Abnormal log analysis method, device and electronic equipment

Abstract

The present invention discloses an analysis method, device and electronic device for abnormal logs. The method relates to the field of artificial intelligence, and comprises: obtaining an abnormal log to be processed generated when an abnormality occurs in the system; inputting the abnormal log to be processed into a pre-trained target language model to obtain multiple first-dimensional vectors; determining a target first-dimensional vector with the highest similarity probability from the multiple first-dimensional vectors, and extracting a target label explanation text from the sentence pair corresponding to the target first-dimensional vector; and using the target label explanation text as the analysis result of the abnormal log to be processed. The present invention solves the technical problem of poor analysis efficiency caused by relying on manual analysis of log files in the prior art.

Description

Technical Field

[0001] The present invention relates to the field of artificial intelligence, and in particular to an abnormal log analysis method, device and electronic equipment. Background Art

[0002] The system often generates a large number of logs when it is running. In today's diverse and complex enterprise-level WEB services and big data service support background, not only are various service frameworks integrated, but also the ways of recording logs are diverse. The log mainly contains two contents: the logical description of the system operation and the state description of the system operation. The logical description of the system operation is expressed in natural language that can be understood by humans. When an error occurs in the system, it describes the event that the system cannot continue to execute, such as what kind of error occurred when calling a certain module, what kind of error occurred when accessing a certain external interface, and the description of system resource exhaustion. The state description of the system operation is expressed as a set of structured data, such as the timestamp of each job submission, resource utilization, data throughput, job execution time, etc. when the system is running. This series of parameters quantitatively describes the state of the system when it runs to a specific stage.

[0003] In the prior art, when a system exception occurs, the staff responsible for system operation and maintenance usually manually extracts the system log and manually analyzes the logical description and status description of the system error to find the cause of the system exception, resulting in poor analysis efficiency.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present invention provide a method, device and electronic device for analyzing abnormal logs, so as to at least solve the technical problem of poor analysis efficiency caused by manual analysis of log files in the prior art.

[0006] According to one aspect of an embodiment of the present invention, a method for analyzing an exception log is provided, comprising: obtaining an exception log to be processed generated when an exception occurs in the system; inputting the exception log to be processed into a pre-trained target language model to obtain a plurality of first-dimensional vectors, wherein each first-dimensional vector represents the similarity probability between the exception log to be processed and each sentence pair corresponding to the exception log to be processed, and each sentence pair is generated by combining the exception log to be processed and a label explanation text, and the label explanation text at least includes exception detail information and / or an exception solution of a preset exception type label; determining a target first-dimensional vector with the largest similarity probability from the plurality of first-dimensional vectors, and extracting a target label explanation text from the sentence pair corresponding to the target first-dimensional vector; and using the target label explanation text as the analysis result of the exception log to be processed.

[0007] Furthermore, each of the multiple first-dimensional vectors corresponds to a second-dimensional vector, wherein the second-dimensional vector represents the dissimilarity probability between the exception log to be processed and each sentence pair corresponding to the exception log to be processed.

[0008] Furthermore, the analysis method of the exception log also includes: before inputting the exception log to be processed into the pre-trained target language model, obtaining multiple historical exception logs, wherein each historical exception log contains at least a description text of the system logic, wherein the description text of the system logic at least includes description information of the event that caused the system exception; vectorizing each historical exception log according to the description text of the system logic to obtain a semantic vector corresponding to each historical exception log.

[0009] Furthermore, the analysis method of the exception log also includes: counting the first frequency of each word in the description text of the system logic in each historical exception log and the second frequency of each word in all historical exception logs; calculating the weight value of each word in each historical exception log according to the first frequency and the second frequency; in each historical exception log, performing weighted summation on the weight value of each word and the word semantic vector of each word to obtain the semantic vector corresponding to each historical exception log.

[0010] Furthermore, the analysis method of the exception log also includes: after vectorizing each historical exception log according to the description text of the system logic to obtain the semantic vector corresponding to each historical exception log, clustering the semantic vectors corresponding to multiple historical exception logs to obtain the exception type corresponding to each historical exception log, wherein each exception type corresponds to at least one historical exception log; obtaining a preset exception type label corresponding to each exception type, and marking the preset exception type label on the corresponding historical exception log to obtain the marked historical exception log, wherein one exception type corresponds to one preset exception type label; and training the target language model according to the marked historical exception logs.

[0011] Furthermore, the analysis method of the exception log also includes: performing text expansion on the annotated historical exception log to obtain an expanded historical exception log, wherein the expanded historical exception log at least includes: a description text of the system logic, a description text of the system status, and a label explanation text of a preset exception type label; and training an initial language model based on the expanded historical exception log to obtain a target language model.

[0012] Furthermore, the analysis method of the exception log also includes: obtaining the label explanation text of the preset exception type label, wherein each preset exception type label corresponds to at least one label explanation text; in the case where a preset exception type label corresponds to multiple label explanation texts, each label explanation text is added to each annotated historical exception log corresponding to the corresponding preset exception type label, to obtain multiple expanded historical exception logs.

[0013] Furthermore, the exception log to be processed includes at least a description text of the system logic and a description text of the system status. The analysis method of the exception log also includes: controlling the target language model to obtain a label explanation text to be combined from at least one label explanation text corresponding to each preset exception type label, and inserting a preset separator between the description text of the system logic, the description text of the system status and the label explanation text to be combined to obtain the target text, inserting a preset sentence start label at the beginning position of the target text to obtain sentence pairs corresponding to each preset exception type label, and generating multiple first-dimensional vectors based on the sentence pairs corresponding to each preset exception type label.

[0014] According to another aspect of an embodiment of the present invention, there is also provided an analysis device for an exception log, comprising: an acquisition module, used to acquire an exception log to be processed generated when an exception occurs in the system; an input module, used to input the exception log to be processed into a pre-trained target language model to obtain a plurality of first-dimensional vectors, wherein each first-dimensional vector represents the similarity probability between the exception log to be processed and each sentence pair corresponding to the exception log to be processed, and each sentence pair is generated by combining the exception log to be processed and a label explanation text, and the label explanation text at least includes exception detail information and / or an exception solution of a preset exception type label; a first determination module, used to determine a target first-dimensional vector with the largest similarity probability from a plurality of first-dimensional vectors, and extract a target label explanation text from the sentence pair corresponding to the target first-dimensional vector; and a second determination module, used to use the target label explanation text as the analysis result of the exception log to be processed.

[0015] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the above-mentioned abnormal log analysis method.

[0016] According to another aspect of an embodiment of the present invention, there is further provided an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the above-mentioned abnormal log analysis method.

[0017] In an embodiment of the present invention, a method of locating the abnormal problems of the exception log to be processed based on the target language model is adopted. The exception log to be processed generated when the system exception occurs is obtained, and then the exception log to be processed is input into the pre-trained target language model to obtain multiple first-dimensional vectors, and then the target first-dimensional vector with the largest similarity probability is determined from the multiple first-dimensional vectors, and the target label explanation text is extracted from the sentence pair corresponding to the target first-dimensional vector, so that the target label explanation text is used as the analysis result of the exception log to be processed. Among them, each first-dimensional vector represents the similarity probability of each sentence pair corresponding to the exception log to be processed, and each sentence pair is generated by combining the exception log to be processed and a label explanation text, and the label explanation text at least includes the exception details information and / or exception solution of the preset exception type label.

[0018] In the above process, since the label explanation text in each sentence pair corresponds to a different preset abnormal type label, and each preset abnormal type label corresponds to an abnormal type, the similarity probability between the abnormal log to be processed and each sentence pair corresponding to the abnormal log to be processed is obtained based on the target language model, and the similarity judgment between the abnormal type corresponding to the abnormal log to be processed and the abnormal type corresponding to each sentence pair is realized. Further, the target label explanation text is extracted from the sentence pair with the highest similarity probability among multiple sentence pairs, and it is used as the analysis result of the abnormal log to be processed, so as to realize the abnormal problem location of the abnormal log to be processed, avoid the analysis of the abnormal log based on manual methods, so that the operator can quickly obtain the cause of the abnormal log, and then quickly solve the abnormal problem, which improves the analysis efficiency and problem solving efficiency of the abnormal log.

[0019] It can be seen that the solution provided by the present application achieves the purpose of locating the abnormal problems of the exception logs to be processed based on the target language model, thereby achieving the technical effect of improving the analysis efficiency of the exception logs, and further solving the technical problem of poor analysis efficiency caused by relying on manual analysis of log files in the prior art. BRIEF DESCRIPTION OF THE DRAWINGS

[0020] The drawings described herein are used to provide a further understanding of the present invention and constitute a part of this application. The exemplary embodiments of the present invention and their descriptions are used to explain the present invention and do not constitute an improper limitation of the present invention. In the drawings:

[0021] Figure 1 is a schematic diagram of an optional abnormal log analysis method according to an embodiment of the present invention;

[0022] Figure 2 is a schematic diagram of an optional training target language model according to an embodiment of the present invention;

[0023] Figure 3 is a schematic diagram of an optional method of performing text expansion on annotated historical abnormality logs according to an embodiment of the present invention;

[0024] Figure 4 is a schematic diagram of an optional abnormal log analysis device according to an embodiment of the present invention;

[0025] Figure 5 is a schematic diagram of an optional electronic device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0027] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0028] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data for display, data for analysis, etc.) involved in this disclosure are all information and data authorized by the user or fully authorized by all parties.

[0029] Example 1

[0030] According to an embodiment of the present invention, an embodiment of a method for analyzing an exception log is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0031] Figure 1is a schematic diagram of an optional abnormal log analysis method according to an embodiment of the present invention, such as Figure 1 As shown, the method comprises the following steps:

[0032] Step S101, obtaining an exception log to be processed when an exception occurs in the system.

[0033] In step S101, the unprocessed exception log generated when the system has an exception can be obtained through the application system, processor, electronic device and other devices. In this embodiment, the aforementioned unprocessed exception log is obtained through the data analysis system. Optionally, the data analysis system can directly read the newly generated exception log from the system where the exception occurs, or the relevant operator, the system where the exception occurs, or other systems can input the unprocessed exception log into the data analysis system for the data analysis system to obtain.

[0034] Among them, the unprocessed exception log includes at least the description text of the system logic and the description text of the system status. The description text of the system logic is expressed in natural language that humans can understand. When an error occurs in the system, it describes the event that the system cannot continue to execute, such as what kind of error occurred when calling a certain module, what kind of error occurred when accessing a certain external interface, and system resource exhaustion. The description text of the system status is expressed as a set of structured data, such as the timestamps submitted by each job when the system is running, resource utilization, data throughput, job execution time, etc. This series of parameters quantitatively describes the status of the system when it runs to a specific stage.

[0035] It should be noted that, by obtaining the unprocessed exception log generated when an exception occurs in the system, subsequent analysis of the unprocessed exception log can be achieved.

[0036] Step S102, input the exception log to be processed into the pre-trained target language model to obtain multiple first-dimensional vectors, wherein each first-dimensional vector represents the similarity probability between the exception log to be processed and each sentence pair corresponding to the exception log to be processed, and each sentence pair is generated by combining the exception log to be processed and a label explanation text, and the label explanation text at least includes the exception details information and / or exception solution of the preset exception type label.

[0037] In step S102, the data analysis system may input the aforementioned exception log to be processed into a pre-trained target language model. In this embodiment, the pre-trained target language model may be a BERT (Bidirectional Encoder Representations from Transformers) model, which is a classic large-scale pre-trained language model that aims to pre-train deep bidirectional representations of text by jointly adjusting the context of all layers in the model.

[0038] Optionally, the data analysis system can control the target language model to combine the exception log to be processed with multiple label explanation texts to generate a sentence pair composed of the exception log to be processed and a label explanation text, and calculate the similarity probability between the exception log to be processed and the label explanation text in the sentence pair, so as to output the first dimension vector corresponding to each sentence pair, that is, the similarity probability between the exception log to be processed and the label explanation text. Among them, each label explanation text is in natural language form, which corresponds to a preset exception type label, and each preset exception type label corresponds to an exception type. Each label text can be a detailed description of the exception type corresponding to the preset exception type label, or an explanation (i.e., a solution) of the exception type corresponding to the preset exception type label, or a combination of a detailed description and an explanation of the exception type corresponding to the preset exception type label.

[0039] It should be noted that since the label explanation text in each sentence pair corresponds to a different preset exception type label, and each preset exception type label corresponds to an exception type, the similarity probability between the exception log to be processed and each sentence pair corresponding to the exception log to be processed is obtained based on the target language model, and the similarity judgment between the exception type corresponding to the exception log to be processed and the exception type corresponding to each sentence pair is realized, which facilitates the subsequent positioning of the exception log problem.

[0040] Step S103, determining a target first-dimensional vector with the largest similarity probability from the multiple first-dimensional vectors, and extracting a target label explanation text from the sentence pair corresponding to the target first-dimensional vector.

[0041] In step S103, when the similarity probability between the abnormal log to be processed and the sentence pair is higher, the abnormal type of the abnormal log to be processed is more similar to the abnormal type corresponding to the sentence pair, and the first dimension vector is larger or closer to a certain value. Therefore, the data analysis system can determine the target first dimension vector with the highest similarity probability from multiple first dimension vectors based on the value of the first dimension vector, and extract the target label explanation text from the sentence pair corresponding to the target first dimension vector. The target label explanation text is the relatively optimal explanation of the abnormal cause corresponding to the abnormal log to be processed.

[0042] It should be noted that by determining the target first-dimensional vector with the largest similarity probability and extracting the target label explanation text corresponding to the target first-dimensional vector, the relatively optimal explanation of the abnormal cause corresponding to the abnormal log to be processed is determined, that is, the abnormal problem location of the abnormal log to be processed is achieved.

[0043] Step S104: taking the target tag explanation text as the analysis result of the exception log to be processed.

[0044] In step S104, the data analysis system can use the above-determined target tag interpretation text as the analysis result of the exception log to be processed, and display the analysis result to the operator through the human-computer interaction interface, so that the operator can know the analysis result and maintain the system that generates the exception log to be processed based on the analysis result.

[0045] It should be noted that by using the target label explanation text as the analysis result of the exception log to be processed, the manual analysis of the exception log is avoided, so that the operator can quickly obtain the cause of the exception log and quickly solve the exception problem based on the exception solution in the target label explanation text, thereby improving the efficiency of exception analysis and problem solving.

[0046] Based on the scheme defined by the above steps S101 to S104, it can be known that in an embodiment of the present invention, a method of locating the abnormal problem of the exception log to be processed based on the target language model is adopted, by obtaining the exception log to be processed generated when the system exception occurs, and then inputting the exception log to be processed into the pre-trained target language model to obtain multiple first-dimensional vectors, and then determining the target first-dimensional vector with the largest similarity probability from the multiple first-dimensional vectors, and extracting the target label explanation text from the sentence pair corresponding to the target first-dimensional vector, so as to use the target label explanation text as the analysis result of the exception log to be processed. Among them, each first-dimensional vector represents the similarity probability between the exception log to be processed and each sentence pair corresponding to the exception log to be processed, and each sentence pair is generated by combining the exception log to be processed and a label explanation text, and the label explanation text at least includes the exception details information and / or exception solution of the preset exception type label.

[0047] It is easy to notice that in the above process, since the label explanation text in each sentence pair corresponds to a different preset abnormal type label, and each preset abnormal type label corresponds to an abnormal type, the similarity probability between the abnormal log to be processed and each sentence pair corresponding to the abnormal log to be processed is obtained based on the target language model, and the similarity judgment between the abnormal type corresponding to the abnormal log to be processed and the abnormal type corresponding to each sentence pair is realized. Furthermore, the target label explanation text is extracted from the sentence pair with the highest similarity probability among multiple sentence pairs, and it is used as the analysis result of the abnormal log to be processed, so as to realize the abnormal problem location of the abnormal log to be processed, avoid the analysis of the abnormal log based on manual methods, so that the operator can quickly obtain the cause of the abnormal log, and then quickly solve the abnormal problem, which improves the analysis efficiency and problem solving efficiency of the abnormal log.

[0048] It can be seen that the solution provided by the present application achieves the purpose of locating the abnormal problems of the exception logs to be processed based on the target language model, thereby achieving the technical effect of improving the analysis efficiency of the exception logs, and further solving the technical problem of poor analysis efficiency caused by relying on manual analysis of log files in the prior art.

[0049] In an optional embodiment, in the process of inputting the exception log to be processed into the pre-trained target language model to obtain multiple first-dimensional vectors, the data analysis module can control the target language model to obtain a label explanation text to be combined from at least one label explanation text corresponding to each preset exception type label, and insert a preset separator between the description text of the system logic, the description text of the system status and the label explanation text to be combined to obtain the target text, insert a preset sentence start label at the beginning of the target text, obtain sentence pairs corresponding to each preset exception type label, and generate multiple first-dimensional vectors based on the sentence pairs corresponding to each preset exception type label.

[0050] Optionally, each preset exception type label and at least one label explanation text corresponding thereto can be stored in a preset storage area, specifically a storage area such as a database or a cloud server. After the data analysis module inputs the log to be processed into the pre-trained target language model, the data analysis module can control the target language model to obtain from the preset storage area a label explanation text corresponding to each preset exception type label, and use it as the label explanation text to be combined. Here, the target language model is a BERT model. For example, when there are ten preset exception type labels in the preset storage area, the data analysis module controls the target language model to obtain one label explanation text from the multiple label explanation texts corresponding to each preset exception type label, so as to obtain ten label explanation texts to be combined, and each label explanation text to be combined corresponds to a preset exception type label respectively.

[0051] Furthermore, the data analysis module can control the target language model to perform text processing on the exception log to be processed. During the text processing, the target language model can convert the character sequence <w1,..., wi,... wn> of the input text into <CLS, w1,..., wi,... wn, SEP>, where "CLS" is a specified sequence start symbol, that is, a preset sentence start label, without other language meanings, and "SEP" is a specified sequence end symbol or separator, that is, a preset separator. When the character sequence of the input text contains multiple sentences, the corresponding number of "SEP" can be used.

[0052] Specifically, in this embodiment, the target language model can extract the description text of the system logic and the description text of the system state of the exception log to be processed, and convert the description text of the system logic, the description text of the system state, and each of the aforementioned label explanation texts to be combined into <CLS, description text of system logic, SEP, description text of system state, SEP, label explanation text, SEP> or <CLS, description text of system logic, SEP, description text of system state, SEP, preset exception type label / label explanation text, SEP>, so as to obtain a sentence pair corresponding to each preset exception type label. Among them, in the BERT model, the vector corresponding to "CLS" is usually used to represent the vector of the entire character sequence of the input text.

[0053] Furthermore, after obtaining the sentence pair corresponding to each preset exception type label, the data analysis system can control the target language model to perform text representation processing on each sentence pair to generate multiple first-dimensional vectors. Specifically, in the BERT model, a multi-head self-attention mechanism module is constructed. The basic calculation formula of each multi-head self-attention mechanism module is as follows:

[0054]

[0055] Among them, Softmax() represents the normalization processing function, Q r , K r 、V r The vector matrix corresponding to the sentence pair is divided into three parts. Represent different weight matrices. Specifically, in a single tap r, the vector matrix corresponding to the sentence pair will be divided into Q r , K r 、V r Three parts, then Q r , K r 、V r The three matrices are transformed into different weight matrices. Perform linear mapping and calculate the similarity respectively, then determine the weight value based on the similarity, and perform weighted summation on each vector in the V matrix to obtain H r , which is the result output by a single tap r.

[0056] After that, for all the different taps r, they are concatenated and linearly transformed to the original vector scale, and then added to the original input to obtain the text representation corresponding to the input text. The formula is as follows:

[0057] X′=HW H +X=[H1,...,H r , ..., H R ]W H +X

[0058] Among them, X′ represents the text representation corresponding to the input text, which takes into account and constructs the relationship between the description text of system logic, the description text of system status, and the label explanation text of the combination, [H1, ..., H r , ..., H R ] represents each tap, X represents the input text, i.e., sentence pair, W H represents the pair [H1, ..., H r , ..., H R ] performs a linear transformation of the original vector scale.

[0059] Furthermore, the generated text representation vector is passed through a fully connected layer MLP() to extract and compress the relationship between different dimensions in the high-dimensional vector, reducing the vector dimension to adapt to the overall classification task. Since after the text processing of the exception log to be processed, the task is transformed into a binary classification problem in which the model determines whether the text pair is similar, the final output of the fully connected layer MLP is a two-dimensional vector to characterize the similarity probability of each sentence pair corresponding to the exception log to be processed and the exception log to be processed. Finally, in order to express the probability more intuitively, the data analysis system can control the target language model to use the softmax function to normalize the two-dimensional vector and convert all variables therein into decimals in the range of [0,1]. The formula is as follows:

[0060] P = Softmax(MLP(X′ CLS ))

[0061] Among them, Softmax() represents the normalization function, MLP(X′ CLS ) represents the output of the fully connected layer MLP(), P represents the probability vector of the exception log to be processed corresponding to the input sentence pair being divided into the exception type corresponding to the label explanation text in the sentence pair, and the P vector is a two-dimensional vector and includes at least the first dimension vector, thereby realizing the acquisition of the first dimension vector.

[0062] It should be noted that by controlling the target language model to generate sentence pairs and generating multiple first-dimensional vectors based on the sentence pairs, accurate determination of the similarity between the exception log to be processed and each exception type is achieved.

[0063] In an optional embodiment, each first-dimensional vector in the plurality of first-dimensional vectors corresponds to a second-dimensional vector, wherein the second-dimensional vector represents a dissimilarity probability between the exception log to be processed and each sentence pair corresponding to the exception log to be processed.

[0064] Optionally, the aforementioned P vector also includes a second-dimensional vector, and the data analysis system can combine the value of the first-dimensional vector with the value of the second-dimensional vector to determine the target first-dimensional vector with the highest similarity probability from multiple first-dimensional vectors, thereby improving the more accurate judgment of the target first-dimensional vector and further improving the analysis accuracy.

[0065] In an optional embodiment, before inputting the exception log to be processed into the pre-trained target language model, the data analysis system can obtain multiple historical exception logs, and then vectorize each historical exception log according to the description text of the system logic to obtain the semantic vector corresponding to each historical exception log. Each historical exception log contains at least the description text of the system logic, and the description text of the system logic includes at least the description information of the event that caused the system exception.

[0066] Optional, such as Figure 2 As shown, the data analysis system can obtain multiple historical abnormality logs based on manually input data, or directly read from a storage device such as a related system or memory. After obtaining multiple historical abnormality data, the data analysis system can extract the description text of the system logic in each historical abnormality data, and vectorize the description text of the system logic in each historical abnormality data to obtain a semantic vector corresponding to the historical abnormality log.

[0067] It should be noted that, by obtaining the semantic vector corresponding to each historical abnormal log, the initial language model is subsequently trained based on each historical abnormal log to obtain a target language model.

[0068] In an optional embodiment, in the process of vectorizing each historical exception log according to the description text of the system logic, the data analysis system can count the first frequency of each word in the description text of the system logic in each historical exception log and the second frequency of each word in all historical exception logs, and then calculate the weight value of each word in each historical exception log based on the first frequency and the second frequency, so that in each historical exception log, the weight value of each word and the word semantic vector of each word are weightedly summed to obtain the semantic vector corresponding to each historical exception log.

[0069] Optionally, the data analysis system can vectorize the description text of the system logic based on the term frequency-inverse document frequency index (TF-IDF). TF-IDF is a technology for extracting keywords from natural language paragraphs. The frequency of a word in a paragraph multiplied by the inverse document frequency of the word in the entire natural language corpus is the TF-IDF score. The higher the TF-IDF score, the higher the weight of the corresponding word in its paragraph, which means that the word has a higher contribution to the semantics of the entire paragraph.

[0070] Specifically, taking any one of the multiple historical anomaly logs as an example, the data analysis system can obtain the frequency of each word in the description text of the system logic appearing in the anomaly log, that is, the first frequency, and obtain the probability of each word in the description text of the system logic appearing in all historical daily logs, that is, the second frequency. Thus, the TF-IDF method is adopted to calculate the TF-IDF weight of each word for the historical anomaly log based on the first frequency and the second frequency. Furthermore, based on the aforementioned TF-IDF weight of each word, the word semantic vectors of all words in the historical anomaly log are weighted and summed, so that the semantic vector corresponding to the historical anomaly log can be obtained.

[0071] It should be noted that by calculating the first frequency and the second frequency of each word in the description text of the system logic corresponding to each historical exception log, and calculating the semantic vector corresponding to each historical exception log based on the first frequency and the second frequency, the semantic vector corresponding to each historical exception log is accurately determined, thereby achieving accurate extraction of the natural language semantics contained in the historical exception log.

[0072] In an optional embodiment, after vectorizing each historical exception log according to the description text of the system logic to obtain the semantic vector corresponding to each historical exception log, the data analysis system can cluster the semantic vectors corresponding to multiple historical exception logs to obtain the exception type corresponding to each historical exception log, and then obtain the preset exception type label corresponding to each exception type, and annotate the preset exception type label on the corresponding historical exception log to obtain the annotated historical exception log, and then train the target language model based on the annotated historical exception log. Each exception type corresponds to at least one historical exception log, and each exception type corresponds to a preset exception type label.

[0073] Optional, such as Figure 2 As shown, the operator can determine the initial number of clusters of the system exception logs with the help of the development manual written by the system in the development phase and the problem summary and relevant experience of the system in the operation phase, or the data analysis system can determine the initial number of clusters of the system exception logs based on preset values, or the data analysis system can calculate the initial number of clusters of the system exception logs based on relevant algorithms. After determining the initial number of clusters, the data analysis system can use the K-means clustering algorithm to perform multiple clustering calculations on the semantic vectors corresponding to multiple historical exception logs based on the initial number of clusters, so as to obtain the clustering results of the semantic vectors corresponding to the multiple historical exception logs, thereby determining the exception type corresponding to each historical exception log based on the clustering results.

[0074] Furthermore, after determining the exception type corresponding to each historical exception log, such as Figure 2 As shown, the data analysis system can obtain the preset exception type label corresponding to each exception type, and mark the preset exception type label on the corresponding historical exception log to obtain the marked historical exception log, wherein the marked historical exception file at least includes the preset exception type label, the description text of the system logic and the description text of the system status, and the preset exception type label can be a number, letter or other identifier, or it can be directly taken as the name of the exception type.

[0075] Furthermore, after obtaining the annotated historical exception logs, the data analysis system uses the annotated historical exception logs as training samples to train the language model to be trained, thereby obtaining a target language model.

[0076] It should be noted that by determining the exception type corresponding to each historical exception log and labeling each historical exception log based on the exception type, the acquisition of training samples is achieved, so that the initial language model can be effectively trained, and then the target language model that can accurately judge is obtained.

[0077] In an optional embodiment, in the process of obtaining the target language model by training the annotated historical exception log, the data analysis system can perform text expansion on the annotated historical exception log to obtain the expanded historical exception log, thereby training the initial language model based on the expanded historical exception log to obtain the target language model. The expanded historical exception log includes at least: a description text of the system logic, a description text of the system status, and a label explanation text of a preset exception type label.

[0078] Optional, such as Figure 2 As shown, in order to cope with the unbalanced distribution of system anomaly types, in this application, the aforementioned training samples (i.e., the annotated historical anomaly logs) can be text-expanded to enrich the training samples so that the distribution of each system anomaly type is more even. Figure 3 As shown, the data analysis system can extract the description text of the system logic from the annotated historical anomaly logs, and extract the description text of the effective system status based on manual screening, and at the same time create the label explanation text or obtain the label explanation text from the preset storage area. Then, based on the relationship between the historical anomaly logs, anomaly types and label explanation texts, the multi-classification task can be converted into a sentence pair task, that is, based on the historical anomaly logs, anomaly types and label explanation texts, sentence pairs corresponding to each historical anomaly file are generated, and then the sentence pairs are transformed to achieve text expansion.

[0079] Further, after the historical anomaly logs are expanded, the data analysis system can train the initial language model based on the expanded historical anomaly logs to obtain the target language model. In this embodiment, the method provided by the present application can be implemented in Python 3.7, and the PyTorch framework can be used as a support library for deep learning models. The open source HuggingFace is used as a training framework for the BERT pre-trained model (i.e., the initial language model) based on PyTorch. The BERT pre-trained model can use the BERT-Base version released by Google, which contains a total of 110M parameters.

[0080] It should be noted that, in general, the types of abnormal logs are not evenly distributed. On the one hand, an unbalanced data set will make the language model tend to favor the categories with dominant data distribution when making predictions, causing the model to fail in predicting some more serious abnormal categories that are not dominant in distribution. On the other hand, the amount of abnormal log data may not be enough to train a usable and effective model. Therefore, by performing text expansion on the annotated historical abnormal logs, the training data can be effectively expanded and the robustness of problem location in abnormal logs can be improved.

[0081] In an optional embodiment, in the process of performing text expansion on the annotated historical exception log to obtain the expanded historical exception log, the data analysis system can obtain the label explanation text of the preset exception type label, and when a preset exception type label corresponds to multiple label explanation texts, each label explanation text is added to each annotated historical exception log corresponding to the corresponding preset exception type label, thereby obtaining multiple expanded historical exception logs. Each preset exception type label corresponds to at least one label explanation text.

[0082] Specifically, in conventional applications, the data set format of a typical multi-classification task (text classification) is: <sentence, label>, and multi-classification prediction is directly performed based on the data set in this format. Since the relevant system or model tries to map the label directly from the input text, no additional information is used. In the present application, since each exception type has a set of exception resolution mechanisms, the data set format of the aforementioned typical multi-classification task can be transformed into <description text of the system logic and description text of the system status of the historical exception log, sentence_2, label (0, 1)>, where the content of sentence_2 is the label explanation text, and label (0, 1) represents the preset exception type label corresponding to the label explanation text in each sentence_2.

[0083] Furthermore, after obtaining the sentence pairs corresponding to each historical abnormal log, such as Figure 3 As shown, the data analysis system can obtain at least one label explanation text corresponding to each preset abnormal type label and generate an explanation dictionary. The format of each pair of entries in the explanation dictionary is as follows:

[0084] {

[0085] "label": [explanation1, ···, explanationN],

[0086] "label response": [response 1, ···, response M]

[0087] }

[0088] Among them, [explanation 1, ···, explanation N] represents the exception details information of the preset exception type label corresponding to the label explanation text, and [response 1, ···, response M] represents the exception solution of the preset exception type label corresponding to the label explanation text. When there is only explanation or only label in the label explanation text, M+N label explanation texts can be generated. When there are only explanation and label in the label explanation text, M*N label explanation texts can be generated. When the label explanation text can contain only explanation or only label, or only explanation and label, M*N+M+N label explanation texts can be generated.

[0089] Afterwards, based on the interpretation dictionary, the content corresponding to sentence_2 in the aforementioned sentence pair is expanded. That is, for any historical anomaly log, if the anomaly type in the corresponding sentence pair corresponds to multiple aforementioned label interpretation texts, a sentence pair corresponding to the historical anomaly log can be generated based on each label interpretation text, so that a historical anomaly log has multiple sentence pairs corresponding to the same anomaly type, thereby achieving text expansion. It should be noted that in the aforementioned text expansion process, the data analysis system can, based on actual conditions and according to the amount of data of each anomaly type, level the unbalanced data distribution, so that in the multiple expanded historical anomaly logs (i.e., sentence pairs) finally obtained, the amount of data of each anomaly type is evenly distributed.

[0090] It should be noted that by expanding the historical exception logs based on at least one label explanation text corresponding to each preset exception type label, the historical exception logs are effectively expanded, avoiding the imbalance of data distribution in the training data, thereby improving the robustness of the target language model.

[0091] It should be noted that in this application, on the one hand, based on the description text of the system logic in the exception log, the TF-IDF algorithm is used for text vectorization representation, and the K-Means clustering algorithm is used to achieve large-scale and rapid automatic induction of exceptions and errors. On the other hand, based on the BERT model, the description text of the system logic in the exception log is integrated with the description text of the system status for modeling, which can fully expose the status and logical hidden dangers in the exception log and automatically locate the problem. On the other hand, the multi-classification task is converted into a sentence pair similarity judgment task, and the data is expanded, which can effectively improve the robustness of the exception log problem location method.

[0092] It can be seen that the solution provided by the present application achieves the purpose of locating the abnormal problems of the exception logs to be processed based on the target language model, thereby achieving the technical effect of improving the analysis efficiency of the exception logs, and further solving the technical problem of poor analysis efficiency caused by relying on manual analysis of log files in the prior art.

[0093] Example 2

[0094] According to an embodiment of the present invention, an embodiment of an abnormal log analysis device is provided, wherein: Figure 4 is a schematic diagram of an optional abnormal log analysis device according to an embodiment of the present invention, such as Figure 4 As shown, the device comprises:

[0095] The acquisition module 401 is used to acquire the to-be-processed exception log generated when an exception occurs in the system;

[0096] An input module 402 is used to input the exception log to be processed into a pre-trained target language model to obtain a plurality of first-dimensional vectors, wherein each first-dimensional vector represents a similarity probability between the exception log to be processed and each sentence pair corresponding to the exception log to be processed, and each sentence pair is generated by combining the exception log to be processed and a label explanation text, and the label explanation text at least includes exception details information and / or an exception solution of a preset exception type label;

[0097] A first determination module 403 is used to determine a target first-dimensional vector with the largest similarity probability from a plurality of first-dimensional vectors, and extract a target label explanation text from a sentence pair corresponding to the target first-dimensional vector;

[0098] The second determination module 404 is used to use the target tag interpretation text as the analysis result of the abnormal log to be processed.

[0099] It should be noted that the above-mentioned acquisition module 401, input module 402, first determination module 403 and second determination module 404 correspond to steps S101 to S104 in the above-mentioned embodiment, and the examples and application scenarios implemented by the four modules and the corresponding steps are the same, but are not limited to the contents disclosed in the above-mentioned embodiment 1.

[0100] Optionally, each first-dimensional vector in the multiple first-dimensional vectors corresponds to a second-dimensional vector, wherein the second-dimensional vector represents the dissimilarity probability between the exception log to be processed and each sentence pair corresponding to the exception log to be processed.

[0101] Optionally, the analysis device for the exception log also includes: a first sub-acquisition module, used to acquire multiple historical exception logs, wherein each historical exception log contains at least a description text of the system logic, wherein the description text of the system logic includes at least description information of the event that caused the system exception; a first processing module, used to vectorize each historical exception log according to the description text of the system logic to obtain a semantic vector corresponding to each historical exception log.

[0102] Optionally, the first processing module also includes: a statistical module, which is used to count the first frequency of each word in the description text of the system logic in each historical exception log and the second frequency of each word in all historical exception logs; a first calculation module, which is used to calculate the weight value of each word in each historical exception log according to the first frequency and the second frequency; and a second calculation module, which is used to perform weighted summation of the weight value of each word and the word semantic vector of each word in each historical exception log to obtain the semantic vector corresponding to each historical exception log.

[0103] Optionally, the analysis device for the exception log also includes: a second processing module, used to cluster the semantic vectors corresponding to multiple historical exception logs to obtain the exception type corresponding to each historical exception log, wherein each exception type corresponds to at least one historical exception log; a second sub-acquisition module, used to obtain a preset exception type label corresponding to each exception type, and mark the preset exception type label on the corresponding historical exception log to obtain the marked historical exception log, wherein one exception type corresponds to one preset exception type label; a third processing module, used to train the target language model according to the marked historical exception logs.

[0104] Optionally, the third processing module also includes: a text expansion module, which is used to perform text expansion on the annotated historical exception log to obtain an expanded historical exception log, wherein the expanded historical exception log at least includes: a description text of the system logic, a description text of the system status, and a label explanation text of a preset exception type label; a fourth processing module, which is used to train the initial language model based on the expanded historical exception log to obtain a target language model.

[0105] Optionally, the text expansion module also includes: a third sub-acquisition module, used to obtain the label explanation text of the preset exception type label, wherein each preset exception type label corresponds to at least one label explanation text; a fifth processing module, used to, when a preset exception type label corresponds to multiple label explanation texts, add each label explanation text to each annotated historical exception log corresponding to the corresponding preset exception type label, so as to obtain multiple expanded historical exception logs.

[0106] Optionally, the exception log to be processed includes at least a description text of the system logic and a description text of the system status, and the input module also includes: a sixth processing module, used to control the target language model to obtain a label explanation text to be combined from at least one label explanation text corresponding to each preset exception type label, and insert a preset separator between the description text of the system logic, the description text of the system status and the label explanation text to be combined to obtain the target text, insert a preset sentence start label at the beginning of the target text, obtain sentence pairs corresponding to each preset exception type label, and generate multiple first-dimensional vectors based on the sentence pairs corresponding to each preset exception type label.

[0107] Example 3

[0108] According to another aspect of an embodiment of the present invention, a computer-readable storage medium is provided. The computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the above-mentioned abnormal log analysis method.

[0109] Example 4

[0110] According to another aspect of an embodiment of the present invention, an electronic device is provided, wherein: Figure 5 is a schematic diagram of an optional electronic device according to an embodiment of the present invention, such as Figure 5 As shown, the electronic device includes a memory and a processor, the memory stores a computer program, and the processor is configured to run the computer program to execute the above-mentioned abnormal log analysis method.

[0111] The serial numbers of the above embodiments of the present invention are only for description and do not represent the advantages or disadvantages of the embodiments.

[0112] In the above embodiments of the present invention, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0113] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0114] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed over multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0115] In addition, each functional unit in each embodiment of the present invention may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0116] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, in essence, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions for a computer device (which can be a personal computer, a server or a network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), mobile hard disk, magnetic disk or optical disk and other media that can store program codes.

[0117] The above are only preferred embodiments of the present invention. It should be pointed out that, for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present invention. These improvements and modifications should also be regarded as the scope of protection of the present invention.

Claims

1. A method for analyzing abnormal logs, characterized in that: include: Obtain the pending exception logs generated when a system exception occurs; Inputting the exception log to be processed into a pre-trained target language model to obtain multiple first-dimensional vectors, wherein each first-dimensional vector represents the similarity probability between the exception log to be processed and each sentence pair corresponding to the exception log to be processed, and each sentence pair is generated by combining the exception log to be processed and a label explanation text, wherein the label explanation text at least includes exception details information and / or an exception solution of a preset exception type label; The exception log to be processed includes at least a description text of the system logic and a description text of the system state, wherein the exception log to be processed is input into a pre-trained target language model to obtain a plurality of first-dimensional vectors, including: controlling the target language model to obtain a label explanation text to be combined from at least one label explanation text corresponding to each preset exception type label, and inserting a preset separator between the description text of the system logic, the description text of the system state, and the label explanation text to be combined to obtain a target text, inserting a preset sentence start label at the beginning position of a sentence in the target text to obtain a sentence pair corresponding to each preset exception type label, and generating the plurality of first-dimensional vectors based on the sentence pairs corresponding to each preset exception type label; When the target language model is a BERT model, a multi-head self-attention mechanism module is constructed in the BERT model. Each multi-head self-attention mechanism module obtains the output results of each tap r through a basic calculation formula. For all different taps r, the output results are spliced ​​and then linearly converted to the original vector scale, and then added to the original input to obtain a text representation vector corresponding to the input text; the generated text representation vector is passed through a fully connected layer to extract and compress the relationship between different dimensions in the high-dimensional vector, and output as a two-dimensional vector. The two-dimensional vector represents the similarity probability between the to-be-processed exception log and each sentence pair corresponding to the to-be-processed exception log. The data analysis system controls the target language model to use a softmax function to normalize the two-dimensional vector. The to-be-processed exception log corresponding to the input sentence pair is divided into a probability vector of the exception type corresponding to the label explanation text in the sentence pair; The basic calculation formula of the multi-head self-attention mechanism module is as follows: Among them, Softmax() represents the normalization processing function, Q r , K r 、V r The vector matrix corresponding to the sentence pair is divided into three parts. Represent different weight matrices respectively; Determine the target first-dimensional vector with the largest similarity probability from the multiple first-dimensional vectors, and extract the target label explanation text from the sentence pair corresponding to the target first-dimensional vector; The target tag interpretation text is used as the analysis result of the exception log to be processed.

2. The method according to claim 1, characterized in that Each first-dimensional vector in the plurality of first-dimensional vectors corresponds to a second-dimensional vector, wherein the second-dimensional vector represents a dissimilarity probability between the exception log to be processed and each sentence pair corresponding to the exception log to be processed.

3. The method according to claim 1, characterized in that Before inputting the to-be-processed exception log into the pre-trained target language model, the method further includes: Acquire multiple historical exception logs, wherein each historical exception log contains at least a description text of the system logic, wherein the description text of the system logic at least includes description information of an event that caused the system exception to occur; Each historical exception log is vectorized according to the description text of the system logic to obtain a semantic vector corresponding to each historical exception log.

4. The method according to claim 3, characterized in that Vectorization is performed on each of the historical exception logs according to the description text of the system logic to obtain a semantic vector corresponding to each of the historical exception logs, including: Counting a first frequency of each word in the description text of the system logic appearing in each of the historical exception logs and a second frequency of each word appearing in all the historical exception logs; Calculate the weight value of each word in each historical abnormality log according to the first frequency and the second frequency; In each of the historical exception logs, a weighted sum is performed on the weight value of each word and the word semantic vector of each word to obtain the semantic vector corresponding to each of the historical exception logs.

5. The method according to claim 3, characterized in that After vectorizing each of the historical exception logs according to the description text of the system logic to obtain a semantic vector corresponding to each of the historical exception logs, the method further includes: Performing clustering processing on the semantic vectors corresponding to the multiple historical exception logs to obtain an exception type corresponding to each historical exception log, wherein each exception type corresponds to at least one historical exception log; Obtaining a preset exception type label corresponding to each exception type, and marking the preset exception type label on the corresponding historical exception log to obtain a marked historical exception log, wherein one exception type corresponds to one preset exception type label; The target language model is obtained by training according to the annotated historical abnormality logs.

6. The method according to claim 5, characterized in that The target language model is obtained by training the annotated historical abnormality logs, including: Performing text expansion on the annotated historical exception log to obtain an expanded historical exception log, wherein the expanded historical exception log at least includes: a description text of the system logic, a description text of the system status, and a label explanation text of the preset exception type label; The initial language model is trained based on the expanded historical exception logs to obtain the target language model.

7. The method according to claim 6, characterized in that The annotated historical exception log is subjected to text expansion to obtain an expanded historical exception log, including: Obtaining a label explanation text of the preset exception type label, wherein each preset exception type label corresponds to at least one label explanation text; In the case where a preset exception type label corresponds to multiple label explanation texts, each label explanation text is added to each annotated historical exception log corresponding to the corresponding preset exception type label to obtain multiple expanded historical exception logs.

8. An analysis device for abnormal logs, characterized in that: The device comprises: The acquisition module is used to obtain the unprocessed exception logs generated when an exception occurs in the system; An input module is configured to input the exception log to be processed into a pre-trained target language model to obtain a plurality of first-dimensional vectors, wherein each first-dimensional vector represents a similarity probability between the exception log to be processed and each sentence pair corresponding to the exception log to be processed, wherein each sentence pair is generated by combining the exception log to be processed with a label explanation text, wherein the label explanation text includes at least exception details information and / or an exception solution of a preset exception type label; The exception log to be processed includes at least a description text of the system logic and a description text of the system status. The input module further includes: a sixth processing module, which is used to control the target language model to obtain a label explanation text to be combined from at least one label explanation text corresponding to each preset exception type label, and insert a preset separator between the description text of the system logic, the description text of the system status, and the label explanation text to be combined to obtain a target text, insert a preset sentence start label at the beginning of a sentence in the target text, obtain a sentence pair corresponding to each preset exception type label, and generate multiple first-dimensional vectors based on the sentence pairs corresponding to each preset exception type label; When the target language model is a BERT model, a multi-head self-attention mechanism module is constructed in the BERT model. Each multi-head self-attention mechanism module obtains the output results of each tap r through a basic calculation formula. For all different taps r, the output results are spliced ​​and then linearly converted to the original vector scale, and then added to the original input to obtain a text representation vector corresponding to the input text; the generated text representation vector is passed through a fully connected layer to extract and compress the relationship between different dimensions in the high-dimensional vector, and output as a two-dimensional vector. The two-dimensional vector represents the similarity probability between the to-be-processed exception log and each sentence pair corresponding to the to-be-processed exception log. The data analysis system controls the target language model to use a softmax function to normalize the two-dimensional vector. The to-be-processed exception log corresponding to the input sentence pair is divided into a probability vector of the exception type corresponding to the label explanation text in the sentence pair; The basic calculation formula of the multi-head self-attention mechanism module is as follows: Among them, Softmax() represents the normalization processing function, Q r , K r 、V r The vector matrix corresponding to the sentence pair is divided into three parts. Represent different weight matrices respectively; A first determination module is configured to determine a target first-dimensional vector having the greatest similarity probability from the multiple first-dimensional vectors, and extract a target label explanation text from the sentence pair corresponding to the target first-dimensional vector; The second determining module is configured to use the target tag interpretation text as the analysis result of the exception log to be processed.

9. A computer-readable storage medium, characterized in that The computer-readable storage medium includes a stored program, wherein when the program is executed, the device where the computer-readable storage medium is located is controlled to execute the abnormality log analysis method according to any one of claims 1 to 7.

10. An electronic device comprising a memory and a processor, characterized in that: The memory stores a computer program, and the processor is configured to run the computer program to execute the abnormality log analysis method according to any one of claims 1 to 7.

Images