Host system log processing method, device, equipment and medium

Abstract

The present disclosure provides a host system log processing method, which can be applied to the fields of computer and Internet of Things technology. The host system log processing method includes: parsing a first log message from the host system to obtain attribute information of the first log message; adding an attribute identifier corresponding to the attribute information to the first log message according to the attribute information to obtain a second log message with the attribute identifier; and generating a first message statistical image corresponding to the attribute identifier in a first interactive page according to the second log message, wherein the first message statistical image represents the statistical characteristics of the second log message with the same attribute identifier within a first historical period. The present disclosure also provides a host system log processing device, equipment, storage medium and program product.

Description

Technical Field

[0001] The present disclosure relates to the fields of computers and the Internet of Things, and in particular to a host system log processing method, device, equipment, medium and program product. Background Art

[0002] Mainframe computers are usually used to process large amounts of data. Unlike ordinary computers, mainframe computers can run multiple operating systems at the same time and have reliability, security, backward compatibility, and efficient data I / O processing performance. Since mainframe computers need to process large amounts of data during operation, they will generate a large amount of system logs. System operation and maintenance personnel complete related system operation and maintenance work by viewing system logs.

[0003] In the process of implementing the inventive concept of the present disclosure, the inventors found that due to the large number of system logs, it is difficult for operation and maintenance personnel to effectively analyze log messages in the face of large-scale system logs, causing great trouble to system operation and maintenance work. Summary of the invention

[0004] In view of the above problems, the present disclosure provides a host system log processing method, apparatus, device, medium and program product.

[0005] According to a first aspect of the present disclosure, a host system log processing method is provided, comprising:

[0006] Parsing a first log message from the host system to obtain attribute information of the first log message;

[0007] According to the attribute information, adding an attribute identifier corresponding to the attribute information to the first log message to obtain a second log message having the attribute identifier; and

[0008] According to the second log message, a first message statistical image corresponding to the attribute identifier is generated in the first interactive page, wherein the first message statistical image represents the statistical characteristics of the second log messages having the same attribute identifier within the first historical period.

[0009] According to an embodiment of the present disclosure, the host system log processing method further includes:

[0010] In response to a query operation on the statistical sub-image of the above-mentioned first message statistical image, a second message statistical image is generated in the second interactive page, wherein the above-mentioned second message statistical image represents the statistical characteristics of the above-mentioned second log message within a second historical time period, and the above-mentioned first historical time period includes at least one of the above-mentioned second historical time periods.

[0011] According to an embodiment of the present disclosure, generating a first message statistical image corresponding to the attribute identifier in the first interactive page according to the second log message includes:

[0012] According to the attribute identifier of the second log message, construct a log message set corresponding to the attribute identifier, wherein the log message set includes at least one of the second log messages;

[0013] According to the log message set and the attribute identifier, a first message statistical image corresponding to the attribute identifier is generated in the first interactive page.

[0014] According to an embodiment of the present disclosure, parsing a first log message from a host system to obtain attribute information of the first log message includes:

[0015] Parsing a first log message from the host system to obtain message header data of the first log message;

[0016] Based on the target attribute information in the target attribute information table and the target matching result of the message header data, the attribute information of the first log message is obtained.

[0017] According to an embodiment of the present disclosure, the host system log processing method further includes:

[0018] Displaying, on the third interactive page, an operation object for comparing the second log message within two different preset time periods, wherein the two different preset time periods include a reference historical time period and a comparison historical time period;

[0019] In response to the query operation on the operation object, a reference second log message set within the reference historical time period and a comparison second log message set within the comparison historical time period are obtained;

[0020] Matching the comparison second log message set with the reference second log message set, and determining a reference second log message from the comparison second log message set, wherein the reference second log message is a second log message in the comparison second log message set that matches a second log message in the reference second log message set;

[0021] Deleting the reference second log message in the compared second log message set to obtain the target second log message; and

[0022] Add the above target second log message to the target log message pool.

[0023] According to an embodiment of the present disclosure, the above-mentioned attribute information includes subsystem attribute information and log message type information, and the above-mentioned attribute identifier includes a subsystem identifier and a log message type identifier.

[0024] According to an embodiment of the present disclosure, the host system log processing method further includes:

[0025] According to a preset time rule, the first log message is downloaded from the host system.

[0026] A second aspect of the present disclosure provides a host system log processing device, comprising:

[0027] A parsing module, used for parsing a first log message from a host system to obtain attribute information of the first log message;

[0028] an identification adding module, configured to add an attribute identification corresponding to the attribute information to the first log message according to the attribute information, so as to obtain a second log message having the attribute identification; and

[0029] A generation module is used to generate a first message statistical image corresponding to the above-mentioned attribute identifier in a first interactive page based on the above-mentioned second log message, wherein the above-mentioned first message statistical image represents the statistical characteristics of the second log message with the same above-mentioned attribute identifier within a first historical period.

[0030] A third aspect of the present disclosure provides an electronic device, comprising: one or more processors; and a memory for storing one or more programs, wherein when the one or more programs are executed by the one or more processors, the one or more processors execute the above-mentioned host system log processing method.

[0031] A fourth aspect of the present disclosure further provides a computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the above-mentioned host system log processing method.

[0032] The fifth aspect of the present disclosure further provides a computer program product, including a computer program, which implements the above-mentioned host system log processing method when executed by a processor. BRIEF DESCRIPTION OF THE DRAWINGS

[0033] The above contents and other objects, features and advantages of the present disclosure will become more apparent through the following description of the embodiments of the present disclosure with reference to the accompanying drawings, in which:

[0034] Figure 1 The following schematically shows an application scenario diagram of a host system log processing method and device according to an embodiment of the present disclosure;

[0035] Figure 2 The flowchart of the host system log processing method according to the embodiment of the present disclosure is schematically shown;

[0036] Figure 3 A flowchart schematically illustrates parsing a first log message from a host system to obtain attribute information of the first log message according to an embodiment of the present disclosure;

[0037] Figure 4 A flowchart of generating a first message statistical image corresponding to an attribute identifier in a first interactive page according to a second log message according to an embodiment of the present disclosure is schematically shown;

[0038] Figure 5 The following schematically shows an application scenario diagram of the host system log processing method according to an embodiment of the present disclosure;

[0039] Figure 6 A flowchart of a host system log processing method according to another embodiment of the present disclosure is schematically shown;

[0040] Figure 7 A diagram schematically shows an application scenario of a host system log processing method according to another embodiment of the present disclosure;

[0041] Figure 8 A structural block diagram of a host system log processing device according to an embodiment of the present disclosure is schematically shown; and

[0042] Fig. 9 A block diagram of an electronic device suitable for implementing a host system log processing method according to an embodiment of the present disclosure is schematically shown. DETAILED DESCRIPTION

[0043] Hereinafter, embodiments of the present disclosure will be described with reference to the accompanying drawings. However, it should be understood that these descriptions are exemplary only and are not intended to limit the scope of the present disclosure. In the following detailed description, for ease of explanation, many specific details are set forth to provide a comprehensive understanding of the embodiments of the present disclosure. However, it is apparent that one or more embodiments may also be implemented without these specific details. In addition, in the following description, descriptions of known structures and technologies are omitted to avoid unnecessary confusion of the concepts of the present disclosure.

[0044] The terms used herein are only for describing specific embodiments and are not intended to limit the present disclosure. The terms "comprise", "include", etc. used herein indicate the existence of the features, steps, operations and / or components, but do not exclude the existence or addition of one or more other features, steps, operations or components.

[0045] All terms (including technical and scientific terms) used herein have the meanings commonly understood by those skilled in the art, unless otherwise defined. It should be noted that the terms used herein should be interpreted as having a meaning consistent with the context of this specification, and should not be interpreted in an idealized or overly rigid manner.

[0046] When using expressions such as "at least one of A, B, and C, etc.", they should generally be interpreted according to the meaning of the expression commonly understood by those skilled in the art (for example, "a system having at least one of A, B, and C" should include but is not limited to a system having A alone, B alone, C alone, A and B, A and C, B and C, and / or A, B, C, etc.).

[0047] With the rapid development of Internet technology, more and more companies are using mainframe computers as the main management system for operational activities such as data processing and background program management. During the operation of the mainframe system, a large number of system log messages will be generated every day, and the relevant operation and maintenance personnel will perform relevant maintenance work on the host system based on the log messages. However, the log messages generated by the host system are usually stored in the host system, and the number is huge. It is difficult for the operation and maintenance personnel to find important log messages such as alarm messages and error messages in time by checking the log messages, resulting in the inability to find problems generated by the host system during operation in time, which causes great trouble for the operation and maintenance personnel in the daily maintenance work of the host system.

[0048] An embodiment of the present disclosure provides a host system log processing method, including:

[0049] Parse a first log message from a host system to obtain attribute information of the first log message; add an attribute identifier corresponding to the attribute information to the first log message based on the attribute information to obtain a second log message with the attribute identifier; and generate a first message statistical image corresponding to the attribute identifier in a first interactive page based on the second log message, wherein the first message statistical image represents statistical features of second log messages with the same attribute identifier within a first historical period of time.

[0050] According to an embodiment of the present disclosure, attribute information is obtained by parsing a first log message from a host system, and a corresponding attribute identifier is added to the first log message according to the attribute information to obtain a second log message with an attribute identifier, which can solve the problem in the related art that log messages of the host system are difficult to classify; at the same time, according to the attribute identifier of the second log message, statistical features of the second log message with the same attribute identifier are counted, and a first message statistical image representing the statistical features is displayed in a first interactive page, which can further classify the logs generated by the host system, and clearly and intuitively display the statistical features such as the number and proportion of the second log messages corresponding to the attribute identifier to the operation and maintenance personnel, so as to help the operation and maintenance personnel to promptly discover log events in the host system according to the first message statistical image, and promptly discover problems with the host system by analyzing the statistical features of the second log message, so as to improve the efficiency of the operation and maintenance personnel in solving host system problems.

[0051] In the technical solution of the present disclosure, the collection, storage, use, processing, transmission, provision, disclosure and application of user personal information involved comply with the provisions of relevant laws and regulations, take necessary confidentiality measures, and do not violate public order and good morals.

[0052] In the technical solution of the present disclosure, the user's authorization or consent is obtained before obtaining or collecting the user's personal information.

[0053] Figure 1 The application scenario diagram of the host system log processing method and device according to the embodiments of the present disclosure is schematically shown.

[0054] like Figure 1 As shown, the application scenario 100 according to this embodiment may include terminal devices 101, 102, 103, a network 104, a server 105, and a mainframe 106. The network 104 is used to provide a medium for a communication link between the terminal devices 101, 102, 103 and the server 105. The network 104 may include various connection types, such as wired, wireless communication links or optical fiber cables, etc. The mainframe 106 may include a computer used to process large-capacity data.

[0055] Users can use terminal devices 101, 102, 103 to interact with server 105 through network 104 to receive or send messages, etc. Various communication client applications can be installed on terminal devices 101, 102, 103, such as shopping applications, web browser applications, search applications, instant messaging tools, email clients, social platform software, etc. (only examples).

[0056] The terminal devices 101 , 102 , and 103 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smart phones, tablet computers, laptop computers, and desktop computers.

[0057] The server 105 may be a server that provides various services, such as a background management server (only as an example) that supports websites browsed by users using the terminal devices 101, 102, and 103. The background management server may analyze and process the received data such as user requests, and feed back the processing results (such as web pages, information, or data obtained or generated according to user requests) to the terminal device. The server 105 may obtain the first log message from the mainframe 106.

[0058] It should be noted that the host system log processing method provided in the embodiment of the present disclosure can generally be executed by the server 105. Accordingly, the host system log processing device provided in the embodiment of the present disclosure can generally be set in the server 105. The host system log processing method provided in the embodiment of the present disclosure can also be executed by a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105. Accordingly, the host system log processing device provided in the embodiment of the present disclosure can also be set in a server or server cluster that is different from the server 105 and can communicate with the terminal devices 101, 102, 103 and / or the server 105.

[0059] It should be understood that Figure 1 The number of terminal devices, networks, servers and mainframes in the embodiment is only for illustration. Any number of terminal devices, networks, servers and mainframes may be provided as required.

[0060] The following will be based on Figure 1 The scene described by Figure 2 to Figure 7 The host system log processing method of the disclosed embodiment is described in detail.

[0061] Figure 2 The flowchart of the host system log processing method according to an embodiment of the present disclosure is schematically shown.

[0062] like Figure 2 As shown, the host system log processing method of this embodiment may include operations S210 to S230.

[0063] In operation S210, a first log message from a host system is parsed to obtain attribute information of the first log message.

[0064] According to an embodiment of the present disclosure, the host system may include a mainframe computer, which may include multiple subsystems (i.e., program running environments) for large-scale data processing. The first log message may include time recording information of operation information and running status of each subsystem of the host system during operation, and the log message may include a subsystem name, a generation time, a log identifier, a message header, and log message content.

[0065] According to an embodiment of the present disclosure, the attribute information of the first log message may include the subsystem generating the log message, the log message type, etc. The log message type may include, for example, the log message type INFO, ERROR, WARNING, etc.

[0066] It should be noted that the attribute information of the first log message may be recorded in a field of a message header, or may also be recorded in the log message content of the first log message. The attribute information of the first log message may be obtained by parsing the first log message.

[0067] In operation S220, an attribute identifier corresponding to the attribute information is added to the first log message according to the attribute information to obtain a second log message having the attribute identifier.

[0068] In operation S230, a first message statistical image corresponding to the attribute identifier is generated in the first interactive page according to the second log message, wherein the first message statistical image represents statistical features of the second log messages having the same attribute identifier within the first historical period.

[0069] According to an embodiment of the present disclosure, the second log message may include a log message with an attribute identifier, so that the second log message can be classified and counted using the attribute identifier to obtain the statistical number of second log messages with the same attribute identifier and a log message set consisting of second log messages with the attribute identifier. The first message statistical image may include an image that intuitively reflects the statistical number of second log messages with the same attribute identifier, such as a bar chart, a line chart, a pie chart, etc.

[0070] According to an embodiment of the present disclosure, the statistical feature may include a statistical quantity, but is not limited thereto, and may also include a statistical quantity ratio, etc.

[0071] It should be noted that the first message statistical image can represent the statistical characteristics of the second log message of any first historical duration. Technical personnel in this field can set the specific time period of the first historical duration according to actual needs. For example, the historical time period can be set to January 1, 202x to January 2, 202x.

[0072] According to the embodiments of the present disclosure, since the first log messages generated by the host system do not classify the first log messages according to the subsystems or log message types to which they belong, and there is no specific identifier that can clearly distinguish the first log messages, the operation and maintenance personnel need to read the fields used for classification from the first log messages to perform subsequent analysis on the first log messages. This increases the workload of the operation and maintenance personnel and reduces the efficiency of the operation and maintenance work.

[0073] According to an embodiment of the present disclosure, attribute information is obtained by parsing a first log message from a host system, and a corresponding attribute identifier is added to the first log message according to the attribute information to obtain a second log message with an attribute identifier, which can solve the problem in the related art that log messages of the host system are difficult to classify; at the same time, according to the attribute identifier of the second log message, statistical features of the second log message with the same attribute identifier are counted, and a first message statistical image representing the statistical features is displayed in a first interactive page, which can further classify the logs generated by the host system, and clearly and intuitively display the statistical features such as the number and proportion of the second log messages corresponding to the attribute identifier to the operation and maintenance personnel, so as to help the operation and maintenance personnel to promptly discover log events in the host system according to the first message statistical image, and promptly discover problems with the host system by analyzing the statistical features of the second log message, so as to improve the efficiency of the operation and maintenance personnel in solving host system problems.

[0074] According to an embodiment of the present disclosure, the host system log processing method may further include the following operations.

[0075] According to the preset time rule, the first log message is downloaded from the host system.

[0076] According to an embodiment of the present disclosure, the preset time rule may include a preset time interval, such as an interval of 1 second, 1 minute, etc. Those skilled in the art may set specific preset time rules according to actual needs to ensure timely query of log messages of the host system.

[0077] According to an embodiment of the present disclosure, by downloading the first log message from the host system, relevant operation and maintenance personnel can view the log message of the host system from other background servers, so as to save the operation steps of viewing the first log message after logging into the host system in the related technology, simplify the operation process of querying the log message, and reduce the impact on the operation of the host system during the query of the log message.

[0078] According to an embodiment of the present disclosure, the attribute information includes subsystem attribute information and log message type information, and the attribute identifier includes a subsystem identifier and a log message type identifier.

[0079] According to the embodiments of the present disclosure, since the host system may include multiple subsystems, such as a database subsystem, etc., the operation and maintenance personnel can quickly analyze the operation of each subsystem by determining the subsystem name generated by the log message, and then formulate an operation and maintenance plan to quickly solve the operation problem of the host system.

[0080] According to an embodiment of the present disclosure, the log message type may include the type that characterizes the recorded event, such as an error type (ERROR), an alarm type (WARNING), a normal type (INFO), etc., but is not limited to this, and may also include a attention type (NOTICE), etc. Technical personnel in this field can design the log message type according to actual needs.

[0081] It should be understood that the log type identifier may include an error type identifier, an alarm type identifier, a common type identifier, etc. Those skilled in the art may specifically set the log message type identifier according to actual needs.

[0082] According to the embodiments of the present disclosure, the same second log message can have both a subsystem identifier and a log message type identifier, and then the log message set corresponding to the subsystem identifier can be obtained by counting the number of second log messages with the same subsystem identifier, and the proportion of second log messages of each log message type in the subsystem can be obtained according to the log message type identifier of the second log message in the log message set. This is conducive to the operation and maintenance personnel to query the log message according to the subsystem of the host system, and is helpful for the subsequent intuitive display of the statistical features of the second log message.

[0083] Figure 3 The flowchart of parsing a first log message from a host system to obtain attribute information of the first log message according to an embodiment of the present disclosure is schematically shown.

[0084] like Figure 3 As shown, operation S210, parsing a first log message from a host system, and obtaining attribute information of the first log message may include operations S310 to S320.

[0085] In operation S310 , a first log message from a host system is parsed to obtain message header data of the first log message.

[0086] In operation S320, attribute information of the first log message is obtained based on the target attribute information in the target attribute information table and the target matching result of the message header data.

[0087] According to an embodiment of the present disclosure, the message header data may include data information located in the first field of the first log message, the target attribute information table may be constructed based on the target attribute information, and the target attribute information may include data information used to characterize the attribute information of the first log message, for example, it may include a subsystem field used to characterize the subsystem name, a type field used to characterize the log message type, and the like.

[0088] By matching the target attribute information with the message header data, a target matching result can be obtained. The target matching result indicates that when the target attribute information matches the message header data, the attribute information represented by the target attribute information can be determined as the attribute information of the first log message. For example, when the message header data matches the target attribute information "WARNING", it can be determined that the attribute information of the first log message includes the alarm type attribute information.

[0089] It should be noted that the embodiments of the present disclosure do not limit the specific matching method, for example, it may include a forward maximum matching algorithm, a regular expression matching algorithm, etc. The embodiments of the present disclosure do not limit the specific matching method, as long as it can achieve matching of the target attribute information with the message header data.

[0090] In an embodiment of the present disclosure, the python web framework flask can be used as the backend, and the first log message is downloaded from the host system at a time interval of every 1 minute. The received first log message is stored in the elasticsearch (ES search engine) of the platform after data cleaning. The backend program reads the first log message in elasticsearch in real time by calling the interface to implement the host system log processing method provided by the embodiment of the present disclosure.

[0091] Figure 4 The flowchart of generating a first message statistical image corresponding to an attribute identifier in a first interactive page according to a second log message according to an embodiment of the present disclosure is schematically shown.

[0092] like Figure 4 As shown, operation S230, generating a first message statistical image corresponding to the attribute identifier in the first interactive page according to the second log message may include operations S410 to S420.

[0093] In operation S410, a log message set corresponding to the attribute identifier is constructed according to the attribute identifier of the second log message, wherein the log message set includes at least one second log message.

[0094] In operation S420, a first message statistical image corresponding to the attribute identifier is generated in the first interactive page according to the log message set and the attribute identifier.

[0095] According to an embodiment of the present disclosure, the first message statistical image can intuitively represent the statistical characteristics of the second log message in the log message set with the attribute identifier, thereby facilitating operation and maintenance personnel to analyze the operation status of the host system according to the attribute identifier and the corresponding first message statistical image. For example, for the log message set corresponding to the subsystem identifier, a first message statistical image can be constructed for different subsystem identifiers. The first message statistical image may include a bar graph, and each bar graphic object in the bar graph represents the statistical number of the second log messages with the corresponding subsystem identifier.

[0096] According to an embodiment of the present disclosure, the host system log processing method may further include the following operations.

[0097] In response to a query operation on a statistical sub-image of a first message statistical image, a second message statistical image is generated in a second interactive page, wherein the second message statistical image represents statistical features of a second log message within a second historical duration, and the first historical duration includes at least one second historical duration.

[0098] According to an embodiment of the present disclosure, the statistical sub-image may be a graphic object in the first message statistical image. For example, when the first message statistical image is a bar graph, the statistical sub-image may be a bar graph object in the bar graph. The query operation for the statistical sub-image may include any operation type, such as a single-click operation or a double-click operation, but is not limited thereto. When the statistical sub-image is displayed in the second interactive page of a terminal device with a touch display screen, the query operation for the statistical sub-image may also include a touch gesture operation such as a long press operation. The embodiment of the present disclosure does not limit the specific type of the query operation.

[0099] According to an embodiment of the present disclosure, the second historical duration may be a historical time period in the first historical duration. By displaying a second message statistical image representing statistical features of a second log message in the second historical duration, operation and maintenance personnel may be helped to analyze log messages for fine-grained historical time periods, thereby discovering problems in the operation of the host system based on the analysis results.

[0100] Figure 5 The application scenario diagram of the host system log processing method according to an embodiment of the present disclosure is schematically shown.

[0101] like Figure 5 As shown, in the initial interactive page 510, four query images may be included: "Log message statistics", "Alarm log message" T511, "TOP10 log message", and "Today's alarm information". In response to detecting a click operation on "Alarm log message" T511, the user may jump to the first interactive page 520.

[0102] The first interactive page 520 may include a first message statistics image T520, which is a bar graph. The vertical axis of the bar graph is the statistical number of second log messages with an alarm type identifier. The horizontal axis of the bar graph may indicate that the first historical period is seven days before the current date. D1, D2, D3, D4, D5, D6, and D7 may represent the date name of each of the seven days before the current date, that is, the second historical period is 1 day.

[0103] The first message statistics image T520 may include multiple statistics sub-images, that is, multiple bar graph objects. When a query operation on the bar graph object 521 is detected, the page may jump to the second interactive page 530 .

[0104] Second message statistics images T531 and T532 may be generated in the second interactive page 530. The second message statistics image T531 may indicate the statistical number of second log messages with alarm type identification generated by each subsystem in the host system within the date D2, wherein A1, A2, A3, A4, A5, A6, and A7 may indicate the names of each subsystem in the host system, and the vertical axis of the second message statistics image T531 is the statistical number of second log messages.

[0105] The second message statistics image T532 is a pie chart, which can represent the statistical number ratio of the second log messages with attribute identification information of alarm type identification, error type identification, common type identification and attention type identification in subsystem A1 on date D2. The statistical sub-image T532 represents the ratio of the number of second log messages with alarm type identification to the number of all second log messages.

[0106] It should be noted that the user can also query the detailed information of all second log messages corresponding to the second message statistics images T531 and T532 in the second interactive page 530, that is, the user can query the detailed information such as the subsystem name, generation time, log identifier, message header and log message content of the second log messages.

[0107] According to an embodiment of the present disclosure, when the second message statistical image is a pie chart, it can also represent the statistical quantity ratio of the second log messages with different message header data in a selected subsystem and a selected historical period, so as to facilitate operation and maintenance personnel to analyze the log messages of the host system according to the message header data.

[0108] According to an embodiment of the present disclosure, when a query operation is detected for the query image "log message statistics" in the initial interaction page 510, multiple first message statistics images can be generated in the first interaction page 520, wherein each first message statistics image can respectively represent the statistical number of second log messages identified by each log message type within the first historical time period.

[0109] According to an embodiment of the present disclosure, when a query operation is detected for the query image "TOP10 log messages" in the initial interaction page 510, a first message statistical image of the second log messages ranked top 10 in number of log messages generated by the host system within the first historical time period can be generated in the first interaction page 520, and each statistical sub-image of the first message statistical image can respectively represent the message header data or the log message name of the second log message.

[0110] According to an embodiment of the present disclosure, when a query operation is detected for the query image "TOP10 log messages" in the initial interaction page 510, the page can be directly jumped to Figure 5 The second interactive page 530 in .

[0111] Figure 6 The flowchart of a host system log processing method according to another embodiment of the present disclosure is schematically shown.

[0112] like Figure 6 As shown, the host system log processing method may further include operations S610 to S650.

[0113] In operation S610, an operation object for comparing second log messages in two different preset time periods is displayed in a third interactive page, where the two different preset time periods include a reference historical time period and a comparison historical time period;

[0114] In operation S620, in response to a query operation on the operation object, a reference second log message set within a reference historical time period and a comparison second log message set within a comparison historical time period are acquired;

[0115] In operation S630, the comparison second log message set is matched with the reference second log message set, and a reference second log message is determined from the comparison second log message set, wherein the reference second log message is a second log message in the comparison second log message set that matches a second log message in the reference second log message set;

[0116] In operation S640, the reference second log message in the compared second log message set is deleted to obtain the target second log message; and

[0117] In operation S650 , the target second log message is added to the target log message pool.

[0118] According to an embodiment of the present disclosure, message header data of a second log message in a comparison second log message set may be matched with message header data of a second log message in a benchmark second log message set to determine a second log message in the comparison second log message set that matches the second log message in the benchmark second log message set, thereby obtaining a new target log message that appears within the comparison historical time period.

[0119] According to an embodiment of the present disclosure, the benchmark historical time period may be earlier than the comparison historical time period, and the benchmark second log message in the comparison second log message set may be a second log message in the comparison second log message set that has appeared in the benchmark historical time period. Therefore, by deleting the benchmark second log message in the comparison second log message set, the target second log message obtained may represent a new log message that appeared in the host system during the comparison historical time period. By adding the target second log message to the target log message pool, the new messages that appear may be classified and stored. By analyzing the target log messages in the target log message pool, the operation and maintenance personnel may avoid interference caused by repeated log messages, analyze new log messages in a timely manner, and promptly discover problems existing in the operation of the host system, thereby improving the operation and maintenance efficiency of the host system.

[0120] Figure 7 The following schematically shows an application scenario diagram of a host system log processing method according to another embodiment of the present disclosure.

[0121] like Figure 7 As shown, operation objects T611 and T612 are displayed in the third interactive page 610. Operation object T611 represents an operation object for selecting parameters for the second log message in the reference historical time period, and operation object T612 represents an operation object for selecting parameters for the second log message in the comparison historical time period.

[0122] When the query operation on the operation object T611, T612 is detected, the time menu T6111, T6121 and the subsystem menu T6112, T6122 can be displayed. The operation and maintenance personnel can determine the base historical time period and the comparison historical time period by selecting the time menu T6111, T6121, and determine the subsystem name to be queried by selecting the subsystem menu T6112, T6122, thereby determining the base second log message set within the base historical time period and the comparison second log message set within the comparison historical time period.

[0123] By matching the reference second log message set with the message header data of the second log message in the comparison second log message set, the reference second log message is determined from the comparison second log message set, and the target second log message is obtained after deleting the reference second log message in the comparison second log message set.

[0124] In the interactive page T620, a display image of the target log message pool T620 may be displayed, and the display image may include target second log messages 621, 622, 623, ... in the target log message pool. Each target second log message may include at least message header data X1, X2, X3, and log message content M1, M2, M3.

[0125] According to the embodiments of the present disclosure, operation and maintenance personnel can avoid interference caused by repeated log messages by viewing the target second log message, analyze new log messages in a timely manner, and promptly discover problems in the operation of the host system, thereby improving the operation and maintenance efficiency of the host system.

[0126] Based on the above host system log processing method, the present disclosure also provides a host system log processing device. Figure 8 The device is described in detail.

[0127] Figure 8 The structural block diagram of the host system log processing device according to an embodiment of the present disclosure is schematically shown.

[0128] like Figure 8 As shown, the host system log processing device 800 of this embodiment includes a parsing module 810 , an identification adding module 820 and a generating module 830 .

[0129] The parsing module 810 is used to parse the first log message from the host system to obtain attribute information of the first log message.

[0130] The identifier adding module 820 is used to add an attribute identifier corresponding to the attribute information to the first log message according to the attribute information, so as to obtain a second log message having the attribute identifier.

[0131] The generation module 830 is used to generate a first message statistical image corresponding to the attribute identifier in the first interactive page according to the second log message, wherein the first message statistical image represents the statistical characteristics of the second log messages with the same attribute identifier within the first historical period.

[0132] According to an embodiment of the present disclosure, the host system log processing device may further include a second generating module.

[0133] The second generation module is used to generate a second message statistical image in a second interactive page in response to a query operation on a statistical sub-image of the first message statistical image, wherein the second message statistical image represents statistical features of the second log message within a second historical duration, and the first historical duration includes at least one second historical duration.

[0134] According to an embodiment of the present disclosure, the generation module may include: a first construction unit and a first generation unit.

[0135] The first constructing unit is used to construct a log message set corresponding to the attribute identifier according to the attribute identifier of the second log message, wherein the log message set includes at least one second log message.

[0136] The first generating unit is used to generate a first message statistical image corresponding to the attribute identifier in the first interactive page according to the log message set and the attribute identifier.

[0137] According to an embodiment of the present disclosure, the parsing module may include: a parsing unit and a first matching unit.

[0138] The parsing unit is used to parse a first log message from a host system to obtain message header data of the first log message.

[0139] The first matching unit is used to obtain the attribute information of the first log message based on the target attribute information in the target attribute information table and the target matching result of the message header data.

[0140] According to an embodiment of the present disclosure, the host system log processing device may further include:

[0141] The display module is used to display, on the third interactive page, an operation object for comparing the second log message within two different preset time periods, where the two different preset time periods include a reference historical time period and a comparison historical time period.

[0142] The first acquisition module is used to acquire a reference second log message set within a reference historical time period and a comparison second log message set within a comparison historical time period in response to a query operation on an operation object.

[0143] The first matching module is used to match the comparison second log message set with the benchmark second log message set, and determine the benchmark second log message from the comparison second log message set, wherein the benchmark second log message is a second log message in the comparison second log message set that matches the second log message in the benchmark second log message set.

[0144] The deletion module is used to delete the reference second log message in the second log message set and obtain the target second log message.

[0145] The adding module is used to add the target second log message to the target log message pool.

[0146] According to an embodiment of the present disclosure, the attribute information includes subsystem attribute information and log message type information, and the attribute identifier includes a subsystem identifier and a log message type identifier.

[0147] According to an embodiment of the present disclosure, the host system log processing device may further include a download module.

[0148] The download module is used to download the first log message from the host system according to a preset time rule.

[0149] According to an embodiment of the present disclosure, any multiple modules in the parsing module 810, the identification adding module 820 and the generating module 830 can be combined in one module for implementation, or any one of the modules can be split into multiple modules. Alternatively, at least part of the functions of one or more of these modules can be combined with at least part of the functions of other modules and implemented in one module. According to an embodiment of the present disclosure, at least one of the parsing module 810, the identification adding module 820 and the generating module 830 can be at least partially implemented as a hardware circuit, such as a field programmable gate array (FPGA), a programmable logic array (PLA), a system on a chip, a system on a substrate, a system on a package, an application specific integrated circuit (ASIC), or can be implemented by hardware or firmware such as any other reasonable way of integrating or packaging the circuit, or implemented in any one of the three implementation modes of software, hardware and firmware or in an appropriate combination of any of them. Alternatively, at least one of the parsing module 810, the identification adding module 820 and the generating module 830 can be at least partially implemented as a computer program module, and when the computer program module is run, the corresponding function can be executed.

[0150] Fig. 9 A block diagram of an electronic device suitable for implementing a host system log processing method according to an embodiment of the present disclosure is schematically shown.

[0151] like Fig. 9 As shown, the electronic device 900 according to an embodiment of the present disclosure includes a processor 901, which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM) 902 or a program loaded from a storage part 908 into a random access memory (RAM) 903. The processor 901 may include, for example, a general-purpose microprocessor (e.g., a CPU), an instruction set processor and / or a related chipset and / or a special-purpose microprocessor (e.g., an application-specific integrated circuit (ASIC)), etc. The processor 901 may also include an onboard memory for caching purposes. The processor 901 may include a single processing unit or multiple processing units for performing different actions of the method flow according to an embodiment of the present disclosure.

[0152] In RAM 903, various programs and data required for the operation of electronic device 900 are stored. Processor 901, ROM 902 and RAM 903 are connected to each other via bus 904. Processor 901 performs various operations of the method flow according to the embodiment of the present disclosure by executing the program in ROM 902 and / or RAM 903. It should be noted that the program can also be stored in one or more memories other than ROM 902 and RAM 903. Processor 901 can also perform various operations of the method flow according to the embodiment of the present disclosure by executing the program stored in the one or more memories.

[0153] According to an embodiment of the present disclosure, the electronic device 900 may further include an input / output (I / O) interface 905, which is also connected to the bus 904. The electronic device 900 may further include one or more of the following components connected to the I / O interface 905: an input portion 906 including a keyboard, a mouse, etc.; an output portion 907 including a cathode ray tube (CRT), a liquid crystal display (LCD), etc., and a speaker, etc.; a storage portion 908 including a hard disk, etc.; and a communication portion 909 including a network interface card such as a LAN card, a modem, etc. The communication portion 909 performs communication processing via a network such as the Internet. A drive 910 is also connected to the I / O interface 905 as needed. A removable medium 911, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 910 as needed, so that a computer program read therefrom is installed into the storage portion 908 as needed.

[0154] The present disclosure also provides a computer-readable storage medium, which may be included in the device / apparatus / system described in the above embodiments; or may exist independently without being assembled into the device / apparatus / system. The above computer-readable storage medium carries one or more programs, and when the above one or more programs are executed, the method according to the embodiment of the present disclosure is implemented.

[0155] According to an embodiment of the present disclosure, a computer-readable storage medium may be a non-volatile computer-readable storage medium, for example, may include but is not limited to: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the present disclosure, a computer-readable storage medium may be any tangible medium containing or storing a program, which may be used by or in combination with an instruction execution system, an apparatus, or a device. For example, according to an embodiment of the present disclosure, a computer-readable storage medium may include the ROM 902 and / or RAM 903 described above and / or one or more memories other than ROM 902 and RAM 903.

[0156] The embodiment of the present disclosure also includes a computer program product, which includes a computer program, and the computer program contains program code for executing the method shown in the flowchart. When the computer program product is run in a computer system, the program code is used to enable the computer system to implement the method provided by the embodiment of the present disclosure.

[0157] The above functions defined in the system / device of the embodiment of the present disclosure are performed when the computer program is executed by the processor 901. According to the embodiment of the present disclosure, the system, device, module, unit, etc. described above can be implemented by a computer program module.

[0158] In one embodiment, the computer program may be based on a tangible storage medium such as an optical storage device, a magnetic storage device, etc. In another embodiment, the computer program may also be transmitted and distributed in the form of a signal on a network medium, and downloaded and installed through the communication part 909, and / or installed from a removable medium 911. The program code contained in the computer program may be transmitted using any appropriate network medium, including but not limited to: wireless, wired, etc., or any suitable combination of the above.

[0159] In such an embodiment, the computer program can be downloaded and installed from the network through the communication part 909, and / or installed from the removable medium 911. When the computer program is executed by the processor 901, the above functions defined in the system of the embodiment of the present disclosure are performed. According to the embodiment of the present disclosure, the system, device, means, module, unit, etc. described above can be implemented by a computer program module.

[0160] According to an embodiment of the present disclosure, the program code for executing the computer program provided by the embodiment of the present disclosure can be written in any combination of one or more programming languages. Specifically, these computing programs can be implemented using high-level process and / or object-oriented programming languages, and / or assembly / machine languages. Programming languages ​​include, but are not limited to, Java, C++, python, "C" language or similar programming languages. The program code can be executed entirely on the user computing device, partially on the user device, partially on the remote computing device, or entirely on the remote computing device or server. In the case of a remote computing device, the remote computing device can be connected to the user computing device through any type of network, including a local area network (LAN) or a wide area network (WAN), or can be connected to an external computing device (for example, using an Internet service provider to connect through the Internet).

[0161] The flow charts and block diagrams in the accompanying drawings illustrate the possible architecture, functions and operations of the systems, methods and computer program products according to various embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a module, a program segment, or a part of a code, and the above-mentioned module, program segment, or a part of a code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the box can also occur in a different order from the order marked in the accompanying drawings. For example, two boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram or flow chart, and the combination of the boxes in the block diagram or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0162] It will be appreciated by those skilled in the art that the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways, even if such combinations and / or combinations are not explicitly described in the present disclosure. In particular, the features described in the various embodiments and / or claims of the present disclosure may be combined and / or combined in a variety of ways without departing from the spirit and teachings of the present disclosure. All of these combinations and / or combinations fall within the scope of the present disclosure.

[0163] The embodiments of the present disclosure are described above. However, these embodiments are only for illustrative purposes and are not intended to limit the scope of the present disclosure. Although the embodiments are described above separately, this does not mean that the measures in the various embodiments cannot be used in combination to advantage. The scope of the present disclosure is defined by the attached claims and their equivalents. Without departing from the scope of the present disclosure, those skilled in the art may make a variety of substitutions and modifications, which should all fall within the scope of the present disclosure.

Claims

1. A host system log processing method, comprising: Parsing a first log message from a host system to obtain attribute information of the first log message; According to the attribute information, adding an attribute identifier corresponding to the attribute information to the first log message to obtain a second log message with the attribute identifier; According to the second log message, generating a first message statistical image corresponding to the attribute identifier in the first interactive page, wherein the first message statistical image represents statistical features of the second log messages having the same attribute identifier within a first historical period; Displaying, on the third interactive page, an operation object for comparing the second log message within two different preset time periods, wherein the two different preset time periods include a reference historical time period and a comparison historical time period; In response to a query operation on the operation object, obtaining a reference second log message set within the reference historical time period and a comparison second log message set within the comparison historical time period; Matching the comparison second log message set with the benchmark second log message set, and determining a benchmark second log message from the comparison second log message set, wherein the benchmark second log message is a second log message in the comparison second log message set that matches a second log message in the benchmark second log message set; Deleting the reference second log message in the compared second log message set to obtain the target second log message; and The target second log message is added to a target log message pool.

2. The host system log processing method according to claim 1, further comprising: In response to a query operation on the statistical sub-image of the first message statistical image, a second message statistical image is generated in a second interactive page, wherein the second message statistical image represents statistical features of the second log message within a second historical duration, and the first historical duration includes at least one of the second historical duration.

3. The host system log processing method according to claim 1, wherein: Generating, according to the second log message, a first message statistical image corresponding to the attribute identifier in the first interactive page includes: According to the attribute identifier of the second log message, construct a log message set corresponding to the attribute identifier, wherein the log message set includes at least one of the second log messages; According to the log message set and the attribute identifier, a first message statistical image corresponding to the attribute identifier is generated in the first interactive page.

4. The host system log processing method according to claim 1, wherein: Parsing a first log message from a host system to obtain attribute information of the first log message includes: Parsing a first log message from a host system to obtain message header data of the first log message; Based on the target attribute information in the target attribute information table and the target matching result of the message header data, the attribute information of the first log message is obtained.

5. The host system log processing method according to claim 1, wherein: The attribute information includes subsystem attribute information and log message type information, and the attribute identifier includes a subsystem identifier and a log message type identifier.

6. The host system log processing method according to claim 1, further comprising: According to a preset time rule, the first log message is downloaded from the host system.

7. A host system log processing device, comprising: A parsing module, configured to parse a first log message from a host system to obtain attribute information of the first log message; an identification adding module, used for adding an attribute identification corresponding to the attribute information to the first log message according to the attribute information, so as to obtain a second log message having the attribute identification; A generating module, configured to generate, in a first interactive page, a first message statistical image corresponding to the attribute identifier according to the second log message, wherein the first message statistical image represents statistical features of the second log messages having the same attribute identifier within a first historical period; A display module, used to display, on a third interactive page, an operation object for comparing a second log message within two different preset time periods, wherein the two different preset time periods include a reference historical time period and a comparison historical time period; A first acquisition module, configured to acquire, in response to a query operation on the operation object, a reference second log message set within the reference historical time period and a comparison second log message set within the comparison historical time period; A first matching module, configured to match the comparison second log message set with the benchmark second log message set, and determine a benchmark second log message from the comparison second log message set, wherein the benchmark second log message is a second log message in the comparison second log message set that matches a second log message in the benchmark second log message set; a deleting module, configured to delete the reference second log message in the compared second log message set to obtain a target second log message; and The adding module is used to add the target second log message to the target log message pool.

8. An electronic device, comprising: one or more processors; a storage device for storing one or more programs, When the one or more programs are executed by the one or more processors, the one or more processors execute the method according to any one of claims 1 to 6.

9. A computer-readable storage medium having executable instructions stored thereon, which, when executed by a processor, causes the processor to execute the method according to any one of claims 1 to 6.

10. A computer program product, comprising a computer program, wherein when the computer program is executed by a processor, the method according to any one of claims 1 to 6 is implemented.

Images