Log monitoring method and device, electronic device and storage medium

Abstract

The present invention provides a log monitoring method and device, an electronic device and a storage medium. The log monitoring method includes obtaining the current application log, determining whether the current application log contains a characteristic keyword; if the current application log contains the characteristic keyword, matching the preset alarm level to the current application log, and issuing an alarm prompt corresponding to the preset alarm level when determining that the current application log meets the preset alarm condition; if the current application log does not contain the characteristic keyword, stopping the monitoring of the current application log. The log monitoring method provided by the present invention matches the preset alarm level to the current application log, and issues an alarm prompt corresponding to the preset alarm level when determining that the current application log meets the preset alarm condition, and by dividing the preset alarm levels, the accuracy of the alarm can be improved, and then the monitoring of multiple application logs can be automatically realized, thereby improving its versatility.

Description

Technical Field

[0001] The present invention relates to the field of computer software technology, and in particular to a log monitoring method and device, electronic equipment and storage medium. Background Art

[0002] The business data of an enterprise is always at risk of being leaked. Once the business data of an enterprise is leaked, the assets of the relevant enterprise will also suffer a certain degree of loss. However, by monitoring activity logs, the ability of relevant enterprises to prevent data risks can be improved.

[0003] Common methods for monitoring logs mainly include determining the composition of monitoring data; monitoring data includes: rich, detailed text and data; label data that can be used for telemetry; health check data and performance data from applications; and manually configuring monitoring data to the target application by relevant personnel to monitor logs.

[0004] The problems or shortcomings of the above-mentioned log monitoring method include: manually configuring monitoring data to the target application by relevant personnel, which has the problem of poor versatility. Summary of the invention

[0005] In view of the problems existing in the prior art, embodiments of the present invention provide a log monitoring method and device, an electronic device and a storage medium.

[0006] The present invention provides a log monitoring method, comprising:

[0007] Obtaining the current application log, and determining whether the current application log contains a characteristic keyword;

[0008] If the current application log contains the characteristic keyword, a preset alarm level is matched to the current application log, and when it is determined that the current application log meets the preset alarm condition, an alarm prompt corresponding to the preset alarm level is issued;

[0009] If the current application log does not contain the characteristic keyword, the monitoring of the current application log is stopped.

[0010] According to a log monitoring method provided by the present invention, before obtaining the current application log, the method further includes:

[0011] Determine the target application, collect relevant logs in the target application, and forward the relevant logs to the distributed logging system;

[0012] Based on the distributed log system, the related logs are processed to generate and forward the current application logs.

[0013] According to a log monitoring method provided by the present invention, when it is determined that the current application log meets a preset alarm condition, issuing an alarm prompt corresponding to the preset alarm level includes:

[0014] When it is determined that the current application log meets the preset alarm condition, it is judged whether the alarm information corresponding to the current application log meets the upgrade configuration condition, and based on the generated upgrade configuration condition judgment result, the alarm prompt corresponding to the preset alarm level is issued.

[0015] According to a log monitoring method provided by the present invention, the determining whether the alarm information corresponding to the current application log meets the upgrade configuration condition, and issuing the alarm prompt corresponding to the preset alarm level based on the generated upgrade configuration condition determination result, includes:

[0016] Determine whether the alarm information corresponding to the current application log meets the upgrade configuration condition;

[0017] If the alarm information corresponding to the current application log meets the upgrade configuration condition, determine the number of the alarm information corresponding to the current application log within the preset alarm time, and judge whether the number of the alarm information corresponding to the current application log within the preset alarm time reaches the number threshold corresponding to the level of the upgraded alarm information, and issue the alarm prompt corresponding to the preset alarm level based on the generated number judgment result;

[0018] If the alarm information corresponding to the current application log does not meet the upgrade configuration condition, determine whether the alarm information corresponding to the current application log meets the merging condition, and based on the generated merging condition judgment result, issue the alarm prompt corresponding to the preset alarm level.

[0019] According to a log monitoring method provided by the present invention, the determining the number of alarm information corresponding to the current application log within a preset alarm time includes:

[0020] Determine whether the generation time of the alarm information corresponding to the current application log is greater than the preset alarm time;

[0021] If the generation time of the alarm information corresponding to the current application log is not greater than the preset alarm time, determining the quantity of the alarm information;

[0022] If the generation time of the alarm information corresponding to the current application log is greater than the preset alarm time, determine the pending alarm information whose generation time is greater than the preset alarm time, and clear the pending alarm information.

[0023] According to a log monitoring method provided by the present invention, the determining whether the quantity of the alarm information corresponding to the current application log within the preset alarm time reaches the quantity threshold corresponding to the level of the upgraded alarm information, and issuing the alarm prompt corresponding to the preset alarm level based on the generated quantity determination result, includes:

[0024] Determine whether the number of the alarm information corresponding to the current application log within the preset alarm time reaches the number threshold corresponding to the level of upgrading the alarm information;

[0025] If the number of the alarm information corresponding to the current application log reaches the number threshold corresponding to the level of the alarm information, the level of the alarm information corresponding to the current application log is upgraded, and the steps of determining whether the alarm information corresponding to the current application log meets a merging condition and issuing the alarm prompt corresponding to the preset alarm level based on the generated merging condition determination result are performed;

[0026] If the number of the alarm information corresponding to the current application log does not reach the number threshold corresponding to the level of upgrading the alarm information, directly execute the step of determining whether the alarm information corresponding to the current application log meets the merging condition, and based on the generated merging condition judgment result, issue the alarm prompt corresponding to the preset alarm level.

[0027] According to a log monitoring method provided by the present invention, the determining whether the alarm information corresponding to the current application log meets the merging condition, and issuing the alarm prompt corresponding to the preset alarm level based on the generated merging condition determination result, includes:

[0028] Determine whether the alarm information corresponding to the current application log meets the merging condition;

[0029] If it is determined that the alarm information corresponding to the current application log meets the merging condition, determine the call link identifier of the alarm information, obtain the target-associated alarm information associated with the call link identifier, parse the target-associated alarm information, generate target alarm information, merge the alarm information corresponding to the current application log and the target alarm information to generate application alarm information, and issue the alarm prompt corresponding to the preset alarm level based on the application alarm information;

[0030] If it is determined that the alarm information corresponding to the current application log does not satisfy the merging condition, the alarm prompt corresponding to the preset alarm level is directly issued.

[0031] The present invention also provides a log monitoring device, comprising:

[0032] An acquisition module is used to acquire the current application log and determine whether the current application log contains a characteristic keyword;

[0033] A matching module, configured to match a preset alarm level to the current application log if the current application log contains the characteristic keyword, and issue an alarm prompt corresponding to the preset alarm level if it is determined that the current application log meets the preset alarm condition;

[0034] The stopping module is used to stop monitoring the current application log if the current application log does not contain the characteristic keyword.

[0035] According to a log monitoring device provided by the present invention, the acquisition module is further used for:

[0036] Determine the target application, collect relevant logs in the target application, and forward the relevant logs to the distributed logging system;

[0037] Based on the distributed log system, the related logs are processed to generate and forward the current application logs.

[0038] According to a log monitoring device provided by the present invention, the matching module includes:

[0039] The alarm submodule is used to determine whether the alarm information corresponding to the current application log meets the upgrade configuration condition when it is determined that the current application log meets the preset alarm condition, and based on the generated upgrade configuration condition judgment result, issue the alarm prompt corresponding to the preset alarm level.

[0040] According to a log monitoring device provided by the present invention, the alarm submodule is specifically used for:

[0041] Determine whether the alarm information corresponding to the current application log meets the upgrade configuration condition;

[0042] If the alarm information corresponding to the current application log meets the upgrade configuration condition, determine the number of the alarm information corresponding to the current application log within the preset alarm time, and judge whether the number of the alarm information corresponding to the current application log within the preset alarm time reaches the number threshold corresponding to the level of the upgraded alarm information, and issue the alarm prompt corresponding to the preset alarm level based on the generated number judgment result;

[0043] If the alarm information corresponding to the current application log does not meet the upgrade configuration condition, determine whether the alarm information corresponding to the current application log meets the merging condition, and based on the generated merging condition judgment result, issue the alarm prompt corresponding to the preset alarm level.

[0044] According to a log monitoring device provided by the present invention, the alarm submodule is further used for:

[0045] Determine whether the generation time of the alarm information corresponding to the current application log is greater than the preset alarm time;

[0046] If the generation time of the alarm information corresponding to the current application log is not greater than the preset alarm time, determining the quantity of the alarm information;

[0047] If the generation time of the alarm information corresponding to the current application log is greater than the preset alarm time, determine the pending alarm information whose generation time is greater than the preset alarm time, and clear the pending alarm information.

[0048] According to a log monitoring device provided by the present invention, the alarm submodule is further used for:

[0049] Determine whether the number of the alarm information corresponding to the current application log within the preset alarm time reaches the number threshold corresponding to the level of upgrading the alarm information;

[0050] If the number of the alarm information corresponding to the current application log reaches the number threshold corresponding to the level of the alarm information, the level of the alarm information corresponding to the current application log is upgraded, and it is determined whether the alarm information corresponding to the current application log meets the merging condition, and based on the generated merging condition determination result, the alarm prompt corresponding to the preset alarm level is issued;

[0051] If the number of the alarm information corresponding to the current application log does not reach the number threshold corresponding to the level of upgrading the alarm information, determine whether the alarm information corresponding to the current application log meets the merging condition, and based on the generated merging condition judgment result, issue the alarm prompt corresponding to the preset alarm level.

[0052] According to a log monitoring device provided by the present invention, the alarm submodule is further used for:

[0053] Determine whether the alarm information corresponding to the current application log meets the merging condition;

[0054] If it is determined that the alarm information corresponding to the current application log meets the merging condition, determine the call link identifier of the alarm information, obtain the target-associated alarm information associated with the call link identifier, parse the target-associated alarm information, generate target alarm information, merge the alarm information corresponding to the current application log and the target alarm information to generate application alarm information, and issue the alarm prompt corresponding to the preset alarm level based on the application alarm information;

[0055] If it is determined that the alarm information corresponding to the current application log does not satisfy the merging condition, the alarm prompt corresponding to the preset alarm level is directly issued.

[0056] The present invention also provides a computer program product, comprising a computer program / instruction, which implements the steps of any of the above-mentioned log monitoring methods when executed by a processor.

[0057] The present invention also provides a non-transitory computer-readable storage medium on which a computer program is stored. When the computer program is executed by a processor, the steps of any of the log monitoring methods described above are implemented.

[0058] The present invention provides a log monitoring method and device, electronic device and storage medium. By obtaining the current application log, it is determined whether the current application log contains a characteristic keyword; if the current application log contains the characteristic keyword, the preset alarm level is matched to the current application log, and when it is determined that the current application log meets the preset alarm condition, an alarm prompt corresponding to the preset alarm level is issued; if the current application log does not contain the characteristic keyword, the monitoring of the current application log is stopped. The log monitoring method and device provided by the present invention, by matching the preset alarm level to the current application log, when it is determined that the current application log meets the preset alarm condition, an alarm prompt corresponding to the preset alarm level is issued, and by dividing the preset alarm levels, the accuracy of the alarm can be improved, and then the monitoring of multiple application logs can be automatically realized, thereby improving its versatility. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the technical solutions in the present invention or the prior art, the following briefly introduces the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0060] Figure 1 It is a flow chart of a log monitoring method provided by an embodiment of the present invention;

[0061] Figure 2It is a flow chart of issuing an alarm prompt according to the result of judging the upgrade configuration condition in the log monitoring method provided by the embodiment of the present invention;

[0062] Figure 3 It is a schematic diagram of a process for determining the number of alarm information corresponding to the current application log in the log monitoring method provided by an embodiment of the present invention;

[0063] Figure 4 It is a flow chart of issuing an alarm prompt according to a quantity judgment result in a log monitoring method provided by an embodiment of the present invention;

[0064] Figure 5 It is a flow chart of issuing an alarm prompt according to a result of a merging condition judgment in a log monitoring method provided by an embodiment of the present invention;

[0065] Figure 6 It is a schematic diagram of merging alarm information by using a call link identifier provided by an embodiment of the present invention;

[0066] Figure 7 It is a detailed flow chart of the log monitoring method provided by an embodiment of the present invention;

[0067] Figure 8 It is a structural diagram of a log monitoring device provided by an embodiment of the present invention;

[0068] Fig. 9 It is a schematic diagram of the hardware structure of an electronic device provided by an embodiment of the present invention. DETAILED DESCRIPTION

[0069] In order to make the purpose, technical solution and advantages of the present invention clearer, the technical solution of the present invention will be clearly and completely described below in conjunction with the drawings of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0070] The accompanying drawings are for illustration only and are not drawn strictly to scale. As used herein, the term "preferably" and similar terms are used to indicate approximations, not degrees, and are intended to illustrate the inherent deviations in measured or calculated values ​​that will be recognized by those of ordinary skill in the art. It should be noted that in this specification, the expressions "first", "second", "third", etc. are only used to distinguish one feature from another, and do not represent any limitation on the features, especially not any order of precedence.

[0071] It should also be understood that expressions such as "include", "comprising", "including" and / or "comprising" are open rather than closed expressions in this specification, which indicate the presence of the stated features, elements and / or components, but do not exclude the presence of one or more other features, elements, components and / or their combinations. In addition, when describing the embodiments of the present application, "may" is used to mean "one or more embodiments of the present application". And, the term "exemplary" is intended to refer to an example or illustration.

[0072] Unless otherwise specified, all words (including engineering terms and scientific and technological terms) used in this article have the same meaning as those commonly understood by ordinary technicians in the field to which this application belongs. It should also be understood that, unless clearly stated in this application, words defined in common dictionaries should be interpreted as having the same meaning as their meaning in the context of the relevant technology, and should not be interpreted in an idealized or overly formal sense.

[0073] In order to solve the problems existing in the prior art, embodiments of the present invention provide a log monitoring method and device, an electronic device and a storage medium.

[0074] First, the terms involved in one or more embodiments of the present invention are explained.

[0075] Distributed log system (Kafka) refers to a data system used for distributed management of log data.

[0076] The call link identifier (Trace ID) refers to the link identifier of the trace log data.

[0077] Figure 1 FIG. 1 is a flow chart of a log monitoring method according to an embodiment of the present invention. Figure 1 As shown, the method includes:

[0078] Step 101, obtain the current application log, and determine whether the current application log contains a characteristic keyword; if so, execute step 102, if not, execute step 103.

[0079] Specifically, obtaining the current application log refers to obtaining a piece of log data generated by the target application at the current moment; or, it may be application log data obtained by periodically accessing a log database, where the log database is used to store log data generated by the target application.

[0080] The feature keyword refers to a keyword that represents the associated features contained in the log data.

[0081] Step 102: if the current application log contains a characteristic keyword, match the preset alarm level to the current application log, and if it is determined that the current application log meets the preset alarm condition, issue an alarm prompt corresponding to the preset alarm level.

[0082] Specifically, the preset alarm levels may include many types, which are not specifically limited in the present invention. The alarm prompt refers to the form of displaying the alarm information through sound, light and / or text.

[0083] Preferably, the preset alarm levels in the present invention include level L0, level L1 and level L2, wherein level L0 refers to a catastrophic abnormality of the target application; level L1 refers to focusing on error abnormalities; and level L2 refers to program hidden dangers.

[0084] Exemplarily, the preset alarm level L0 may be as shown in Table 1.

[0085] Table 1

[0086]

[0087]

[0088] The preset alarm level L1 may be as shown in Table 2.

[0089] Table 2

[0090] Serial number Keywords 1 Unknown Host Exception 2 Sun Cert Path Builder Exception 3 Class Not Found Exception 4 Class Cast Exception 5 File Not Found Exception 6 Socket Timeout Exception 7 java.net.Connect Exception 8 Connect Timeout Exception 9 Timeout Exception 10 IO Exception 11 Net Exception

[0091] The preset alarm level L2 may be as shown in Table 3.

[0092] Table 3

[0093]

[0094]

[0095] Correspondingly, matching the preset alarm level to the current application log means determining the characteristic keywords contained in the current application log, and matching the characteristic keywords contained in the current application log with the keywords contained in each preset alarm level one by one. When it is determined that the characteristic keywords contained in the current application log completely match any keyword in any preset alarm level, the preset alarm level is matched to the current application log.

[0096] It should be noted that the current application log may include one or more characteristic keywords at the same time.

[0097] Furthermore, the preset alarm condition refers to the conditions for issuing alarm prompts corresponding to the preset alarm levels. Further, in the case of determining that the current application log meets the preset alarm condition, issuing an alarm prompt corresponding to the preset alarm level means that by judging whether the current application log meets the preset alarm condition, and in the case of determining that the current application log meets the preset alarm condition, issuing an alarm prompt corresponding to the preset alarm level matching the current application log.

[0098] Correspondingly, the preset alarm conditions may include a preset alarm condition corresponding to level L0, a preset alarm condition corresponding to level L1, and a preset alarm condition corresponding to level L2.

[0099] Among them, the preset alarm condition corresponding to level L0 means that if it occurs once, it indicates that there is a major fault, and an alarm prompt needs to be issued in time, and the existing fault needs to be eliminated according to the alarm prompt; the preset alarm condition corresponding to level L1 means that if the error exception occurs more than 5 times in 5 minutes, an alarm prompt needs to be issued in time, and the existing problem needs to be solved accordingly according to the alarm prompt issued; the preset alarm condition corresponding to level L2 means that if the program hidden danger occurs more than 15 times in 5 minutes, an alarm prompt needs to be issued in time, and attention needs to be paid to the program hidden danger in time according to the alarm prompt issued.

[0100] Step 103: If the current application log does not contain the characteristic keyword, stop monitoring the current application log.

[0101] In addition, before obtaining the current application log, it also includes:

[0102] Step S1, determine the target application, collect relevant logs in the target application, and forward the relevant logs to the distributed log system.

[0103] Step S2: Based on the distributed log system, relevant logs are processed to generate and forward current application logs.

[0104] Specifically, processing related logs based on the distributed log system mainly refers to processing related log data of different flows using the distributed log system to obtain application logs of smoothed flows.

[0105] It should be noted that for the current application in normal working state, it will generate multiple application logs with constant content of different flows; then, by processing the application log data of different flows using the distributed log system, application log data of smooth flow can be obtained.

[0106] In addition, when it is determined that the current application log meets the preset alarm conditions, an alarm prompt corresponding to the preset alarm level is issued, including:

[0107] When it is determined that the current application log meets the preset alarm condition, it is judged whether the alarm information corresponding to the current application log meets the upgrade configuration condition, and based on the generated upgrade configuration condition judgment result, an alarm prompt corresponding to the preset alarm level is issued.

[0108] Specifically, in the case of determining that the current application log meets the preset alarm condition, it means that by judging whether the current application log meets the preset alarm condition, it is determined that the current application log meets the preset alarm condition.

[0109] Correspondingly, the purpose of judging whether the alarm information corresponding to the current application log meets the upgrade configuration conditions is to judge whether the alarm information needs to be upgraded. It should be noted that the upgrade configuration conditions refer to the pre-configured conditions for each alarm type in the configuration table of the target application, including whether it needs to be upgraded or not. Among them, the configuration table of the target application refers to the collection of activity products at each stage in the life cycle of the target application.

[0110] Exemplarily, if the target application configuration table contains alarm type A, alarm type B and alarm type C, and alarm type A and alarm type C are pre-configured to be upgraded, and alarm type B is pre-configured not to be upgraded; then determining whether the alarm information corresponding to the current application log meets the upgrade configuration conditions means matching the alarm type of the alarm information corresponding to the current application log with the alarm type A, alarm type B and alarm type C contained in the configuration table of the target application, respectively. When an alarm type that is exactly the same as the alarm type of the alarm information corresponding to the current application log is matched in the configuration table of the target application, it is determined whether the alarm information corresponding to the current application log needs to be upgraded.

[0111] It should be noted that if it is determined that the current application log does not meet the preset alarm condition by judging whether the current application log meets the preset alarm condition, the monitoring of the current application log is stopped.

[0112] To sum up, based on the above embodiments, the log monitoring method provided by the present invention matches the preset alarm level to the current application log, and when it is determined that the current application log meets the preset alarm conditions, an alarm prompt corresponding to the preset alarm level is issued, and by dividing the preset alarm levels, the accuracy of the alarm can be improved, and then the monitoring of multiple application logs can be automatically realized, thereby improving its versatility.

[0113] Based on the above embodiments, Figure 2 FIG. 1 is a flow chart of issuing an alarm prompt according to the result of the upgrade configuration condition judgment in a log monitoring method provided according to an embodiment of the present invention. Figure 2 As shown, an alarm is issued based on the upgrade condition judgment result, including:

[0114] Step 201, determine whether the alarm information corresponding to the current application log meets the upgrade configuration conditions; if so, execute step 202, if not, execute step 203.

[0115] Step 202: If the alarm information corresponding to the current application log meets the upgrade configuration conditions, determine the number of alarm information corresponding to the current application log within the preset alarm time, and judge whether the number of alarm information corresponding to the current application log within the preset alarm time reaches the number threshold corresponding to the level of the upgraded alarm information. Based on the generated number judgment result, issue an alarm prompt corresponding to the preset alarm level.

[0116] Specifically, determining the amount of alarm information corresponding to the current application log within the preset alarm time refers to determining the amount of alarm information corresponding to the current application log within the preset alarm time.

[0117] Correspondingly, the quantity threshold corresponding to the upgraded alarm information level refers to the quantity value that the alarm information needs to meet within the preset alarm time in order to upgrade the alarm information from one alarm level to an adjacent higher alarm level.

[0118] It should be noted that, using the log monitoring method recorded in the present invention, multiple log data of the target application can be monitored simultaneously. Among them, for any log data monitored, determining the number of alarm information corresponding to the current application log means obtaining the number of alarm information within the preset alarm time (preset time period) up to the current time point. Because the application log data of different traffic flows is processed by the distributed log system, the application log data of smooth traffic flow can be obtained, therefore, the number of alarm information obtained within the preset time period is constant.

[0119] Step 203: If the alarm information corresponding to the current application log does not meet the upgrade configuration condition, determine whether the alarm information corresponding to the current application log meets the merging condition, and issue an alarm prompt corresponding to the preset alarm level based on the generated merging condition judgment result.

[0120] Specifically, the merging condition refers to whether the alarm information contains a call link identifier, and if the alarm information contains a call link identifier, the alarm information can be merged; if the alarm information does not contain a call link identifier, the alarm information cannot be merged.

[0121] In summary, based on the above embodiments, it is possible to implement refined management of the alarm level of the alarm information corresponding to the current application log, effectively avoiding the situation where the alarm information corresponding to the application log is not processed when the alarm level is already at a very high level.

[0122] Based on the above embodiments, Figure 3FIG. 1 is a flow chart of determining the number of alarm messages corresponding to the current application log in a log monitoring method provided according to an embodiment of the present invention. Figure 3 As shown, determine the number of alarm information corresponding to the current application log, including:

[0123] Step 301 , determine whether the generation time of the alarm information corresponding to the current application log is greater than the preset alarm time; if so, execute step 302 , if not, execute step 303 .

[0124] Specifically, the preset alarm time refers to the maximum value of the generation time corresponding to at least one alarm information that can issue an alarm prompt.

[0125] Step 302: If the generation time of the alarm information corresponding to the current application log is greater than the preset alarm time, determine the alarm information to be processed whose generation time is greater than the preset alarm time, and clear the alarm information to be processed.

[0126] Exemplarily, if the preset alarm time is 5 minutes, and the generation time of the alarm information corresponding to the current application log is more than 5 minutes, then all alarm information with a generation time greater than 5 minutes is determined, and all alarm information with a generation time greater than 5 minutes is collectively referred to as pending alarm information, and the aforementioned pending alarm information is cleared.

[0127] Step 303: If the generation time of the alarm information corresponding to the current application log is not greater than the preset alarm time, the quantity of the alarm information is determined.

[0128] Exemplarily, if the preset alarm time is 5 minutes, and the alarm information corresponding to the current application log is generated within 5 minutes, then the number of all alarm information generated within 5 minutes of the preset alarm time is determined.

[0129] In summary, based on the above embodiments, accurate management of the number of alarm information corresponding to the current application log can be achieved by determining the number of alarm information that meets the preset alarm time condition.

[0130] Based on the above embodiments, Figure 4 FIG. 1 is a flow chart of issuing an alarm prompt according to a quantity judgment result in a log monitoring method provided according to an embodiment of the present invention. Figure 4 As shown, an alarm is issued based on the quantity judgment result, including:

[0131] Step 401 , determine whether the number of alarm information corresponding to the current application log within the preset alarm time reaches the number threshold corresponding to the level of the upgraded alarm information; if so, execute step 402 , if not, execute step 403 .

[0132] Step 402 : If the number of alarm information corresponding to the current application log reaches the number threshold corresponding to the level of the upgraded alarm information, the level of the alarm information corresponding to the current application log is upgraded, and step 203 is executed.

[0133] For example, if the level of the alarm information is level 5, the alarm level corresponding to the current application log is level 3, and the number threshold for upgrading the level of the alarm information to level 5 is 10. If the number of alarm information corresponding to the current application log is 15, the alarm level upgrade condition is met, and the alarm level corresponding to the current application log is upgraded to level 4.

[0134] Step 403: If the number of alarm information corresponding to the current application log does not reach the number threshold corresponding to the level of the upgraded alarm information, directly execute step 203.

[0135] To summarize, based on the above embodiments, when it is determined that the number of alarm information corresponding to the current application log reaches the quantity threshold corresponding to the level of the upgraded alarm information, the alarm level of the alarm information corresponding to the current application log can be upgraded, thereby achieving the accuracy of the alarm level corresponding to the upgraded application log.

[0136] Based on the above embodiments, Figure 5 FIG. 1 is a flow chart of issuing an alarm prompt according to a result of a combined condition judgment in a log monitoring method provided according to an embodiment of the present invention. Figure 5 As shown, an alarm prompt is issued according to the result of the merge condition judgment, including:

[0137] Step 501, determine whether the alarm information corresponding to the current application log meets the merging conditions; if so, execute step 502, if not, execute step 503.

[0138] Specifically, the merging condition refers to whether the alarm information contains a call link identifier, and if the alarm information contains a call link identifier, the alarm information can be merged; if the alarm information does not contain a call link identifier, the alarm information cannot be merged.

[0139] Step 502: If it is determined that the alarm information corresponding to the current application log meets the merging conditions, determine the call link identifier of the alarm information, obtain the target associated alarm information associated with the call link identifier, parse the target associated alarm information, generate target alarm information, merge the alarm information corresponding to the current application log and the target alarm information to generate application alarm information, and based on the application alarm information, issue an alarm prompt corresponding to the preset alarm level.

[0140] Specifically, determining the call link identifier of the alarm information refers to determining the call link identifier contained in the alarm information corresponding to the current application log.

[0141] Correspondingly, obtaining target associated alarm information associated with the call link identifier means obtaining all alarm information corresponding to the determined call link identifier in at least one application log after the current application log.

[0142] For example, see Figure 6 , if there are target applications A, B and C, and if the database corresponding to target application C fails, target application C will issue a call database alarm C through the application log.

[0143] If target application A can call any log data in target application B, target application B can call any log data in target application C, and the call link identifiers (Trace ID) corresponding to target application A and target application B are both 006. If it is determined that the call link identifier (Trace ID) corresponding to the call database alarm C is 006, then target application B can issue the associated call target application C timeout alarm B according to the call link identifier (Trace ID), and target application B can issue the associated call target application B timeout alarm A according to the call link identifier (Trace ID), respectively parse the call target application C timeout alarm B and the call target application B timeout alarm A, merge the parsing results with the call database alarm C, obtain the alarm information of the database failure, and issue the alarm prompt of the database failure to the alarm recipient, so that the alarm recipient can take corresponding solutions.

[0144] Step 503: If it is determined that the alarm information corresponding to the current application log does not meet the merging condition, an alarm prompt corresponding to the preset alarm level is directly issued.

[0145] Specifically, directly issuing an alarm prompt corresponding to a preset alarm level refers to directly issuing an alarm prompt corresponding to a preset alarm level that has been matched to the alarm information corresponding to the current application log.

[0146] To sum up, the log monitoring method provided by the present invention matches the preset alarm level to the current application log, and when it is determined that the current application log meets the preset alarm conditions, an alarm prompt corresponding to the preset alarm level is issued, and by dividing the preset alarm levels, the accuracy of the alarm can be improved, and then the monitoring of multiple application logs can be automatically realized, thereby improving its versatility.

[0147] Based on the above embodiments, Figure 7 FIG. 1 is a detailed flow chart of a log monitoring method according to an embodiment of the present invention. Figure 7 As shown in the figure, the detailed process of the log monitoring method includes:

[0148] Step 701, determine the target application, collect relevant logs in the target application, and forward the relevant logs to the distributed log system.

[0149] Step 702: Based on the distributed log system, relevant logs are processed to generate and forward current application logs.

[0150] Step 703, obtain the current application log, and determine whether the current application log contains the characteristic keyword; if so, execute step 704, if not, execute step 705.

[0151] Step 704, matching the preset alarm level to the current application log.

[0152] Step 705: Stop monitoring the current application log.

[0153] Step 706, when it is determined that the current application log meets the preset alarm condition, determine whether the alarm information corresponding to the current application log meets the upgrade configuration condition; if so, execute step 707, if not, execute step 712.

[0154] Step 707 , determine whether the generation time of the alarm information corresponding to the current application log is greater than the preset alarm time; if so, execute step 708 , if not, execute step 709 .

[0155] Step 708, determining the alarm information to be processed whose generation time is greater than the preset alarm time, and clearing the alarm information to be processed.

[0156] Step 709, determine the quantity of warning information.

[0157] Step 710, determine whether the number of alarm information corresponding to the current application log within the preset alarm time reaches the number threshold corresponding to the level of the upgraded alarm information; if so, execute step 711, if not, execute step 712.

[0158] Step 711: Upgrade the level of the warning information corresponding to the current application log.

[0159] Step 712, determine whether the alarm information corresponding to the current application log meets the merging condition; if so, execute step 713, if not, execute step 714.

[0160] Step 713, determine the call link identifier of the alarm information, obtain the target associated alarm information associated with the call link identifier, parse the target associated alarm information, generate target alarm information, merge the alarm information corresponding to the current application log and the target alarm information to generate application alarm information, and based on the application alarm information, issue an alarm prompt corresponding to the preset alarm level.

[0161] Step 714, directly issue an alarm prompt corresponding to the preset alarm level.

[0162] To sum up, based on the above embodiments, the log monitoring method provided by the present invention matches the preset alarm level to the current application log, and when it is determined that the current application log meets the preset alarm conditions, an alarm prompt corresponding to the preset alarm level is issued, and by dividing the preset alarm levels, the accuracy of the alarm can be improved, and then the monitoring of multiple application logs can be automatically realized, thereby improving its versatility.

[0163] Based on the above embodiments, Figure 8 Schematic diagram of the structure of a log monitoring device provided according to an embodiment of the present invention. Figure 8 As shown, the log monitoring device includes: an acquisition module 810 , a matching module 820 and a stop module 830 .

[0164] The acquisition module 810 is used to acquire the current application log and determine whether the current application log contains a characteristic keyword.

[0165] The acquisition module 810 is also used to: determine the target application, collect relevant logs in the target application, and forward the relevant logs to the distributed log system; based on the distributed log system, process the relevant logs, generate and forward the current application logs.

[0166] The matching module 820 is used to match the preset alarm level to the current application log if the current application log contains a characteristic keyword, and issue an alarm prompt corresponding to the preset alarm level when it is determined that the current application log meets the preset alarm condition.

[0167] Among them, the matching module 820 includes: an alarm sub-module, which is used to determine whether the alarm information corresponding to the current application log meets the upgrade configuration conditions when it is determined that the current application log meets the preset alarm conditions, and based on the generated upgrade configuration condition judgment result, issue an alarm prompt corresponding to the preset alarm level.

[0168] The alarm submodule is used to:

[0169] Determine whether the alarm information corresponding to the current application log meets the upgrade configuration conditions;

[0170] If the alarm information corresponding to the current application log meets the upgrade configuration conditions, determine the number of alarm information corresponding to the current application log within the preset alarm time, and judge whether the number of alarm information corresponding to the current application log within the preset alarm time reaches the number threshold corresponding to the level of the upgraded alarm information, and issue an alarm prompt corresponding to the preset alarm level based on the generated number judgment result;

[0171] If the alarm information corresponding to the current application log does not meet the upgrade configuration conditions, determine whether the alarm information corresponding to the current application log meets the merging conditions, and based on the generated merging condition judgment result, issue an alarm prompt corresponding to the preset alarm level.

[0172] Optionally, the alarm submodule is further used for:

[0173] Determine whether the generation time of the alarm information corresponding to the current application log is greater than the preset alarm time;

[0174] If the generation time of the alarm information corresponding to the current application log is not greater than the preset alarm time, the number of alarm information is determined;

[0175] If the generation time of the alarm information corresponding to the current application log is greater than the preset alarm time, the pending alarm information whose generation time is greater than the preset alarm time is determined, and the pending alarm information is cleared.

[0176] Optionally, the alarm submodule is further used for:

[0177] Determine whether the number of alarm information corresponding to the current application log within the preset alarm time has reached the number threshold corresponding to the level of the upgraded alarm information;

[0178] If the number of alarm information corresponding to the current application log reaches the number threshold corresponding to the level of the upgraded alarm information, the level of the alarm information corresponding to the current application log is upgraded, and it is determined whether the alarm information corresponding to the current application log meets the merging condition, and based on the generated merging condition judgment result, an alarm prompt corresponding to the preset alarm level is issued;

[0179] If the number of alarm messages corresponding to the current application log does not reach the number threshold corresponding to the level of the upgraded alarm message, determine whether the alarm messages corresponding to the current application log meet the merging conditions, and based on the generated merging condition judgment result, issue an alarm prompt corresponding to the preset alarm level.

[0180] Optionally, the alarm submodule is further used for:

[0181] Determine whether the alarm information corresponding to the current application log meets the merging conditions;

[0182] If it is determined that the alarm information corresponding to the current application log meets the merging condition, determine the call link identifier of the alarm information, obtain the target-associated alarm information associated with the call link identifier, parse the target-associated alarm information, generate target alarm information, merge the alarm information corresponding to the current application log and the target alarm information to generate application alarm information, and issue an alarm prompt corresponding to a preset alarm level based on the application alarm information;

[0183] If it is determined that the alarm information corresponding to the current application log does not meet the merging conditions, an alarm prompt corresponding to the preset alarm level is directly issued.

[0184] The stop module 830 is used to stop monitoring the current application log if the current application log does not contain the characteristic keyword.

[0185] To summarize, based on the above embodiments, the log monitoring device provided by the present invention matches the preset alarm level to the current application log, and when it is determined that the current application log meets the preset alarm conditions, it issues an alarm prompt corresponding to the preset alarm level, and by dividing the preset alarm levels, it can improve the accuracy of the alarm, and then automatically realize the monitoring of multiple application logs, thereby improving its versatility.

[0186] Fig. 9 FIG. 1 is a schematic diagram of the hardware structure of an electronic device according to an embodiment of the present invention. Fig. 9 As shown, the electronic device may include: a processor 910, a communication interface 920, a memory 930 and a communication bus 940, wherein the processor 910, the communication interface 920 and the memory 930 communicate with each other through the communication bus 940. The processor 910 may call the logic instructions in the memory 930 to execute the log monitoring method, which includes: obtaining the current application log, determining whether the current application log contains a feature keyword; if the current application log contains the feature keyword, matching the preset alarm level to the current application log, and issuing an alarm prompt corresponding to the preset alarm level when determining that the current application log meets the preset alarm condition; if the current application log does not contain the feature keyword, stopping monitoring the current application log.

[0187] In addition, the logic instructions in the above-mentioned memory 930 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on such an understanding, the technical solution of the present invention can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0188] On the other hand, the present invention also provides a computer program product, which includes a computer program stored on a non-transitory computer-readable storage medium, and the computer program includes program instructions. When the program instructions are executed by a computer, the computer can execute the log monitoring method provided by the above methods, and the method includes: obtaining a current application log, and determining whether the current application log contains a feature keyword; if the current application log contains the feature keyword, matching a preset alarm level to the current application log, and when it is determined that the current application log meets the preset alarm condition, issuing an alarm prompt corresponding to the preset alarm level; if the current application log does not contain the feature keyword, stopping monitoring of the current application log.

[0189] On the other hand, the present invention also provides a non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, is implemented to execute the above-mentioned log monitoring methods, the methods comprising: obtaining a current application log, and determining whether the current application log contains a characteristic keyword; if the current application log contains the characteristic keyword, matching a preset alarm level to the current application log, and when determining that the current application log meets the preset alarm condition, issuing an alarm prompt corresponding to the preset alarm level; if the current application log does not contain the characteristic keyword, stopping monitoring of the current application log.

[0190] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0191] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0192] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, rather than to limit it. Although the present invention has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. A log monitoring method, characterized in that: include: Obtaining the current application log, and determining whether the current application log contains a characteristic keyword; If the current application log contains the characteristic keyword, a preset alarm level is matched to the current application log, and when it is determined that the current application log meets the preset alarm condition, an alarm prompt corresponding to the preset alarm level is issued; The preset alarm condition is the condition for issuing an alarm prompt corresponding to the preset alarm level; If the current application log does not contain the characteristic keyword, stop monitoring the current application log; The step of issuing an alarm prompt corresponding to the preset alarm level when determining that the current application log meets the preset alarm condition includes: In the case of determining that the current application log meets the preset alarm condition, judging whether the alarm information corresponding to the current application log meets the upgrade configuration condition, and issuing the alarm prompt corresponding to the preset alarm level based on the generated upgrade configuration condition judgment result; the upgrade configuration condition is a condition pre-configured for each alarm type in the configuration table of the target application, including the condition that needs to be upgraded or does not need to be upgraded, and the configuration table of the target application is a collection of activity products at each stage in the life cycle of the target application; The determining whether the alarm information corresponding to the current application log meets the upgrade configuration condition, and issuing the alarm prompt corresponding to the preset alarm level based on the generated upgrade configuration condition determination result, includes: Determine whether the alarm information corresponding to the current application log meets the upgrade configuration condition; If the alarm information corresponding to the current application log meets the upgrade configuration condition, determine the number of the alarm information corresponding to the current application log within the preset alarm time, and judge whether the number of the alarm information corresponding to the current application log within the preset alarm time reaches the number threshold corresponding to the level of the upgraded alarm information, and issue the alarm prompt corresponding to the preset alarm level based on the generated number judgment result; If the alarm information corresponding to the current application log does not meet the upgrade configuration condition, determine whether the alarm information corresponding to the current application log meets the merging condition, and based on the generated merging condition judgment result, issue the alarm prompt corresponding to the preset alarm level.

2. The log monitoring method according to claim 1, characterized in that: Before obtaining the current application log, the following steps are also included: Determine the target application, collect relevant logs in the target application, and forward the relevant logs to the distributed logging system; Based on the distributed log system, the related logs are processed to generate and forward the current application logs.

3. The log monitoring method according to claim 1, characterized in that: The determining the quantity of the alarm information corresponding to the current application log within the preset alarm time includes: Determine whether the generation time of the alarm information corresponding to the current application log is greater than the preset alarm time; If the generation time of the alarm information corresponding to the current application log is not greater than the preset alarm time, determining the quantity of the alarm information; If the generation time of the alarm information corresponding to the current application log is greater than the preset alarm time, determine the pending alarm information whose generation time is greater than the preset alarm time, and clear the pending alarm information.

4. The log monitoring method according to claim 1, characterized in that: The determining whether the quantity of the alarm information corresponding to the current application log within the preset alarm time reaches a quantity threshold corresponding to the level of the upgraded alarm information, and issuing the alarm prompt corresponding to the preset alarm level based on the generated quantity determination result, includes: Determine whether the number of the alarm information corresponding to the current application log within the preset alarm time reaches the number threshold corresponding to the level of upgrading the alarm information; If the number of the alarm information corresponding to the current application log reaches the number threshold corresponding to the level of the alarm information, the level of the alarm information corresponding to the current application log is upgraded, and the steps of determining whether the alarm information corresponding to the current application log meets a merging condition and issuing the alarm prompt corresponding to the preset alarm level based on the generated merging condition determination result are performed; If the number of the alarm information corresponding to the current application log does not reach the number threshold corresponding to the level of upgrading the alarm information, directly execute the step of determining whether the alarm information corresponding to the current application log meets the merging condition, and based on the generated merging condition judgment result, issue the alarm prompt corresponding to the preset alarm level.

5. The log monitoring method according to claim 1, characterized in that: The determining whether the alarm information corresponding to the current application log satisfies a merging condition, and issuing the alarm prompt corresponding to the preset alarm level based on the generated merging condition determination result, includes: Determine whether the alarm information corresponding to the current application log meets the merging condition; If it is determined that the alarm information corresponding to the current application log meets the merging condition, determine the call link identifier of the alarm information, obtain the target-associated alarm information associated with the call link identifier, parse the target-associated alarm information, generate target alarm information, merge the alarm information corresponding to the current application log and the target alarm information to generate application alarm information, and issue the alarm prompt corresponding to the preset alarm level based on the application alarm information; If it is determined that the alarm information corresponding to the current application log does not satisfy the merging condition, the alarm prompt corresponding to the preset alarm level is directly issued.

6. A log monitoring device, characterized in that: include: An acquisition module is used to acquire the current application log and determine whether the current application log contains a characteristic keyword; A matching module, configured to match a preset alarm level to the current application log if the current application log contains the characteristic keyword, and issue an alarm prompt corresponding to the preset alarm level if it is determined that the current application log meets the preset alarm condition; The preset alarm condition is the condition for issuing an alarm prompt corresponding to the preset alarm level; A stop module, used for stopping monitoring of the current application log if the current application log does not contain the characteristic keyword; The matching module includes: an alarm submodule, which is used to determine whether the alarm information corresponding to the current application log meets the upgrade configuration condition when it is determined that the current application log meets the preset alarm condition, and issue an alarm prompt corresponding to the preset alarm level based on the generated upgrade configuration condition judgment result; the upgrade configuration condition is a condition pre-configured for each alarm type in the configuration table of the target application, including the condition that needs to be upgraded or does not need to be upgraded, and the configuration table of the target application is a collection of activity products at each stage in the life cycle of the target application; The alarm submodule is specifically used for: Determine whether the alarm information corresponding to the current application log meets the upgrade configuration conditions; If the alarm information corresponding to the current application log meets the upgrade configuration conditions, determine the number of alarm information corresponding to the current application log within the preset alarm time, and judge whether the number of alarm information corresponding to the current application log within the preset alarm time reaches the number threshold corresponding to the level of the upgraded alarm information, and issue an alarm prompt corresponding to the preset alarm level based on the generated number judgment result; If the alarm information corresponding to the current application log does not meet the upgrade configuration conditions, determine whether the alarm information corresponding to the current application log meets the merging conditions, and based on the generated merging condition judgment result, issue an alarm prompt corresponding to the preset alarm level.

7. A computer program product comprising a computer program / instructions, characterized in that When the computer program / instruction is executed by a processor, the steps of the log monitoring method described in any one of claims 1 to 5 are implemented.

8. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the log monitoring method as described in any one of claims 1 to 5 are implemented.

Images