queries the currently running initial monitoring items to compare the target monitoring item with the initial monitoring items and determine whether the target monitoring item already exists in the initial monitoring items; If it is confirmed that the target monitoring item does not exist in the initial monitoring item, then a log monitoring task is created based on the target monitoring item; The method further includes, after the step of establishing a log monitoring task based on the target monitoring item: Set the monitoring period and read the preset abnormal log keyword set, which includes several abnormal log keywords; Obtain the monitoring logs within the monitoring period; Count the number of times each abnormal log keyword appears in the monitoring log; If the number of occurrences of an abnormal log keyword exceeds a preset alarm threshold, an alarm message based on the abnormal log keyword will be generated and sent to the target user. If the number of occurrences of an abnormal log keyword is greater than a preset alarm threshold, the monitoring configuration information corresponding to the target monitoring item and the initial monitoring item is identified based on the abnormal log keyword, and it is determined whether a log monitoring task matching the abnormal log keyword already exists. If no log monitoring task matches the abnormal log keyword, a new log monitoring task is created based on the abnormal log keyword.

2. The method for adding log monitoring according to claim 1, characterized in that, Prior to the step of receiving the monitoring template submitted by the target user, the method further includes: Receive a command to invoke a preset monitoring template, wherein the command indicates the type of monitoring template to be invoked; In response to the invocation command, a monitoring template of the specified type is sent; The step of receiving the monitoring template submitted by the target user includes: Receive the target user's submission request for the monitoring template; Determine whether the monitoring template has been completed; If so, the monitoring template submitted by the target user is imported in response to the submission request.

3. The method for adding log monitoring according to claim 1, characterized in that, The step of comparing the target monitoring item with the initial monitoring item to determine whether the target monitoring item already exists in the initial monitoring item includes: Read the basic monitoring configuration items, identify the basic monitoring configuration items in the target monitoring item to obtain the first comparison item, and identify the basic monitoring configuration items in the initial monitoring item to obtain the second comparison item; By comparing the parameter values ​​of the first comparison item and the second comparison item in sequence, it is determined whether the target monitoring item is duplicated with the items in the initial monitoring item.

4. The method for adding log monitoring according to claim 3, characterized in that, The method further includes: If it is determined that the target monitoring item is a duplicate of an item in the initial monitoring item, the initial monitoring item that matches it is updated based on the monitoring configuration information of the target monitoring item that is determined to be a duplicate.

5. The method for adding log monitoring according to claim 1, characterized in that, After the step of creating a new log monitoring task based on the abnormal log keyword, the method further includes: Receive the target anomaly keyword and the target time range; Invoke the target log monitoring task that matches the target anomaly keyword; The alarm level of the target abnormal keyword in the target log monitoring task is obtained, the first level threshold and the second level threshold of the preset intelligent adjustment instruction are obtained, and the average monitoring frequency of the target abnormal keyword in the target time interval is obtained. Identify a preset alarm threshold that matches the alarm level of the target abnormal keyword; Compare the average monitoring frequency with the magnitude of the alarm threshold; If the average monitoring frequency is less than the alarm threshold and the alarm level is greater than or equal to the first level threshold, a preset intelligent adjustment command is activated to adjust the alarm threshold to the average monitoring frequency. If the average monitoring frequency is greater than the alarm threshold and the alarm level is less than or equal to the second level threshold, a preset intelligent adjustment command is activated to adjust the alarm threshold to the average monitoring frequency.

6. A log monitoring and adding device, characterized in that, include: The template receiving module is used to receive monitoring templates submitted by the target user, which have been filled out by the target user. The template recognition module is used to recognize the content of the monitoring template in order to obtain the monitoring configuration information therein; The monitoring item generation module is used to generate target monitoring items based on the monitoring configuration information; The monitoring deduplication module is used to scan the server to query the currently running initial monitoring items, compare the target monitoring item with the initial monitoring item, and determine whether the target monitoring item already exists in the initial monitoring item; The task creation module is used to create a log monitoring task based on the target monitoring item if it is confirmed that the target monitoring item does not exist in the initial monitoring item. The log monitoring adding device further includes: a log monitoring alarm module, which is used to set a monitoring period and read a preset abnormal log keyword set, the abnormal log keyword set including several abnormal log keywords; obtain monitoring logs within the monitoring period; count the occurrence times of each abnormal log keyword in the monitoring logs; if the occurrence times of the abnormal log keyword are greater than a preset alarm threshold, generate an alarm message based on the abnormal log keyword and send it to the target user; If the number of occurrences of the abnormal log keyword exceeds a preset alarm threshold, the monitoring deduplication module is further used to identify the monitoring configuration information corresponding to the target monitoring item and the initial monitoring item based on the abnormal log keyword, and determine whether a log monitoring task matching the abnormal log keyword already exists; if no log monitoring task matching the abnormal log keyword exists, a new log monitoring task is created based on the abnormal log keyword by the task creation module.

7. A computer device, comprising a memory and a processor, characterized in that, The memory stores a computer program, and when the processor executes the computer program, it implements the steps of the log monitoring addition method as described in any one of claims 1-5.

8. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, when executed by a processor, implements the steps of the log monitoring addition method as described in any one of claims 1-5.

Images