Log data processing method, device, equipment, storage medium and program product

Abstract

The application discloses a log data processing method and device, equipment, a storage medium and a program product, and belongs to the technical field of computers. The method acquires second log data corresponding to each time period from first log data of a target device based on multiple time periods; determines a first running state parameter corresponding to each time period of the target device based on the second log data corresponding to each time period; determines a target time period from the multiple time periods based on the first running state parameter corresponding to each time period; and determines an application program with an anomaly from multiple application programs based on the second log data corresponding to the target time period. The method first performs coarse-grained processing on log data of each time period, finds a time period that may have an anomaly, then performs fine-grained processing on log data in the time period, finds an application program with an anomaly, reduces the processing amount of log data processing, and improves the processing efficiency of log data.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of computers, and in particular to a log data processing method and device, equipment, a storage medium and a program product. BACKGROUND

[0002] With the continuous development of computer technology, more and more application programs can be installed in electronic devices. In order to effectively grasp the running status of each application program, a burying point can be set in the system of the electronic device, the running status of each application program is obtained through the burying point, and corresponding log data is generated.

[0003] In the related art, by analyzing and processing each piece of generated log data, each application program can be diagnosed to determine whether the application program is normally running or abnormally running.

[0004] Since the number of log data of the electronic device every day is very large, the number of log data that needs to be analyzed and processed in the above scheme is also very large, thereby causing slow analysis and processing speed and low analysis and processing efficiency. SUMMARY

[0005] Embodiments of the present application provide a log data processing method, device, equipment, storage medium and program product, which can improve the processing efficiency of log data. The technical solution is as follows:

[0006] On the one hand, a log data processing method is provided, and the method comprises:

[0007] Based on a plurality of time periods, second log data corresponding to each time period is obtained from first log data of a target device, the first log data being used to record the running state of a plurality of application programs installed on the target device;

[0008] Based on the second log data corresponding to each time period, a first running state parameter corresponding to each time period of the target device is determined, the first running state parameter being used to represent the overall running state of the target device;

[0009] Based on the first running state parameter corresponding to each time period, a target time period is determined from the plurality of time periods, the state represented by the first running state parameter corresponding to the target time period being worse than the state represented by the first running state parameter corresponding to other time periods in the plurality of time periods except the target time period;

[0010] Based on the second log data corresponding to the target time period, an application program with an abnormality in the plurality of application programs is determined.

[0011] On the other hand, a log data processing device is provided, and the device comprises:

[0012] The first obtaining module is configured to obtain, based on a plurality of time periods, second log data corresponding to each time period from first log data of a target device, the first log data being used to record running states of a plurality of application programs installed on the target device;

[0013] The first determining module is configured to determine, based on the second log data corresponding to each time period, a first running state parameter of the target device corresponding to each time period, the first running state parameter being used to represent an overall running state of the target device;

[0014] The second determining module is configured to determine, based on the first running state parameter corresponding to each time period, a target time period from the plurality of time periods, the first running state parameter corresponding to the target time period representing a state that is worse than states represented by first running state parameters corresponding to other time periods in the plurality of time periods except the target time period;

[0015] The third determining module is configured to determine, based on the second log data corresponding to the target time period, an application program that exists abnormally from the plurality of application programs.

[0016] In another aspect, an electronic device is provided, which includes a processor and a memory, the memory storing at least one program code, the at least one program code being loaded and executed by the processor to implement the log data processing method described above.

[0017] In another aspect, a computer readable storage medium is provided, which stores at least one program code, the at least one program code being loaded and executed by a processor to implement the log data processing method described above.

[0018] In another aspect, a computer program product is provided, which stores at least one program code, the at least one program code being loaded and executed by a processor to implement the log data processing method described above.

[0019] The technical scheme provided by the embodiments of the present application has the beneficial effects that:

[0020] The log data processing method provided by the embodiments of the present application divides log data of a target device into a plurality of time periods, performs coarse-grained processing on log data of each time period, finds a time period that may exist abnormally, performs fine-grained processing on log data in the time period, and determines an application program that exists abnormally from a plurality of application programs. The log data processing method does not need to perform fine-grained processing on log data of each time period, reduces the processing amount of log data processing, and improves the processing efficiency of log data.

[0021] It should be understood that the general description and the following detailed description are exemplary and explanatory only and are not restrictive of the present disclosure. BRIEF DESCRIPTION OF DRAWINGS

[0022] Figure 1 is a schematic diagram of an implementation environment for log data processing provided by an embodiment of the present application;

[0023] Figure 2 is a flowchart of a log data processing method provided by an embodiment of the present application;

[0024] Figure 3 is a flowchart of a log data processing method provided by an embodiment of the present application;

[0025] Figure 4 is a schematic diagram of a processing result provided by an embodiment of the present application;

[0026] Figure 5 is a flowchart of an abnormal application program determination method provided by an embodiment of the present application;

[0027] Figure 6 is a structural schematic diagram of a log data processing apparatus provided by an embodiment of the present application;

[0028] Figure 7 is a structural schematic diagram of another log data processing apparatus provided by an embodiment of the present application;

[0029] Figure 8 is a structural block diagram of a terminal provided by an embodiment of the present application;

[0030] Figure 9 is a structural block diagram of a server provided by an embodiment of the present application. DETAILED DESCRIPTION

[0031] In order to make the technical solutions and advantages of the present application clearer, the embodiments of the present application are described in further detail below.

[0032] The terms “first”, “second”, “third”, and “fourth” and the like in the specification of the present application, the claims, and the drawings are used to distinguish different objects, and are not used to describe a particular order. In addition, the terms “include” and “have” and any variations thereof are intended to cover non-exclusive inclusion. For example, a process, method, system, product, or device including a series of steps or units is not limited to the listed steps or units, but can optionally include other steps or units not listed or can optionally include other steps or units inherent to the process, method, product, or device.

[0033] It should be noted that the information (including but not limited to user equipment information, user personal information, etc.), data (including but not limited to data for analysis, stored data, displayed data, etc.) and signals involved in the present application are all authorized by the user or fully authorized by all parties, and the collection, use and processing of related data need to comply with relevant laws, regulations and standards of relevant countries and regions. For example, the log data and the like involved in the present application are obtained under full authorization.

[0034] Figure 1 is a schematic diagram of an implementation environment of a log data processing method provided by an embodiment of the present application, referring to Figure 1 The implementation environment includes an electronic device, which can be provided as a terminal 101, can be provided as a server 102, or can be provided as a terminal 101 and a server 102, and no specific limitation is made to this.

[0035] If the electronic device is provided as a terminal 101, the terminal 101 records log data of the local end, and the recorded log data is processed to determine an application program that exists abnormally in a plurality of application programs installed locally. Subsequently, the terminal 101 can show an application identifier of the abnormal application program to the user, so that the user learns that the abnormal application program exists. The terminal 101 can also report abnormal information of the abnormal application program to an application server of the abnormal application program, so that the abnormal application program is improved. The terminal 101 can also repair the abnormal application program to reduce the influence of the abnormal application program on the running state of the terminal 101.

[0036] If the electronic device is provided as a server 102, the server 102 processes the collected log data of each terminal 101 to determine an application program that exists abnormally in a plurality of application programs installed in each terminal 101. Subsequently, the server 102 can send an application identifier of the abnormal application program to the terminal 101, so that the terminal 101 learns that the abnormal application program exists. The server 102 can also record information such as the number of times the abnormal application program exists on each terminal 101, for reference for technicians to update the application program.

[0037] If the electronic device is provided as a terminal 101 and a server 102, the terminal 101 and the server 102 are connected through a wireless or wired network. The terminal 101 can generate log data and report the generated log data to the server 102. The server receives the log data reported by the terminal 101, analyzes and processes the log data, determines an application program that exists abnormally in the terminal 101, returns an application identifier of the abnormal application program to the terminal 101, and the terminal 101 shows the application identifier.

[0038] The terminal 101 is at least one of a mobile phone, a tablet computer, and a PC (Personal Computer) device. The server 102 can be at least one of a server, a server cluster composed of multiple servers, a cloud server, a cloud computing platform, and a virtualization center.

[0039] Figure 2 is a flowchart of a log data processing method provided by an embodiment of the present application, referring to Figure 2 The method comprises the following steps.

[0040] Step 201: Based on multiple time periods, second log data corresponding to each time period is obtained from first log data of a target device, and the first log data is used to record running states of multiple application programs installed on the target device.

[0041] Step 202: Based on the second log data corresponding to each time period, a first running state parameter corresponding to each time period of the target device is determined, and the first running state parameter is used to represent an overall running state of the target device.

[0042] Step 203: Based on the first running state parameter corresponding to each time period, a target time period is determined from the multiple time periods, and a state represented by the first running state parameter corresponding to the target time period is worse than states represented by first running state parameters corresponding to other time periods except the target time period in the multiple time periods.

[0043] Step 204: Based on the second log data corresponding to the target time period, an application program with an abnormality in the multiple application programs is determined.

[0044] In a possible implementation, based on the second log data corresponding to the target time period, the application program with the abnormality in the multiple application programs is determined, comprising:

[0045] Based on the second log data corresponding to the target time period, a second running state parameter of each application program is determined, and the second running state parameter of the application program is used to represent a running state of the application program.

[0046] Based on the second running state parameter of each application program, the application program with the abnormality in the multiple application programs is determined.

[0047] In another possible implementation, the second running state parameter of the application program is used to represent an influence degree of the application program on the running state of the target device; based on the second running state parameter of each application program, the application program with the abnormality in the multiple application programs is determined, comprising:

[0048] The target application program having the greatest influence on the running state of the target device is determined as the abnormal application program from the plurality of application programs based on the second running state parameter of each application program.

[0049] In another possible implementation, determining the application program having an abnormality from the plurality of application programs based on the second running state parameter of each application program comprises:

[0050] Determining the application program having an abnormality from the plurality of application programs based on the second running state parameter of each application program and the second running state parameter corresponding to each application program in the plurality of reference devices.

[0051] In another possible implementation, determining the application program having an abnormality from the plurality of application programs based on the second running state parameter of each application program comprises:

[0052] Determining the target application program having the greatest influence on the running state of the target device from the plurality of application programs based on the second running state parameter of each application program;

[0053] Determining the analysis result of the target application program based on the second running state parameter corresponding to the target application program and the second running state parameter corresponding to the target application program in the plurality of reference devices, the analysis result being used to indicate whether the target application program is an abnormal application program.

[0054] In another possible implementation,

[0055] Determining the analysis result of the target application program based on the second running state parameter corresponding to the target application program and the second running state parameter corresponding to the target application program in the plurality of reference devices comprises any one of the following:

[0056] Determining an average running state parameter based on the second running state parameter corresponding to the target application program in the plurality of reference devices; and determining the analysis result based on the average running state parameter and the second running state parameter corresponding to the target application program in the target device;

[0057] Ranking the second running state parameters corresponding to the target application program in the plurality of reference devices, and determining the second running state parameter located at a target ranking position as a reference running state parameter; and determining the analysis result based on the reference running state parameter and the second running state parameter corresponding to the target application program in the target device;

[0058] Ranking the second running state parameters corresponding to the target application program in the plurality of reference devices and the second running state parameter corresponding to the target application program in the target device; and determining the analysis result based on the ranking position of the second running state parameter corresponding to the target application program in the target device.

[0059] In another possible implementation, the first log data is further used to record running states of a plurality of hardware modules in the target device; and the method further includes:

[0060] After determining the abnormal application program, third log data corresponding to the abnormal application program is acquired from the second log data, the third log data being used to represent running states of the plurality of hardware modules when the plurality of hardware modules provide services for the abnormal application program or influences of the services on the running states of the plurality of hardware modules;

[0061] Based on the third log data, an abnormal reason of the abnormal application program is determined.

[0062] In another possible implementation, based on the third log data, the abnormal reason of the abnormal application program is determined, including:

[0063] Based on the third log data, an abnormal hardware module existing in the plurality of hardware modules is determined;

[0064] Based on fourth log data corresponding to the abnormal hardware module in the third log data, an abnormal reason of the abnormal hardware module is determined;

[0065] The abnormal reason is determined as the abnormal reason of the abnormal application program.

[0066] In another possible implementation, the first running state parameter is an index value corresponding to a comprehensive index represented by a first index; based on the second log data corresponding to each time period, the first running state parameter corresponding to each time period of the target device is determined, including:

[0067] Based on the second log data corresponding to each time period and the first index, an index value corresponding to each time period of the first index is determined, the first index being used to represent a comprehensive index of the plurality of application programs;

[0068] Based on the index value corresponding to each time period of the first index, the first running state parameter corresponding to each time period of the target device is determined.

[0069] In another possible implementation, based on the first running state parameter corresponding to each time period, a target time period is determined from the plurality of time periods, including any one of the following:

[0070] From the first running state parameter corresponding to each time period, a target running state parameter representing the worst state is determined, and a time period corresponding to the target running state parameter is determined as the target time period;

[0071] Based on a running state parameter threshold, from the first running state parameter corresponding to each time period, a target running state parameter representing a state worse than a state represented by the running state parameter threshold is determined, and a time period corresponding to the target running state parameter is determined as the target time period.

[0072] In another possible implementation, after determining the application program with an exception from the plurality of application programs based on the second log data corresponding to the target time period, the method further includes:

[0073] displaying at least one of the following:

[0074] the first running state parameter corresponding to each time period;

[0075] the application identifier of the application program with an exception;

[0076] the second running state parameter of each application program in each time period, the second running state parameter of the application program being used to indicate the running state of the application program;

[0077] the exception cause of the application program with an exception.

[0078] The log data processing method provided in the embodiments of the present application divides log data of a target device into a plurality of time periods, performs coarse-grained processing on the log data of each time period, finds a time period in which an exception may exist, performs fine-grained processing on the log data in the time period, and determines an application program with an exception from a plurality of application programs. The log data processing method provided in the embodiments of the present application does not need to perform fine-grained processing on the log data of each time period, reduces the processing amount of log data processing, and improves the processing efficiency of log data.

[0079] Figure 3 is a flowchart of a log data processing method provided in the embodiments of the present application, executed by an electronic device, referring to Figure 3 , the method includes:

[0080] Step 301: The electronic device collects first log data, the first log data being used to record the running states of a plurality of application programs installed on a target device and the running states of a plurality of hardware modules in the target device.

[0081] The electronic device and the target device can be the same device or different devices, which is not limited in the embodiments of the present application.

[0082] The target device is installed with a plurality of application programs, which can be any application program, for example, an e-commerce application program, an instant messaging application program, a short video application program, etc. The embodiments of the present application do not limit the application programs installed on the target device. The first log data used to record the running states of the plurality of application programs installed on the target device means that the first log data is used to record the usage information of each application program at a certain time point, for example, the application program being used at the current time point, the current of the application program, etc.

[0083] The target device also has a plurality of hardware modules, for example, a CPU (central processing unit) of the target device, a Modem module, a screen, etc., and embodiments of the present application do not limit the plurality of hardware modules of the target device. The first log data is used to record the running state of the plurality of hardware modules in the target device, which means that the first log data is used to record the state information of each hardware module at a certain time point, for example, the load of the CPU, the traffic data of the Modem module, the frame drop rate of the screen, etc.

[0084] Exemplarily, the first log data further includes at least one of the following: (1) a device identifier; (2) a time identifier; and (3) an application identifier.

[0085] The device identifier is an identifier of the device to which the first log data belongs, and the device identifier is used to identify a unique device, for example, the device identifier can be an IMEI (International Mobile Equipment Identity), a MAC (Media Access Control Address), etc., and embodiments of the present application do not limit the device identifier. In some embodiments, after the target device generates the first log data, the target device reports the first log data to the server side, and the server side analyzes and processes the first log data reported by a plurality of devices, in order to enable the server side to distinguish the first log data reported by different devices, the device identifier is carried in the first log data, so as to distinguish different devices or users. It should be noted that, in view of the protection of user privacy, when uploading the first log data, the first log data can be encrypted, or the device identifier can be encrypted.

[0086] The time identifier is used to indicate the generation time of the first log data, and also indicates the occurrence time of the event described by the first log data, and the time identifier can be obtained based on the time displayed on the target device.

[0087] The application identifier is used to distinguish different application programs, and the application identifier is used to indicate a unique application program, for example, the application identifier is an application name, an application number, etc. In some embodiments, the application identifier also carries a version number of the application program, which is used to distinguish different versions of the application program.

[0088] It should be noted that in this embodiment, the collection of the first log data is subject to full user authorization. In other words, the electronic device will only collect the first log data after obtaining full authorization and permission from the user. For example, before collecting the first log data, the electronic device displays a first pop-up window to confirm with the user whether they allow the electronic device to collect and analyze the first log data. After detecting the user's confirmation based on the first pop-up window, the electronic device executes the step of collecting the first log data.

[0089] In some embodiments, multiple tracking points are set on the target device, and the first log data is generated by receiving the tracking point data uploaded by these tracking points.

[0090] In some embodiments, the first log data is stored in the form of a database, and the data is organized, stored, and managed according to the data structure of the database. The database can be any type of database, such as an SQL (Structured Query Language) database. This application does not limit the database used in its embodiments.

[0091] Optionally, after the server receives the first log data reported by the device, it can store the first log data in the corresponding date partition according to the reporting time for subsequent processing. For example, if log data 1 is received on March 8, 2022, then log data 1 is stored in the partition corresponding to March 8, 2022, which is used to store log data generated on March 8, 2022; if log data 2 is received on March 9, 2022, then log data 2 is stored in the partition corresponding to March 9, 2022.

[0092] Step 302: The electronic device obtains the second log data corresponding to each time period from the first log data of the target device based on multiple time periods.

[0093] In some embodiments, the multiple time periods are time periods of equal duration. For example, time period 1 is from 9:00 AM to 10:00 AM, time period 2 is from 10:00 AM to 11:00 AM, and time period 3 is from 11:00 AM to 12:00 PM. Among them, time period 1, time period 2, and time period 3 are all time periods of 1 hour in length.

[0094] In other embodiments, the multiple time periods are time periods of different durations. For example, time period 1 is from 3:00 AM to 9:00 AM, time period 2 is from 9:00 AM to 10:00 AM, and time period 3 is from 10:00 AM to 11:00 AM. Among them, time period 1 is a time period of 6 hours, and time periods 2 and 3 are time periods of 1 hour each.

[0095] In some embodiments, the plurality of time periods is set by the user. For example, the user inputs a start time and an end time of the first log data, and also inputs a time length of the time period. According to the start time, the end time and the time length input by the user, the plurality of time periods is determined, and the second log data corresponding to each time period is obtained from the first log data of the target device.

[0096] For example, the user inputs a start time of March 1, 2022, 8:00 am, the user inputs an end time of March 1, 2022, 4:00 pm, and the user inputs a time length of the time period of 2 hours. Based on the start time, the end time and the time length input by the user, four time periods can be determined, which are time period 1 from 8:00 am to 10:00 am, time period 2 from 10:00 am to 12:00 noon, time period 3 from 12:00 noon to 2:00 pm, and time period 4 from 2:00 pm to 4:00 pm. And the second log data generated from 8:00 am to 10:00 am, the second log data generated from 10:00 am to 12:00 noon, the second log data generated from 12:00 noon to 2:00 pm, and the second log data generated from 2:00 pm to 4:00 pm are obtained respectively.

[0097] In other embodiments, the plurality of time periods is set by default by the device. For example, the device defaults to analyzing the first log data of the current day, and the time length of the time period is 1 hour by default.

[0098] It should be noted that in some cases, the device is in a state of shutdown, hibernation, etc., and therefore does not generate log data. Therefore, in some embodiments, when obtaining the second log data corresponding to each time period from the first log data, if the second log data corresponding to a certain time period is empty, the time period can be extended until the second log data corresponding to the time period is not empty.

[0099] It should be noted that in the embodiments of the present application, when obtaining the second log data corresponding to each time period from the first log data of the target device based on the plurality of time periods, the plurality of time periods can be determined first, and then the second log data corresponding to each time period can be obtained from the first log data of the target device. Alternatively, a time period can be determined first, and then the second log data corresponding to the time period can be obtained from the first log data of the target device. The next time period is determined, and the second log data corresponding to the next time period is obtained from the first log data of the target device, and so on.

[0100] In some embodiments, the first log data of different dates is stored in different databases. For example, one database is used for the first log data of one day. In some cases, it is necessary to analyze and process the first log data of multiple days, at which time the databases corresponding to the multiple days can be merged. When the databases corresponding to the multiple days are merged, different contents need to be merged one by one. For example, the database corresponding to each day includes the current of application A, the current of application B, the load of CPU, etc., so the current of application A in each database is merged, the current of application B in each database is merged, and the load of CPU in each database is merged. After merging the multiple databases, the second log data corresponding to each time period is obtained from the merged database.

[0101] Step 303: The electronic device determines the first running state parameter of the target device corresponding to each time period based on the second log data corresponding to each time period, and the first running state parameter is used to represent the overall running state of the target device.

[0102] In some embodiments, the first running state parameter can be original information in the second log data. For example, the second log data includes information describing different objects, such as information describing each application program, information describing each hardware module, etc. The electronic device determines the first running state parameter of the target device corresponding to each time period based on the second log data corresponding to each time period, including: obtaining data used to represent the overall running state of the target device from the second log data corresponding to each time period to obtain the first running state parameter. For example, the temperature value of the target device, the power consumption of the target device, the frame loss rate of the target device, etc. are obtained from the second log data.

[0103] In some embodiments, the first running state parameter can also be information obtained by aggregating the second log data. For example, the second log data corresponding to each time period includes the power consumption of multiple target devices, the multiple power consumptions are uploaded within the corresponding time period, and each power consumption is the newly added power consumption since the last report. The total power consumption of the target device within the corresponding time period is obtained by adding the multiple power consumptions, and the total power consumption can be determined as the first running state parameter. For example, the second log data corresponding to each time period includes the current of multiple target devices, and the average value of the multiple currents is determined as the first running state parameter. The embodiments of the present application do not limit the form of the second log data.

[0104] In a possible implementation, the second log data is aggregated based on the first index. Optionally, the first running state parameter is an index value corresponding to a comprehensive index represented by the first index; and the electronic device determines the first running state parameter of the target device corresponding to each time period based on the second log data corresponding to each time period, including: determining, based on the second log data corresponding to each time period and the first index, an index value of the first index corresponding to each time period, the first index being used to represent a comprehensive index of the plurality of application programs; and determining, based on the index value of the first index corresponding to each time period, the first running state parameter of the target device corresponding to each time period.

[0105] For example, the first index is a total power consumption in each time period, an average current in a screen-on state, an average current in a screen-off state, an average temperature in each time period, a maximum temperature in each time period, or the like.

[0106] For example, the first index is a total power consumption in each time period, an average current in a screen-on state, an average current in a screen-off state, an average temperature in each time period, a maximum temperature in each time period, or the like.

[0107] In some embodiments, the electronic device analyzes the abnormality of the application program in different aspects in different cases, and the first index used to analyze the abnormality in different aspects is different. For example, in some cases, the electronic device needs to analyze the abnormality of the application program in power consumption, and in this case, the first index can be an average current in a screen-on state, an average current in a screen-off state, or the like. In some cases, the electronic device needs to analyze the abnormality of the application program in temperature rise, and in this case, the first index can be a temperature value of the CPU. In some cases, the electronic device needs to analyze the abnormality of the application program in performance, and in this case, the first index can be a frame loss rate of the target device, ANR (Application Not Response), or the like.

[0108] In some embodiments, the first index indicates one index. The electronic device determines the first running state parameter of the target device corresponding to each time period based on the index value of the first index corresponding to each time period, including: the electronic device determines the index value of the first index corresponding to each time period as the first running state parameter of the target device corresponding to each time period.

[0109] In some embodiments, the first indicator indicates a plurality of indicators. The electronic device determines, based on the indicator values of the plurality of indicators corresponding to each time period, the first running state parameter of the target device corresponding to each time period, including: the electronic device fuses the indicator values of the plurality of indicators corresponding to each time period to obtain an indicator fusion value corresponding to the time period, and determines the indicator fusion value corresponding to the time period as the first running state parameter corresponding to the time period.

[0110] For example, the plurality of indicators are screen-on current and screen-off current, and the screen-on current value and the screen-off current value corresponding to time period 1 are fused to obtain the first running state parameter corresponding to time period 1.

[0111] Optionally, different indicators have different importance. For example, the plurality of indicators are screen-on current and screen-off current, and the screen-on current is more important for abnormality evaluation, so different weights can be given to the screen-on current value and the screen-off current value, and then the screen-on current value and the screen-off current value are fused.

[0112] For example, the electronic device fuses the indicator values of the plurality of indicators corresponding to each time period to obtain an indicator fusion value corresponding to the time period, including: the electronic device, for each time period, fuses the indicator values of the plurality of indicators corresponding to the time period based on the weight of each first indicator to obtain an indicator fusion value corresponding to the time period.

[0113] It should be noted that the numerical ranges of the indicator values corresponding to different indicators are different, in order to more accurately determine the first running state parameter that can represent the overall state of the target device, the indicator values can be normalized first, and then the normalized indicator values are fused.

[0114] Step 304: The electronic device determines a target time period from the plurality of time periods based on the first running state parameter corresponding to each time period, and the state represented by the first running state parameter corresponding to the target time period is worse than the state represented by the first running state parameters corresponding to other time periods in the plurality of time periods except the target time period.

[0115] In the embodiments of the present application, the target time period can be one time period or a plurality of time periods, which are not limited in the embodiments of the present application.

[0116] In one possible implementation, the electronic device determines a target time period from the plurality of time periods based on the first running state parameter corresponding to each time period, including: determining a target running state parameter representing the worst state from the first running state parameters corresponding to each time period, and determining the time period corresponding to the target running state parameter as the target time period.

[0117] Optionally, the first running state parameters corresponding to each time period are sorted according to the advantages and disadvantages of the represented states. In the case where the first running state parameters are arranged in the order of the represented states from good to bad, the time periods corresponding to the last target number of first running state parameters are determined as the target time periods. In the case where the first running state parameters are arranged in the order of the represented states from bad to good, the time periods corresponding to the first target number of first running state parameters are determined as the target time periods.

[0118] The target number can be 1 or multiple, for example, 2, 3, etc.

[0119] It should be noted that the arrangement order of the first running state parameters can represent the abnormality level of the time period, and the higher the abnormality level, the higher the probability of the application program being abnormal in the time period.

[0120] In another possible implementation, the electronic device determines the target time period from the multiple time periods based on the first running state parameters corresponding to each time period, including: determining, based on a running state parameter threshold, a target running state parameter from the first running state parameters corresponding to each time period, the represented state of which is worse than the represented state of the running state parameter threshold, and determining the time period corresponding to the target running state parameter as the target time period.

[0121] The running state parameter threshold can be regarded as a standard for measuring whether the running state of the target device is abnormal. The running state parameter threshold can be any value, for example, an empirical value, a threshold value set by a technician, or a threshold value set by a user, and the embodiments of the present application do not limit the running state parameter threshold.

[0122] In another possible implementation, the electronic device determines the target time period from the multiple time periods based on the first running state parameters corresponding to each time period, including: determining, based on a running state parameter threshold, a first target running state parameter from the first running state parameters corresponding to each time period, the represented state of which is worse than the represented state of the running state parameter threshold; determining, from the first target running state parameter, a second target running state parameter with the worst represented state, and determining the time period corresponding to the second target running state parameter as the target time period.

[0123] It should be noted that the running state parameter threshold and the first running state parameter can have the same form or not. For example, the first running state parameter includes the power consumption of the corresponding time period and the current fusion value of screen turning on and off, and the running state parameter threshold includes the power consumption threshold and the current fusion value threshold of screen turning on and off.

[0124] For another example, the first running state parameter includes power consumption of the corresponding time period, and a current fusion value of screen turning on and off. The running state parameter threshold is a power consumption threshold. For example, the power consumption threshold is 100 mAh. If the power consumption in the first running state parameter exceeds 100 mAh, the first running state parameter is determined as the first target running state parameter. Then, the first target running state parameter is sorted based on the current fusion value of screen turning on and off in the first target running state parameter, and the second target running state parameter is determined.

[0125] Step 305: The electronic device determines an application program with an exception from the plurality of application programs based on the second log data corresponding to the target time period.

[0126] According to the description of step 304, the target time period can be one or multiple. In the case of multiple target time periods, the electronic device performs step 305 for each target time period.

[0127] In a possible implementation, the second log data includes data describing different objects. The electronic device can determine whether each application program has an exception based on the data describing the application program. Alternatively, the electronic device determines an application program with an exception from the plurality of application programs based on the second log data corresponding to the target time period, including: determining a second running state parameter of each application program based on the second log data corresponding to the target time period, the second running state parameter of the application program being used to indicate a running state of the application program; and determining an application program with an exception from the plurality of application programs based on the second running state parameter of each application program.

[0128] It should be noted that the implementation of step 305 can refer to the embodiments shown in Figure 5 The embodiments of the present application will not be repeated here.

[0129] Step 306: The electronic device obtains third log data corresponding to the application program with an exception from the second log data, the third log data being used to indicate a running state of the plurality of hardware modules when providing a service for the application program with an exception or an influence of the service on the running state of the plurality of hardware modules.

[0130] The third log data is data for describing a plurality of hardware modules in the target device. The hardware modules can include at least one of a CPU, a screen, and a Modem module. The third log data is used to represent a running state of the plurality of hardware modules when the plurality of hardware modules provide services for the abnormal application, and refers to a state of the hardware modules, a state of a thread of the application in the hardware modules, and the like when the abnormal application runs in the foreground. The third log data is used to represent an influence of the services of the plurality of hardware modules on the running state of the hardware modules when the plurality of hardware modules provide the services for the abnormal application. For example, a load proportion of a thread of the abnormal application in the CPU, frequency scheduling distribution, and the like.

[0131] It should be noted that the electronic device includes a plurality of hardware modules. If the electronic device focuses on analyzing the abnormality of the application in any one of power consumption, temperature, performance, and the like, it is usually not necessary to analyze each hardware module, but to determine the third index based on the abnormal type, and to obtain the third log data corresponding to the third index from the second log data based on the third index.

[0132] The third index is used to represent at least one index of at least one hardware module. For example, the third index is used to indicate a traffic type used by the Modem module, a use time length of each type of traffic, a frequency scheduling distribution of the CPU, a load condition of a thread of the abnormal application, a brightness, a frame rate, and a frame loss condition of the screen when displaying the abnormal application, and the like.

[0133] It should be noted that in the embodiments of the present application, only the third log data corresponding to the abnormal application is obtained, and the abnormal reason of the abnormal application is determined based on the third log data. In another embodiment, the third log data corresponding to other applications can also be obtained from the second log data, and the abnormal reason of the abnormal application is determined by referring to the third log data corresponding to the other applications.

[0134] Step 307: The electronic device determines the abnormal reason of the abnormal application based on the third log data.

[0135] In a possible implementation manner, the electronic device determines the abnormal reason of the abnormal application based on the third log data, including: the electronic device determines an abnormal hardware module in the plurality of hardware modules based on the third log data; and determines the abnormal reason of the abnormal hardware module based on fourth log data corresponding to the abnormal hardware module in the third log data, and determines the abnormal reason of the abnormal hardware module as the abnormal reason of the abnormal application.

[0136] Optionally, the electronic device determines the abnormal hardware module in the plurality of hardware modules based on the third log data, including: the electronic device determines an index value corresponding to each third index based on the third index and the third log data; and determines the abnormal hardware module based on the index value corresponding to each third index.

[0137] It should be noted that, in the embodiments of the present application, the step of "determining the hardware module with an anomaly based on the index value corresponding to the third index" is similar to the step of "determining the application program with an anomaly based on the index value corresponding to the second index", which will not be repeated here.

[0138] Optionally, the electronic device determines the anomaly cause of the abnormal hardware module based on the fourth log data corresponding to the abnormal hardware module in the third log data, including: the electronic device determines the anomaly cause of the abnormal hardware module based on the index value related to the abnormal hardware module in the index value corresponding to the third index.

[0139] For example, the abnormal hardware module is a Modem module, and the index value related to the Modem module is shown in Table 1.

[0140] Table 1

[0141]

[0142] From the index value related to the Modem module, it can be known that the power consumption of the Modem module is too high, and most of the power consumption of the Modem module is caused by the use of 5G. Part of the reason is that the signal strength of 5G is weak, resulting in high power consumption, and part of the reason is that the transceiver amount of 5G is high, resulting in high power consumption. Thus, the anomaly cause of the abnormal module is obtained, that is, the signal strength of 5G is weak and the transceiver amount of 5G is high.

[0143] It should be noted that, after processing the log data, the embodiments of the present application can also show the processing result to the user. In one possible implementation, after the electronic device determines the application program with an anomaly in the plurality of application programs based on the second log data corresponding to the target time period, the method further includes: displaying at least one of the following: (1) the first running state parameter corresponding to each time period; (2) the application identifier of the abnormal application program; (3) the second running state parameter of each application program in each time period, the second running state parameter of the application program being used to indicate the running state of the application program; (4) the anomaly cause of the abnormal application program.

[0144] For example, in terms of power consumption analysis, the processing result displayed to the user can be as shown in Figure 4 .

[0145] The log data processing method provided in the embodiments of the present application divides log data of a target device into multiple time periods, performs coarse-grained processing on the log data of each time period, finds a time period in which an abnormality may exist, performs fine-grained processing on the log data in the time period, and determines an application program in which an abnormality exists, without performing fine-grained processing on the log data of each time period, thereby reducing the processing amount of log data processing and improving the processing efficiency of log data.

[0146] In addition, the embodiments of the present application perform merging processing on log data at different times, the merging method uses a database as a carrier, that is, multiple databases are merged for processing, and fast analysis of log data in multiple databases is implemented. When a specific time at which an abnormality occurs needs to be detected, the merging operation can quickly locate the time point, thereby improving the analysis efficiency.

[0147] In addition, the embodiments of the present application support processing of log data in any time range in a database, and a user can select any time period for analysis. If the user knows the time at which an abnormality occurs, the user can directly select the time as the time range for processing, thereby reducing the processing amount of data.

[0148] In addition, the embodiments of the present application can not only determine an abnormal application program, but also determine an abnormal reason of the abnormal application program, so that the user can adjust the target device according to the abnormal reason, thereby avoiding continuous abnormality of the application program.

[0149] Figure 5 is a flowchart of an abnormal application program determination method provided by the embodiments of the present application, executed by an electronic device, referring to Figure 5 The method comprises the following steps.

[0150] In step 501, the electronic device determines a second running state parameter of each application program based on second log data corresponding to a target time period, the second running state parameter of the application program being used to indicate a running state of the application program.

[0151] In some embodiments, the second running state parameter is original data in the second log data. The electronic device determines the second running state parameter of each application program based on the second log data corresponding to the target time period, comprising: the electronic device obtains log data describing the application program from the second log data corresponding to the target time period for each application program, to obtain the second running state parameter of the application program.

[0152] In some embodiments, the second log data includes a plurality of pieces of data describing each application program, and in order to reduce the amount of data processed, the second log data can be processed based on the second index to obtain the second running state parameter of each application program. Optionally, determining the second running state parameter of each application program based on the second log data corresponding to the target time period includes: determining an index value corresponding to the second index of each application program based on the second log data corresponding to the target time period and the second index; and determining the second running state parameter of each application program based on the index value corresponding to the second index of each application program.

[0153] In some embodiments, the second log data includes a plurality of pieces of data describing each application program, and in order to reduce the amount of data processed, the second log data can be processed based on the second index to obtain the second running state parameter of each application program. Optionally, determining the second running state parameter of each application program based on the second log data corresponding to the target time period includes: determining an index value corresponding to the second index of each application program based on the second log data corresponding to the target time period and the second index; and determining the second running state parameter of each application program based on the index value corresponding to the second index of each application program.

[0154] The second index is an index representing the running state of the application program. Optionally, the second index is the power consumption of each application program when the screen is turned on or off, the proportion of the power consumption of each application program, the current value of each application program when the screen is turned on or off, and the like, as shown in Table 2.

[0155] Table 2

[0156]

[0157] In some embodiments, the second log data includes a plurality of pieces of data describing each application program, and in order to reduce the amount of data processed, the second log data can be processed based on the second index to obtain the second running state parameter of each application program. Optionally, determining the second running state parameter of each application program based on the second log data corresponding to the target time period includes: determining an index value corresponding to the second index of each application program based on the second log data corresponding to the target time period and the second index; and determining the second running state parameter of each application program based on the index value corresponding to the second index of each application program.

[0158] Step 502: The electronic device determines an application program that exists abnormally in the plurality of application programs based on the second running state parameter of each application program.

[0159] In a first possible implementation, the second running state parameter of the application program is used to represent a degree of influence of the application program on the running state of the target device. The electronic device determines the application program with an anomaly from the plurality of application programs based on the second running state parameter of each application program, including: determining, based on the second running state parameter of each application program, a target application program with the greatest influence on the running state of the target device from the plurality of application programs as the abnormal application program.

[0160] For example, the second running state parameter of the application program includes a power consumption proportion of the application program. The higher the power consumption proportion of the application program, the stronger the user perceives the influence of the application program on the target device, the higher the severity of the abnormality of the application program, and the higher the possibility that the user perceives that the target device consumes power too quickly. Therefore, the target application program with the greatest influence on the running state of the target device from the plurality of application programs can be determined as the abnormal application program, so as to subsequently process the application program in time and avoid relatively serious consequences caused by the abnormality of the application program.

[0161] Considering that some application programs interact with a background server during use, or need to constantly obtain new multimedia data, and the like, the power consumption proportion of these application programs is relatively high, but this is a normal situation. In order to avoid unnecessary processing of the application program, the present embodiment further provides another method for determining an abnormal application program. In a second possible implementation, the electronic device determines the application program with an anomaly from the plurality of application programs based on the second running state parameter of each application program, including: determining, based on the second running state parameter of each application program and the second running state parameter corresponding to each application program in the plurality of reference devices, the application program with an anomaly from the plurality of application programs.

[0162] The plurality of reference devices are other electronic devices, and the plurality of application programs are installed in the plurality of reference devices. The plurality of application programs installed in the plurality of reference devices can be completely identical or not completely identical. In the present embodiment, for each application program, the plurality of reference devices are referred to, and for each application program, the plurality of reference devices referred to can be the same or different, which is not limited in the present embodiment. For example, the electronic device determines the application program with an anomaly from the plurality of application programs based on the second running state parameter of each application program and the second running state parameter corresponding to each application program in the plurality of reference devices, including: for each application program, determining, based on the second running state parameter of the application program and the second running state parameter corresponding to the application program in the plurality of reference devices, whether the application program is an abnormal application program.

[0163] It should be noted that the step "determining whether the application program is an abnormal application program based on the second running state parameter of the application program and the second running state parameter of the application program corresponding to the plurality of reference devices" is similar to the step "determining the analysis result of the target application program based on the second running state parameter of the target application program and the second running state parameter of the target application program corresponding to the plurality of reference devices", and reference can be made to the explanation of the step "determining the analysis result of the target application program based on the second running state parameter of the target application program and the second running state parameter of the target application program corresponding to the plurality of reference devices". Therefore, the explanation will not be repeated here.

[0164] In view of the large amount of data of the second running state parameters of the plurality of reference devices, the embodiments of the present application further provide another method for determining an abnormal application program. In a third possible implementation manner, the electronic device determines the application program existing abnormality in the plurality of application programs based on the second running state parameter of each application program, comprising: determining the application program corresponding to the second running state parameter representing a state worse than the state represented by the reference running state parameter as an abnormal application program based on the second running state parameter of each application program and the reference running state parameter.

[0165] The reference running state parameter can be an empirical value, a laboratory measured value, a threshold value determined based on big data, and the like, and the embodiments of the present application do not limit the reference running state parameter.

[0166] In view of the fact that some application programs consume relatively small total resources relative to the resources consumed by the application programs on other devices, and the overall impact on the target device is not large, and the user is not easy to perceive, the embodiments of the present application further determine whether the application program is abnormal in combination with the impact of the application program on the target device and the running state of the application program on other devices.

[0167] In a fourth possible implementation manner, the electronic device determines the application program existing abnormality in the plurality of application programs based on the second running state parameter of each application program, comprising: determining a target application program having the greatest impact on the running state of the target device from the plurality of application programs based on the second running state parameter of each application program; and determining an analysis result of the target application program based on the second running state parameter of the target application program and the second running state parameter of the target application program corresponding to the plurality of reference devices, the analysis result being used to represent whether the target application program is an abnormal application program.

[0168] The target application program can be one application program or multiple application programs, and the number of target application programs is not limited in the embodiments of the present application. In the case of multiple target application programs, the electronic device performs the step of determining the analysis result of each target application program based on the second running state parameter corresponding to the target application program and the second running state parameter corresponding to the target application program in the multiple reference devices.

[0169] In some embodiments, the electronic device determines the analysis result of the target application program based on the second running state parameter corresponding to the target application program and the second running state parameter corresponding to the target application program in the multiple reference devices, including any of the following steps:

[0170] (1) determining an average running state parameter based on the second running state parameter corresponding to the target application program in the multiple reference devices, and determining the analysis result based on the average running state parameter and the second running state parameter corresponding to the target application program in the target device.

[0171] For example, in the case where the state represented by the second running state parameter of the application program of the target device is worse than the state represented by the average running state parameter, the application program is determined to be an abnormal application program; in the case where the state represented by the second running state parameter of the application program of the target device is better than the state represented by the average running state parameter, the application program is determined to be not an abnormal application program.

[0172] (2) sorting the second running state parameters corresponding to the target application program in the multiple reference devices, determining the second running state parameter located at a target arrangement position as a reference running state parameter, and determining the analysis result based on the reference running state parameter and the second running state parameter corresponding to the target application program in the target device.

[0173] The target arrangement position can be any arrangement position, for example, the 20th position, the 30th position, the 80th position, etc.

[0174] In the case where the state represented by the second running state parameter of the application program of the target device is worse than the state represented by the reference running state parameter, the application program is determined to be an abnormal application program; in the case where the state represented by the second running state parameter of the application program of the target device is better than the state represented by the reference running state parameter, the application program is determined to be not an abnormal application program.

[0175] (3) sorting the second running state parameters corresponding to the target application program in the multiple reference devices and the second running state parameter corresponding to the target application program in the target device, and determining the analysis result based on the arrangement position of the second running state parameter corresponding to the target application program in the target device.

[0176] In the case that the second running state parameters are arranged in the order from the poor state to the good state, if the second running state parameter corresponding to the target application program in the target device is before the target arrangement position (for example, in the first 20%), it is determined that the target application program is an abnormal application program, and if the second running state parameter corresponding to the target application program in the target device is after the target arrangement position, it is determined that the target application program is not an abnormal application program.

[0177] In the case that the second running state parameters are arranged in the order from the poor state to the good state, if the second running state parameter corresponding to the target application program in the target device is before the target arrangement position (for example, in the first 20%), it is determined that the target application program is an abnormal application program, and if the second running state parameter corresponding to the target application program in the target device is after the target arrangement position, it is determined that the target application program is not an abnormal application program.

[0178] The abnormal application program determination method provided by the embodiments of the present application can determine the application program that has a greater impact on the overall running state of the target device, so that the user can know which application program has an impact on the poor overall running state of the target device, and the user is prompted how to handle the application program to improve the overall running state of the target device.

[0179] In addition, the embodiments of the present application only analyze the application program that has a greater impact on the overall running state of the target device, and in the case that the overall running state of the target device is good, the processing amount of the log data is reduced, and the processing efficiency is improved.

[0180] Figure 6 is a structural schematic diagram of a log data processing apparatus provided by the embodiments of the present application, referring to Figure 6 The apparatus comprises:

[0181] The first obtaining module 601 is configured to obtain, based on a plurality of time periods, second log data corresponding to each time period from first log data of a target device, the first log data being used to record running states of a plurality of application programs installed on the target device; the first determining module 602 is configured to determine, based on the second log data corresponding to each time period, a first running state parameter corresponding to each time period of the target device, the first running state parameter being used to represent an overall running state of the target device; the second determining module 603 is configured to determine, based on the first running state parameter corresponding to each time period, a target time period from the plurality of time periods, the state represented by the first running state parameter corresponding to the target time period being worse than the state represented by the first running state parameter corresponding to other time periods except the target time period in the plurality of time periods; and the third determining module 604 is configured to determine, based on the second log data corresponding to the target time period, an abnormal application program existing in the plurality of application programs.

[0182] As shown in Figure 7 In a possible implementation, the third determining module 604 includes: a state determining unit 6041, configured to determine a second running state parameter of each application based on the second log data corresponding to the target time period, the second running state parameter of the application being used to indicate a running state of the application; and an abnormal application determining unit 6042, configured to determine an abnormal application in the plurality of applications based on the second running state parameter of each application.

[0183] In another possible implementation, the second running state parameter of the application is used to indicate a degree of influence of the application on the running state of the target device; and the abnormal application determining unit 6042 is configured to determine, based on the second running state parameter of each application, a target application that has the greatest influence on the running state of the target device as the abnormal application in the plurality of applications.

[0184] In another possible implementation, the abnormal application determining unit 6042 is configured to determine, based on the second running state parameter of each application and the second running state parameter of each application corresponding to each of the plurality of reference devices, the abnormal application in the plurality of applications.

[0185] In another possible implementation, the abnormal application determining unit 6042 is configured to determine, based on the second running state parameter of each application, a target application that has the greatest influence on the running state of the target device from the plurality of applications; and determine, based on the second running state parameter of the target application and the second running state parameter of the target application corresponding to each of the plurality of reference devices, an analysis result of the target application, the analysis result being used to indicate whether the target application is the abnormal application.

[0186] In another possible implementation, the abnormal application determining unit 6042 is configured to perform at least one of the following:

[0187] determine an average running state parameter based on the second running state parameter of the target application corresponding to each of the plurality of reference devices; and determine the analysis result based on the average running state parameter and the second running state parameter of the target application in the target device;

[0188] sort the second running state parameters of the target application corresponding to each of the plurality of reference devices, determine a reference running state parameter located at a target arrangement position, and determine the analysis result based on the reference running state parameter and the second running state parameter of the target application in the target device;

[0189] The second running state parameters corresponding to the target application programs in the plurality of reference devices and the second running state parameter corresponding to the target application program in the target device are sorted; and the analysis result is determined based on the ranking position of the second running state parameter corresponding to the target application program in the target device.

[0190] In another possible implementation, the first log data is further used to record running states of a plurality of hardware modules in the target device; and the apparatus further includes: a second acquisition module 605, configured to acquire, after the abnormal application program is determined, third log data corresponding to the abnormal application program from the second log data, the third log data being used to represent running states of the plurality of hardware modules when the plurality of hardware modules provide services for the abnormal application program or influences of the services on the running states of the plurality of hardware modules; and a fourth determination module 606, configured to determine an abnormal cause of the abnormal application program based on the third log data.

[0191] In another possible implementation, the fourth determination module 606 includes: an abnormal hardware determination unit 6061, configured to determine an abnormal cause of an abnormal hardware module based on fourth log data corresponding to the abnormal hardware module in the third log data; and an abnormal cause determination unit 6062, configured to determine the abnormal cause as the abnormal cause of the abnormal application program.

[0192] In another possible implementation, the first running state parameter is an index value corresponding to a comprehensive index represented by a first index; the first determination module 602 is configured to determine, based on the second log data corresponding to each time period and the first index, an index value of the first index corresponding to each time period, the first index being used to represent a comprehensive index of the plurality of application programs; and determine the first running state parameter corresponding to each time period of the target device based on the index value of the first index corresponding to each time period.

[0193] In another possible implementation, the second determination module 603 is configured to perform at least one of the following:

[0194] determine, from the first running state parameters corresponding to each time period, a target running state parameter representing the worst state, and determine a target time period corresponding to the target running state parameter as the target time period;

[0195] determine, based on a running state parameter threshold, from the first running state parameters corresponding to each time period, a target running state parameter representing a state worse than a state represented by the running state parameter threshold, and determine a target time period corresponding to the target running state parameter as the target time period.

[0196] In another possible implementation, the apparatus further includes a display module 607 configured to display at least one of the following: the first running state parameter corresponding to each time period; the application identifier of the abnormal application; and the second running state parameter of each application corresponding to each time period, the second running state parameter of the application being used to indicate a running state of the application; and the abnormal reason of the abnormal application.

[0197] The embodiments of the present application provide a log data processing apparatus, which divides log data of a target device into a plurality of time periods, performs coarse-grained processing on the log data of each time period, finds a time period in which an abnormality may exist, performs fine-grained processing on the log data in the time period, and determines an abnormal application in a plurality of applications, without performing fine-grained processing on the log data of each time period, thereby reducing the processing amount of log data processing and improving the processing efficiency of log data.

[0198] If the electronic device is provided as a terminal, refer to Figure 8 FIG. 8 shows a structural block diagram of a terminal 800 according to an example embodiment of the present application. The terminal 800 can be a smart phone, a tablet computer, or the like, which has a function of controlling other devices. The terminal 800 in the present application can include one or more of the following components: a processor 810, a memory 820.

[0199] The processor 810 can include one or more processing cores. The processor 810 connects various parts within the terminal 800 with various interfaces and lines, performs various functions of the terminal 800 and processes data by running or executing program codes, programs, code sets, or program code sets stored in the memory 820, and calling data stored in the memory 820. Alternatively, the processor 810 can be implemented in at least one of a hardware form of a digital signal processing (DSP), a field-programmable gate array (FPGA), a programmable logic array (PLA). The processor 810 can integrate a combination of one or several of a central processing unit (CPU), a graphics processing unit (GPU), a neural-network processing unit (NPU), and a modem. Among them, the CPU mainly processes an operating system, a user interface, and an application program, etc.; the GPU is responsible for rendering and drawing of content to be displayed on a display screen; the NPU is used to implement an artificial intelligence (AI) function; and the modem is used to process wireless communication. It can be understood that the above-mentioned modem can also not be integrated into the processor 810, but be implemented by a separate chip.

[0200] The memory 820 can include a random access memory (RAM) and can also include a read-only memory (ROM). Alternatively, the memory 820 includes a non-transitory computer-readable storage medium. The memory 820 can be used to store program codes, programs, codes, code sets, or program code sets. The memory 820 can include a program storage area and a data storage area, wherein the program storage area can store program codes for implementing an operating system, program codes for at least one function (such as a touch function, a sound playing function, an image playing function, etc.), program codes for implementing various method embodiments described above, etc.; and the data storage area can store data (such as audio data, a phone book) created according to the use of the terminal 800, etc.

[0201] In addition, those skilled in the art can understand that the structure of the terminal 800 shown in the above-mentioned drawings does not constitute a limitation on the terminal 800, and the terminal 800 can include more or fewer components than those shown in the drawings, or combine certain components, or different component arrangements. For example, the terminal 800 also includes components such as a microphone, a speaker, a radio frequency circuit, an input unit, a sensor, an audio circuit, a wireless fidelity (Wi-Fi) module, a power supply, a Bluetooth module, and the like, which are not described here.

[0202] If the electronic device is provided as a server, see Figure 9 , Figure 9 is a structural schematic diagram of a server provided by an embodiment of the present application. The server 900 can have great differences due to different configurations or performances, and can include a central processing unit (CPU) 901 and a memory 902, wherein the memory 902 stores at least one program code, the at least one program code is loaded and executed by the processor 901 to realize the method provided by each method embodiment described above. Of course, the server 900 can also have a wired or wireless network interface, a keyboard, and an input and output interface, and the like, so as to perform input and output. The server 900 can also include other components for realizing the functions of the device, which are not described here.

[0203] In an exemplary embodiment, a computer readable medium is also provided, which stores at least one program code, the at least one program code is loaded and executed by a processor to realize the log data processing method in the above-mentioned embodiments.

[0204] In an exemplary embodiment, a computer program product is also provided, which stores at least one program code, the at least one program code is loaded and executed by a processor to realize the log data processing method in the above-mentioned embodiments.

[0205] In some embodiments, the computer program related to the embodiments of the present application can be deployed on a computer device for execution, or on multiple computer devices located in one place, or on multiple computer devices distributed in multiple places and interconnected through a communication network. The multiple computer devices distributed in multiple places and interconnected through a communication network can constitute a blockchain system.

[0206] Those of ordinary skill in the art can understand that all or part of the steps of the above-mentioned embodiments can be completed by hardware, or by a program instructing related hardware, which can be stored in a computer readable storage medium. The storage medium mentioned above can be a read-only memory, a magnetic disk or an optical disk, etc.

[0207] The above merely aims to facilitate the understanding of the technical solutions of the present application by those skilled in the art, and is not used to limit the present application. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present application shall be included in the protection scope of the present application.

Claims

1. A log data processing method characterized by comprising: The method comprises: obtaining, based on a plurality of time periods, second log data corresponding to each time period from first log data of a target device, the first log data being used to record running states of a plurality of application programs installed on the target device; determining, based on the second log data corresponding to each time period, a first running state parameter corresponding to each time period of the target device, the first running state parameter being used to represent an overall running state of the target device; determining, based on the first running state parameter corresponding to each time period, a target time period from the plurality of time periods, the first running state parameter corresponding to the target time period representing a state worse than the first running state parameters corresponding to other time periods of the plurality of time periods; determining, based on the second log data corresponding to the target time period, an application program existing abnormally in the plurality of application programs.

2. The method of claim 1, wherein, The determining, based on the second log data corresponding to the target time period, an application program existing abnormally in the plurality of application programs comprises: determining, based on the second log data corresponding to the target time period, a second running state parameter of each application program, the second running state parameter of the application program being used to represent a running state of the application program; determining, based on the second running state parameter of each application program, the application program existing abnormally in the plurality of application programs.

3. The method of claim 2, wherein, The second running state parameter of the application program is used to represent an influence degree of the application program on the running state of the target device. The determining, based on the second running state parameter of each application program, the application program existing abnormally in the plurality of application programs comprises: determining, based on the second running state parameter of each application program, a target application program having the greatest influence on the running state of the target device from the plurality of application programs as the abnormal application program.

4. The method of claim 2, wherein, The determining, based on the second running state parameter of each application program, the application program existing abnormally in the plurality of application programs comprises: determining, based on the second running state parameter of each application program and a second running state parameter corresponding to each application program in a plurality of reference devices, the application program existing abnormally in the plurality of application programs.

5. The method of claim 2, wherein, The determining, based on the second running state parameter of each application program, the application program existing abnormally in the plurality of application programs comprises: determining, based on the second running state parameter of each application program, a target application program having the greatest influence on the running state of the target device from the plurality of application programs; determining, based on the second running state parameter corresponding to the target application program and a second running state parameter corresponding to the target application program in a plurality of reference devices, an analysis result of the target application program, the analysis result being used to represent whether the target application program is an abnormal application program.

6. The method of claim 5, wherein, The determining, based on the second running state parameter corresponding to the target application program and the second running state parameter corresponding to the target application program in a plurality of reference devices, the analysis result of the target application program comprises any one of: determining an average running state parameter based on the second running state parameter corresponding to the target application program in the plurality of reference devices; determining the analysis result based on the average running state parameter and the second running state parameter corresponding to the target application program in the target device; sorting the second running state parameter corresponding to the target application program in the plurality of reference devices, and determining the reference running state parameter as the second running state parameter at the target ranking position; determining the analysis result based on the reference running state parameter and the second running state parameter corresponding to the target application program in the target device; sorting the second running state parameter corresponding to the target application program in the plurality of reference devices and the second running state parameter corresponding to the target application program in the target device; determining the analysis result based on the ranking position of the second running state parameter corresponding to the target application program in the target device.

7. The method of claim 1, wherein, The first log data is also used to record the running state of a plurality of hardware modules in the target device; and the method further comprises: After determining the abnormal application program, obtaining third log data corresponding to the abnormal application program from the second log data, the third log data being used to represent the running state of the plurality of hardware modules when providing services for the abnormal application program or the influence of the services on the running state of the plurality of hardware modules; determining the abnormal reason of the abnormal application program based on the third log data.

8. The method of claim 7, wherein, The determining of the abnormal reason of the abnormal application program based on the third log data comprises: determining an abnormal hardware module in the plurality of hardware modules based on the third log data; determining the abnormal reason of the abnormal hardware module based on fourth log data corresponding to the abnormal hardware module in the third log data; determining the abnormal reason of the abnormal application program as the abnormal reason of the abnormal hardware module.

9. The method of claim 1, wherein, The first running state parameter is an index value corresponding to a comprehensive index represented by a first index; and the determining of the first running state parameter corresponding to each time period of the target device based on the second log data corresponding to each time period comprises: determining an index value of the first index corresponding to each time period based on the second log data corresponding to each time period and the first index, the first index being used to represent a comprehensive index of the plurality of application programs; determining the first running state parameter corresponding to each time period of the target device based on the index value of the first index corresponding to each time period.

10. The method of claim 1, wherein, The determining of the target time period from the plurality of time periods based on the first running state parameter corresponding to each time period comprises any one of the following: determining a target running state parameter representing the worst state from the first running state parameter corresponding to each time period, and determining the target time period as the time period corresponding to the target running state parameter; Based on the running state parameter threshold, a target running state parameter indicating a state worse than a state indicated by the running state parameter threshold is determined from the first running state parameter corresponding to each time period, and a time period corresponding to the target running state parameter is determined as a target time period.

11. The method of claim 1, wherein, After the application program with an abnormality is determined based on the second log data corresponding to the target time period, the method further includes: displaying at least one of the following: the first running state parameter corresponding to each time period; an application identifier of the abnormal application program; a second running state parameter of each application program corresponding to each time period, the second running state parameter of the application program being used to indicate a running state of the application program; and an abnormal reason of the abnormal application program.

12. A log data processing apparatus characterized by comprising: The apparatus includes: a first obtaining module configured to obtain, based on a plurality of time periods, second log data corresponding to each time period from first log data of a target device, the first log data being used to record running states of a plurality of application programs installed on the target device; a first determining module configured to determine, based on the second log data corresponding to each time period, a first running state parameter corresponding to each time period of the target device, the first running state parameter being used to indicate an overall running state of the target device; a second determining module configured to determine, based on the first running state parameter corresponding to each time period, a target time period from the plurality of time periods, a first running state parameter corresponding to the target time period indicating a state worse than a state indicated by a first running state parameter corresponding to a time period other than the target time period from the plurality of time periods; a third determining module configured to determine, based on the second log data corresponding to the target time period, an application program with an abnormality from the plurality of application programs.

13. An electronic device, comprising: The electronic device includes a processor and a memory, and the memory stores at least one program code, which is loaded and executed by the processor to implement the log data processing method according to any one of claims 1 to 11.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores at least one program code, which is loaded and executed by the processor to implement the log data processing method according to any one of claims 1 to 11.

15. A computer program product, characterised in that, The computer program product stores at least one program code, which is loaded and executed by the processor to implement the log data processing method according to any one of claims 1 to 11.

Images