Method and electronic device for obtaining a hierarchical data structure and processing log entries

Abstract

Embodiments of the present disclosure provide methods, electronic devices, and computer program products for obtaining a hierarchical data structure and processing log entries. The method for obtaining a hierarchical data structure includes: obtaining corresponding feature information included in each log entry of a set of log entries; based on the corresponding feature information, determining multiple log entry patterns, wherein the pattern feature information of each log entry pattern corresponds to the feature information of a subset of log entries in a set of log entries; storing a set of log entries in a hierarchical data structure so that each log entry is associated with at least one of a plurality of nodes of the hierarchical data structure, wherein the plurality of nodes respectively correspond to a plurality of log entry patterns, and the plurality of nodes are organized hierarchically based on their respective corresponding log entry patterns. The embodiments of the present disclosure can obtain a hierarchical data structure to store log entries, and can use this as a basis to support efficient processing of log entries.

Description

Technical Field

[0001] Embodiments of the present disclosure relate to the field of computers, and more particularly, to a method for obtaining a hierarchical data structure and processing log entries, an electronic device, and a computer program product. Background Art

[0002] Network devices, systems, and service programs generate event records during operation. These event records can be stored as log entries (e.g., lines) in log files. Each log entry can record descriptive information related to the operation, such as the date, time, user, and action. With the development of information technology, massive amounts of data are generated at all times. However, traditional solutions for processing log files or log entries cannot effectively analyze them and further extract valuable information. Summary of the Invention

[0003] Embodiments of the present disclosure provide a solution for obtaining a hierarchical data structure and processing log entries.

[0004] In a first aspect of the present disclosure, a method for obtaining a hierarchical data structure for storing log entries is provided, the method comprising: obtaining corresponding feature information included in each log entry of a set of log entries; determining a plurality of log entry patterns based on the corresponding feature information, the pattern feature information of each log entry pattern corresponding to feature information of a subset of log entries in the set of log entries; storing the set of log entries in a hierarchical data structure so that each log entry is associated with at least one node of a plurality of nodes of the hierarchical data structure, the plurality of nodes respectively corresponding to the plurality of log entry patterns, and the plurality of nodes are hierarchically organized based on their respective corresponding log entry patterns.

[0005] In a second aspect of the present disclosure, a method for processing log entries is provided, the method comprising: receiving a request for processing a target log entry; and processing the target log entry based on the hierarchical data structure obtained by the method according to the first aspect of the present disclosure.

[0006] In a third aspect of the present disclosure, an electronic device is provided, comprising a processor; and a memory coupled to the processor, the memory having instructions stored therein, which, when executed by the processor, cause the electronic device to perform actions, the actions comprising: obtaining corresponding feature information included in each log entry of a set of log entries; determining a plurality of log entry patterns based on the corresponding feature information, the pattern feature information of each log entry pattern corresponding to feature information of a subset of log entries in the set of log entries; storing the set of log entries in a hierarchical data structure so that each log entry is associated with at least one of a plurality of nodes of the hierarchical data structure, the plurality of nodes respectively corresponding to the plurality of log entry patterns, and the plurality of nodes being hierarchically organized based on their respective corresponding log entry patterns.

[0007] In a fourth aspect of the present disclosure, an electronic device is provided, comprising a processor; and a memory coupled to the processor, the memory having instructions stored therein, which, when executed by the processor, cause the electronic device to perform actions, the actions comprising: receiving a request for processing a target log entry; and processing the target log entry based on a hierarchical data structure obtained by the electronic device described in the third aspect of the present disclosure.

[0008] In a fifth aspect of the present disclosure, there is provided a computer program product tangibly stored on a computer-readable medium and comprising machine-executable instructions which, when executed, cause a machine to perform any of the steps of the method according to the first aspect.

[0009] In a sixth aspect of the present disclosure, there is provided a computer program product tangibly stored on a computer-readable medium and comprising machine-executable instructions which, when executed, cause a machine to perform any of the steps of the method according to the second aspect.

[0010] This summary is provided to introduce a selection of concepts in a simplified form that are further described in the detailed description below. This summary is not intended to identify key features or essential features of the disclosure, nor is it intended to limit the scope of the disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] The above and other purposes, features and advantages of the present disclosure will become more apparent by describing the exemplary embodiments of the present disclosure in more detail with reference to the accompanying drawings, wherein the same or similar reference numerals generally represent the same or similar components in the exemplary embodiments of the present disclosure. In the accompanying drawings:

[0012] Figure 1 A schematic diagram illustrating an exemplary environment according to an embodiment of the present disclosure is shown;

[0013] Figure 2 A flowchart showing a process of obtaining a hierarchical data structure according to an embodiment of the present disclosure is shown;

[0014] Figure 3 A schematic diagram showing a hierarchical data structure according to an embodiment of the present disclosure is shown;

[0015] Figure 4 A flowchart illustrating a process of processing log entries according to an embodiment of the present disclosure is shown;

[0016] Figure 5 A schematic diagram illustrating a process of determining a first mode based on a natural language processing model according to an embodiment of the present disclosure is shown;

[0017] Figure 6 A schematic diagram illustrating a process of determining a third mode according to an embodiment of the present disclosure is shown;

[0018] 7A to 7C Tables respectively showing rules for rating log processing according to an embodiment of the present disclosure; and

[0019] Figure 8 A block diagram is shown of an example device that may be used to implement embodiments of the present disclosure. DETAILED DESCRIPTION

[0020] The principles of the present disclosure will be described below with reference to several example embodiments shown in the accompanying drawings.

[0021] As used herein, the term "including" and its variations represent open inclusion, i.e., "including but not limited to." Unless otherwise stated, the term "or" means "and / or." The term "based on" means "based at least in part on." The terms "an example embodiment" and "an embodiment" mean "a set of example embodiments." The term "another embodiment" means "a set of additional embodiments." The terms "first," "second," etc. may refer to different or the same objects. Other explicit and implicit definitions may also be included below.

[0022] As discussed above, traditional solutions for processing log files or log entries are unable to efficiently analyze them and further extract valuable information. Consequently, such solutions struggle to analyze log information, such as relationships between log entries, and are even more incapable of using the analysis results to optimize storage systems, such as for log data deduplication, workload prediction, and fault cause analysis and tracing.

[0023] In order to at least partially address the above shortcomings, an embodiment of the present disclosure provides a solution for supporting the analysis of log data. The solution can extract corresponding feature information from each log entry (for example, a line of log in a log file, which can correspond to an event record), and cluster multiple log entries based on the feature information to generate a hierarchical data structure to store multiple log entries. Each node in the hierarchical data will be linked to a subset of log entries in the multiple log entries, and will correspond to a log entry pattern. The log entry pattern can identify the common features of the log entries in the log entry subset. The generated hierarchical data structure can achieve efficient storage and retrieval of log entries.

[0024] This solution can obtain a hierarchical data structure to store log entries, and further, based on this, can support efficient processing of log entries. Such processing includes storage and retrieval, and additionally or alternatively includes analysis of the content recorded in the log entries to obtain various feature information to facilitate subsequent processing.

[0025] Figure 1 FIG. 1 is a schematic diagram of an exemplary environment 100 according to an embodiment of the present disclosure, in which the apparatus and / or method according to an embodiment of the present disclosure may be implemented. Figure 1 As shown, the exemplary environment may include a hierarchical data structure acquisition subsystem 102 and a log processing subsystem 104. The hierarchical data structure acquisition subsystem 102 and the log processing subsystem 104 may be implemented in different or the same computing devices.

[0026] A computing device can be any device with computing capabilities. As non-limiting examples, a computing device can be any type of fixed, mobile, or portable computing device, including but not limited to desktop computers, laptop computers, notebook computers, netbook computers, tablet computers, smartphones, etc. All or some of the components of the computing device can be distributed in the cloud. The computing device can also adopt a cloud-edge architecture.

[0027] The storage device (not shown) includes (a plurality of) storage disks for storing data. The storage disk can be any type of device having storage functionality, including, but not limited to, a hard disk drive (HDD), a solid-state drive (SSD), a removable disk, any other magnetic storage device, any other optical storage device, or any combination thereof. The computing device (e.g., the data structure acquisition device 115 in the hierarchical data structure acquisition subsystem 102) can be configured to store data, such as a set of log entries 110, in the storage device in an indexable manner (e.g., in a hierarchical data structure 120).

[0028] The computing device (e.g., the processing device 135 in the log processing subsystem 104) may also be configured to, in response to the request 130, perform corresponding processing on the stored log data using the hierarchical data structure 120 to obtain a corresponding processing result 140. In some embodiments, the request 130 includes at least one of the following: a query request for a log entry, a first analysis request for a log entry block consisting of associated log entries, and a second analysis request for multiple associated log entry blocks, and the processing result 140 correspondingly includes at least one of the following: the retrieved one or more log entries, the analysis result of the first analysis request (e.g., the first key information), and the analysis result of the second analysis request (e.g., the second key information).

[0029] In some embodiments, the processing device 135 can use a natural language processing model (sometimes referred to as a model in this document) to perform corresponding processing to obtain corresponding analysis results for responding to analysis requests for log entries. In the description of the embodiments of the present disclosure, the term "model" can learn the association between corresponding inputs and outputs from training data, so that after training is completed, the given input is processed based on the parameter set obtained by training to generate corresponding outputs. "Model" may also sometimes be referred to as a "neural network", "learning model", "learning network" or "network". These terms are used interchangeably in this document.

[0030] In some embodiments, the processing device 135 may select a suitable initial model for training to obtain a model. The initial training model includes, but is not limited to, a support vector machine (SVM) model, a Bayesian model, a random forest model, and various deep learning / neural network models, such as a convolutional neural network (CNN), a recurrent neural network (RNN), a deep neural network (DNN), a deep reinforcement learning network (DQN), and the like.

[0031] In some embodiments, the model can be generated using various pre-trained neural network models. Pre-trained neural network models include, but are not limited to, BERT (Bidirectional Encoder Representation from Transformers, a deep bidirectional language representation model based on transformers). In some embodiments, the model can also refer to a model that combines different models to form a joint. For example, the model may include a combination of at least one of the following modules: a word segmenter, a BERT module, a classifier such as a logistic regression algorithm and / or a decision tree algorithm and / or ensemble learning, a sequence labeling model module such as a conditional random field (CRF), etc.

[0032] Environment 100 may also include a training data acquisition device and a model training device (not shown). In some embodiments, the aforementioned multiple devices may be implemented in different or the same computing devices. For example, the training data acquisition device, the model training device, and the processing device 135 may be implemented in the same computing device, which is different from the computing device implemented in the processing device 135.

[0033] During the model training phase, a training data acquisition device may acquire input data and provide it to the model. The input data may be one of a training set, a validation set, and a test set, and the model is a model to be trained. In this article, each sample in the input data may be a text recorded by one or more log entries. The model training device may train the model based on the input data. During the model training phase, the parameters of the model (e.g., weights and biases, etc.) may be adjusted based on at least one constraint (sometimes also referred to as loss), and the constraints may characterize the performance indicators (e.g., accuracy) of the model. The training process may cause at least one constraint to move in a decreasing direction by adjusting the parameters of the model. The trained model may be provided to the processing device 135.

[0034] It should be understood that the architecture and functions in the environment 100 are described for exemplary purposes only and do not imply any limitation on the scope of the present disclosure. The embodiments of the present disclosure may also be applied to other environments with different structures and / or functions. Figure 2 FIG7 is a detailed description of the process according to an embodiment of the present disclosure. For ease of understanding, the specific data mentioned in the following description are exemplary and are not intended to limit the scope of protection of the present disclosure. It is understood that the embodiments described below may also include additional actions not shown and / or may omit the actions shown, and the scope of the present disclosure is not limited in this respect.

[0035] Figure 2 FIG. 2 is a flowchart showing a process 200 for obtaining a hierarchical data structure according to an embodiment of the present disclosure. The process 200 may be performed, for example, in Figure 1 The data structure shown in FIG is implemented at an acquisition device 115 (hereinafter sometimes referred to as an acquisition device). The hierarchical data structure can be configured to store a set of log entries in a structured manner to facilitate subsequent access, retrieval and / or analysis of the stored log entries.

[0036] like Figure 2As shown, at 202, the acquisition device 115 may acquire corresponding characteristic information included in each log entry of a set of log entries. In some embodiments, the acquisition device 115 may first identify the format in which the set of log entries are recorded. Log files typically contain structured information. For example, each log entry may include multiple fields, each field storing fixed information. Examples of fields include, but are not limited to, a time information field, a machine information field, a path information field, and a custom information field. In some embodiments, the time information field may include at least one of the following: a date field, a time field, a timestamp field, and a year field; the machine information field may include at least one of the following: a fully qualified domain name (FQDN) field, a domain name field, an IP address field, and a MAC address field; the path information field may include at least one of the following: a URL / URI field, such as a Windows system path field; and the custom information field may include at least one of the following: a process ID field, a thread ID field, and a job ID field. Each field may record corresponding information, for example, in text form.

[0037] Based on the identified format, acquisition device 115 can determine a predetermined rule for extracting the corresponding characteristic information, and extract the corresponding characteristic information based on the predetermined rule. For example, for log entries stored in a predetermined format, the corresponding information recorded in certain fields may be more valuable for subsequent processing and can represent the characteristics of the information recorded in the log entry. Therefore, a predetermined rule can be set to extract such characteristic information from predetermined fields of the log entry.

[0038] At 204, the acquisition device 115 may determine multiple log entry patterns based on the corresponding feature information. In this article, the pattern feature information of the term "pattern" may refer to the summarized feature information corresponding to the original information recorded in the log entry, so log entries with the same or similar feature information may be determined to belong to the same or similar pattern. For ease of understanding, the following will be combined with Figure 3 To describe in detail. Figure 3 FIG2 shows a schematic diagram of a hierarchical data structure 300 (hereinafter sometimes referred to as a data structure) according to an embodiment of the present disclosure. It should be understood that the hierarchical data structure 300 is for illustration purposes only. Figure 3 The data structure is simplified in the figure. The actual data structure used to implement the embodiments of the present disclosure may include more or fewer levels, and each level may include more nodes, but the present disclosure is not limited to this.

[0039] like Figure 3As shown, a group of log entries may include log entries 340-1 to 340-n. Each log entry will record corresponding information in multiple fields. For example, for a log entry subset including log entries 340-1, 340-n and other similar log entries not shown, based on the same or similar parts between the corresponding feature information extracted from their predetermined fields, one or more corresponding log entry patterns can be determined, and then can correspond to one or more nodes in the hierarchical data structure 300. This process can be regarded as a process of clustering a group of log entries based on feature information. Each log entry pattern may include pattern feature information and data structure domain information. The pattern feature information will correspond to the feature information of a log entry subset in a group of log entries.

[0040] In some embodiments, the pattern feature information is the feature information shared by the log entries in a subset of log entries. In some embodiments, for a subset of log entries, based on the feature information it possesses, multiple shared feature information (e.g., the pattern feature information presented in nodes 331, 321, and 310) can be determined, and thus multiple corresponding log entry patterns can be present. The pattern feature information of the log entry patterns corresponding to nodes 331, 321, and 310 can be associated with each other and can be different levels of abstraction of the original feature information of the log entries. For example, the pattern feature information of the log entry pattern corresponding to node 321 can be an abstract, simplified, or highly formatted expression of the pattern feature information of the log entry pattern corresponding to node 331. The pattern feature information of the log entry pattern corresponding to node 310 can be an abstract, simplified, or highly formatted expression of the pattern feature information of the log entry patterns corresponding to nodes 321 and 320, and further an abstract, simplified, or highly formatted expression of the pattern feature information of the log entry patterns corresponding to nodes 330 and 331.

[0041] Back to reference Figure 2 At 206, the acquisition device 115 may store a set of log entries in a hierarchical data structure so that each log entry is associated with at least one node among a plurality of nodes in the hierarchical data structure. Figure 3 As discussed above, since log entries in a set of log entries may correspond to multiple log entry patterns and thus correspond to corresponding nodes in the hierarchical data structure, a hierarchical data structure 300 may be constructed based on the association between pattern feature information of the log entry patterns.

[0042] In the hierarchical data structure, each log entry is associated with at least a top node, which is located at the top level of the hierarchical data structure (e.g., node 310). Each log entry is also associated with branch nodes (e.g., nodes 321 and 331), which are located at one or more levels below the top level in the hierarchical data structure, and the branch nodes (e.g., nodes 321 and 331) are associated with the top node (e.g., node 310). Utilizing the hierarchical data structure enables different levels of extraction of raw feature information in the log entries, for example, to support subsequent responses to various queries including ambiguous or precise query text.

[0043] The hierarchical data structure 300 may also support linking the log entries to be stored in the newly received log file to be stored to one or some of the nodes therein. In some embodiments, in response to receiving the log entry to be stored, the acquisition device 115 may determine the first characteristic information of the log entry to be stored. The method for determining the first characteristic information is similar to the method for obtaining the characteristics of the log entry discussed above, which will not be repeated here. Based on the first characteristic information, the acquisition device 115 may determine at least one target node for storing the log entry to be stored, wherein the pattern characteristic information corresponding to the at least one target node matches the first characteristic information. Then, the acquisition device 115 may store the log entry to be stored as being associated with the at least one target node, so that the hierarchical data structure can be updated based on the received log file to include the log entry included therein.

[0044] In some embodiments, for each log entry to be stored, the acquisition device 115 can determine whether there is a node matching the log entry to be stored in each layer from the bottom layer to the top layer of the hierarchical data structure. In some embodiments, based on the first feature information, the acquisition device 115 can determine a branch node located in the bottom layer of the hierarchical data structure, and the pattern feature information associated with the determined branch node will match the first feature information. For example, the pattern feature information and the first feature information can be the same, or an abstract, simplified, or highly formatted expression of the latter. Based on the hierarchical data structure, the acquisition device 115 can determine the top node associated with the determined branch node in the top layer of the hierarchical data structure. Since the association relationship between nodes in the hierarchical data structure is determined, based on the determined branch node in the bottom layer, the associated nodes in each layer above the bottom layer (including branch nodes and top nodes in higher layers) can be determined. If the first feature information matches the pattern feature information associated with the determined top node, the acquisition device 115 can determine the branch node and the top node as the target node, and thereby store the log entry to be stored as being associated with such a target node for subsequent processing.

[0045] In some cases, if the first characteristic information and the pattern characteristic information associated with the top node do not match, since the log entry to be stored cannot be stored as associated with the corresponding top node, the acquisition device 115 may store the log entry to be stored in the cache. In response to the log entries to be stored in the cache reaching a predetermined number, the acquisition device 115 may cluster the predetermined number of log entries to be stored based on the first characteristic information corresponding to the predetermined number of log entries to be stored to determine additional pattern characteristic information. Based on the additional pattern characteristic information, the acquisition device 115 may create additional top nodes in the hierarchical data structure, and it will be understood that the additional top nodes correspond to additional log entry patterns determined based on the additional pattern characteristic information. In such a case, the acquisition device 115 may determine the branch node and the top node as the target node, and thereby store the log entry to be stored as associated with such a target node for subsequent processing.

[0046] In this way, the data structure acquisition device can store a set of log entries, along with newly received log entries to be stored, in a hierarchical data structure. Nodes in the hierarchical data structure can correspond to subsets of log entries with common characteristic information. This facilitates efficient subsequent processing of log entries, such as quickly accessing target log entries through query requests and further analyzing the content of related log entries to identify key information.

[0047] Figure 4 FIG. 4 is a flow chart showing a process 400 for processing log entries according to an embodiment of the present disclosure. The process 400 may be performed, for example, in Figure 1 The processing device 135 shown in FIG is implemented. Figure 4 As shown, at 402, the processing device 135 receives a request for processing a target log entry. In some embodiments, the request may include at least one of the following: a query request related to at least a target log entry pattern, a first request for analyzing a first node among a plurality of nodes, and a second request for analyzing the first pattern and a second pattern associated with the first pattern.

[0048] At 404, the processing device 135 Figure 2 The hierarchical data structure obtained by the description is used to process the target log entry to respond to the received request. In this way, the log entry can be processed or analyzed efficiently using the structured feature information.

[0049] In some embodiments, when the received request includes a query request related to at least a target log entry pattern, processing device 135 needs to retrieve one or more target log entries corresponding to the query request from a set of log entries stored in a hierarchical data structure. In some embodiments, processing device 135 may determine at least one target node from a plurality of nodes that matches the target log entry pattern, and then determine a target log entry associated with the at least one target node from the set of log entries for responding to the query request.

[0050] For ease of understanding, the following Figure 3 To describe in detail how to respond to a query request. In some embodiments, for a query request, the processing device 135 can determine, in order from the bottom layer to the top layer of the hierarchical data structure 300, whether there is a node in each layer with pattern feature information that matches the query text included in the query request, where the query text will correspond to the pattern feature information of the target log entry pattern. Thus, the processing device 135 can first determine at least one target top node (e.g., top node 310), and based on this, determine one or more branch nodes (e.g., branch nodes 320, 321) associated with the at least one target top node at a lower level, and based on the pattern feature information associated with the branch node and the query text, determine a matching target branch node (e.g., branch node 320) in a lower level of the one or more branch nodes. By performing a layer-by-layer matching in this manner, the target log entry corresponding to the query request (e.g., log entry 340-1) can be ultimately located quickly and efficiently. It will be understood that when there is no node corresponding to the query request in the hierarchical data structure, the processing device will respond to the query request with a null value.

[0051] Back to reference Figure 4 , using a hierarchical data structure, related log entries (for example, all or part of the log entries corresponding to a node) can be aggregated together to form a log entry block, and artificial intelligence technology such as machine learning can be used to analyze the multiple log entries included in the log entry block to determine the key information recorded in these log entries, and thereby determine the log block pattern (in-block pattern) to identify the overall information related to these log entries as a whole. The in-block pattern is sometimes also referred to as the first pattern or the second pattern in this article.

[0052] In some embodiments, when the received request includes a first request for analyzing a first node among a plurality of nodes, the processing device 135 needs to analyze a subset of log entries associated with the first node in a set of log entries, for example, to remove irrelevant redundant information and determine key information. Figure 5 The processing of the first request is described in detail. Figure 5 A schematic diagram illustrates a process 500 for determining a first pattern based on a natural language processing model according to an embodiment of the present disclosure. The processing device 135 may determine a first target subset 510 of log entries associated with a first node. Each log entry records a large amount of characteristic information, such as time information, machine information, path information, and event information, in various fields according to a predetermined log record format.

[0053] In some embodiments, the processing device 135 can determine a first pattern associated with the first target log entry subset 510 based on the determined first target log entry subset 510 and the natural language processing model 505, for responding to the first request, wherein the pattern feature information of the first pattern identifies key information in the content recorded by the first target log entry subset. In some embodiments, the natural language processing model 505 may include multiple modules configured to perform respective functions. Specifically, in some embodiments, the processing device 135 combines the target log entries in the first target log entry subset to obtain a first combined log text. The model can be enabled to recognize the first combined log text by adding a first identifier (e.g., [CLS]) at the beginning of the first combined log text and a second identifier (e.g., [SEP]) at the end thereof. The above identifiers are only specific examples, and it is understood that the identifiers can be set accordingly according to different natural understanding models.

[0054] The model 505 may include a word segmentation and tensor generation module 530, which is configured to segment the first combined log text into a sequence of individual words and convert the sequence of words into a vector (e.g., an embedding vector, which may include information identifying features of the words in the text and information about the positions of the words in the text). The module 530 is further configured to arrange the converted vectors into a tensor 535 (e.g., a two-dimensional matrix consisting of multiple vectors). The tensor 535 can be input to a feature extraction module 540 of a natural language processing model, such as a BERT-based module. The module 540 can be configured to determine a first feature representation 547 for the first combined log text. In some embodiments, based on the input tensor 535, the output of the module 540 will be a feature tensor 545, the dimensions of which may be {the number of log entries in the first target log entry subset, the maximum number of vectors corresponding to one log entry, the number of hidden layers in the module 540}. The feature tensor 545 can be further divided into a first feature representation 547 corresponding to the tensor 535, and the tensor 535 and the first feature representation 547 can both be two-dimensional matrices, and in some embodiments, the two have the same number of rows and columns. The first feature representation 547 can be input into a classifier module 550, which is configured to determine a first pattern based on the first feature representation, and thus can classify the first target log entry subset 510 as belonging to the first pattern. Examples of the classifier module 550 include, but are not limited to, classifiers based on a logistic regression algorithm, and / or a decision tree algorithm, and / or ensemble learning. In some embodiments, the classifier module 550 can be a classifier based on a logistic regression algorithm. The pattern feature information of the first pattern can be the root cause of the log entries in the first target log entry subset being recorded, for example, a specific fault or error occurring in a storage system, application, or service.

[0055] Since the pattern characteristic information of the first pattern identifies the key information in the content recorded by the first target log entry subset, in this way, multiple associated log entries can be analyzed and the redundant information recorded therein can be removed to obtain the key information expected by the user (for example, the pattern within the log block), so as to facilitate the subsequent execution of corresponding operations based on the key information.

[0056] Back to reference Figure 4For associated intra-block patterns (e.g., the first pattern and the associated second pattern and / or other additional intra-block patterns), artificial intelligence techniques such as machine learning can be used to analyze the corresponding multiple groups of log entries in the associated multiple log entry blocks to determine key information recorded in the multiple groups of log entries, and thereby determine a log block-linked pattern to identify overall information related to the multiple groups of log entries as a whole. The block-linked pattern is sometimes also referred to herein as the third pattern.

[0057] In the case where the received request also includes a second request for analyzing a first pattern and a second pattern associated with the first pattern, the processing device 135 needs to analyze multiple log entry subsets to determine the key information shared by the multiple log entry subsets. For example, when a storage system fails, multiple applications or services using the failed storage system will also experience corresponding failures or errors. Therefore, there is a need to find the root cause of the associated failure. For ease of understanding, the following will be combined with Figure 6 The processing of the second request is described in detail. Figure 6 FIG. 6 is a schematic diagram showing a process 600 of determining a third mode based on a natural language processing model 605 according to an embodiment of the present disclosure. It can be understood that the model 605 and the reference Figure 5 The described model 505 has similar structures and functions, so the description of some modules and the corresponding operations performed by them are omitted.

[0058] In some embodiments, the processing device 135 may determine a plurality of patterns having an associated relationship, for example, a first pattern and a second pattern. Figure 5 In the process described above, the processing device 135 can determine a first feature representation 647-1 corresponding to the first target log entry subset and a second feature representation 647-2 corresponding to the second target log entry subset through the feature extraction module of the natural language processing model 605. Specifically, the processing device 135 combines the first and second target log entry subsets associated with the first and second patterns to obtain first and second combined log texts. Based on the first and second combined log texts, the processing device 135 can Figure 5 A similar process as described above is used to determine the first and second feature representations for the first and second combined log texts. In some embodiments, the processing device performs the processing according to the reference Figure 5 After analyzing each subset of log entries in the process 500 , the processing device 135 may store the resulting feature representations in a storage device for direct use in the process 600 .

[0059] The processing device can then determine a third pattern 650 based on the first feature representation 647-1 and the second feature representation 647-2 for responding to the second request. In some embodiments, the first feature representation 647-1 and the second feature representation 647-2 can be sequentially spliced together to form a combined feature representation 649 in the form of a sequence. In some embodiments, the first feature representation 647-1 and the second feature representation 647-2 can form a higher-dimensional combined feature representation 649. Other technologies that can combine multiple feature representations together are also applicable. Similarly, the combined feature representation 649 can be input into the classifier module 650, and the module 550 is configured to determine a third pattern based on the combined feature representation 649, and thereby determine a third pattern that is related to both the first pattern and the second pattern. Similar to reference Figure 5 Examples of the described classifier modules 550 and 650 also include, but are not limited to, classifiers based on logistic regression algorithms, and / or decision tree algorithms, and / or ensemble learning, with the difference being that the dimensions or forms of the input data they can process are different. In some embodiments, the classifier module 650 can be a combined ensemble learning classifier.

[0060] The pattern characteristic information of the third pattern identifies key information in the content recorded in both the first target log entry subset and the second target log entry subset. The pattern characteristic information of the third pattern can be the root cause of the log entries recorded in the first and second target log entry subsets (and additionally, other associated target log entry subsets) associated with the first pattern (e.g., related to a failure of a first application or service) and the second pattern (e.g., related to a failure of a second application or service different from the first application or service), such as a specific failure or error of the storage system.

[0061] Although the third mode is determined by two feature representations 647-1 and 647-2 in this embodiment, it will be understood that the present disclosure does not limit the number of feature representations, and three or more feature representations can also be used to form a combined feature representation for determining the third mode.

[0062] Since the pattern characteristic information of the third pattern identifies the key information in the content recorded by two or more patterns, in this way, multiple associated patterns can be analyzed to obtain key information that can characterize the multiple patterns, and thereby determine the third pattern (i.e., the log block linking pattern), so as to facilitate the subsequent execution of corresponding operations based on the key information.

[0063] 7A to 7C A table showing rules for rating log processing processes according to an embodiment of the present disclosure is shown. Figure 7ATable 710 shows rules for rating the maturity of log files or log entries (sometimes collectively referred to as logs in this embodiment) according to an embodiment of the present disclosure. Maturity can be scored based on rules in four dimensions. The four dimensions include the analyzability of logs such as shown in Table 710 (for example, the analyzability of the text recorded in the log and / or the format recorded in the log, and the ability to locate the cause of defects or failures), maintainability (for example, the repairability of defects or failures or the improvability of existing functions), security, and supportability (for example, compatibility and extensibility). Log maturity can represent the degree of standardization of the log, and standardized logs are the basis for subsequent log analysis processes.

[0064] It will be appreciated that while only four dimensions of scoring are shown for maturity rating, rules for more or fewer dimensions may be provided as needed. While each dimension is shown as being divided into three levels based on two score thresholds, more score thresholds may be provided to create more levels, or different score thresholds may be provided as needed. This disclosure is not intended to be limiting.

[0065] Figure 7B Table 720 shows rules for rating the confidence of a log analysis process according to an embodiment of the present disclosure. Confidence can be scored based on rules across five dimensions. This confidence can indicate the accuracy of the analysis process. For each dimension, one or more rules can be set for scoring. The five dimensions include a speed dimension, such as that shown in Table 720. Scoring rules for the speed dimension include, but are not limited to, the speed of response to processing requests during the log analysis process.

[0066] The five dimensions also include a source dimension such as shown in Table 720, and the scoring rules for the source dimension include but are not limited to support for analysis of logs from distributed systems (such as Kubernetes) and / or support for analysis of application or service logs (such as container services).

[0067] The five dimensions also include a search dimension such as shown in Table 720, the scoring rules of which include but are not limited to support for basic query syntax, and / or support for complex query syntax (e.g., combined syntax), and / or support for time-based filters.

[0068] The five dimensions also include a scalability dimension such as that shown in Table 720. Scoring rules for the scalability dimension include, but are not limited to, support for incremental log analysis, and / or support for log bursts (i.e., a large number of logs added within a predetermined time period), and / or support for cloud-scale logs, and / or support for TB-sized log data.

[0069] The five dimensions also include an advanced analysis dimension such as that shown in Table 720, and the scoring rules of the advanced analysis dimension include but are not limited to support for contemporary logging, and / or support for monitoring of potential log sources, and / or support for alarming and auditing of potential problems, and / or support for analysis of the root causes of failures, and / or support for streamlined reporting and dashboard reporting.

[0070] It will be appreciated that while only five dimensions are shown for scoring maturity ratings, more or fewer dimensions can be used as needed. While each dimension is shown as being divided into three levels based on two score thresholds, more score thresholds can be used to divide the data into more levels, or different score thresholds can be used as needed. The present disclosure for each dimension is not limited to this.

[0071] Figure 7C Table 730 shows rules for comprehensively rating log analysis results according to an embodiment of the present disclosure. Since both the confidence of the log analysis process and the maturity of the logs affect the accuracy of the final analysis results, a comprehensive evaluation can be obtained from these two dimensions to determine the confidence of the final analysis results.

[0072] For example, if the log maturity level and confidence level are both level three, the accuracy of the final analysis result can be determined to be level three; if the log maturity level is level three, but the confidence level is level two, the accuracy of the final analysis result can be determined to be level two (i.e., the lower level between the two).

[0073] Based on 7A to 7C The computing device 105 can determine at least one of the above two levels based on the table in FIG. In some embodiments, corresponding monitoring parameter thresholds can be set for the score thresholds of the various rules shown in the above table, and the computing device 105 can obtain parameters associated with log files and log entries, for example, in a real-time monitoring manner, and compare them with the corresponding monitoring parameter thresholds to obtain corresponding scores, and determine the corresponding level based on the obtained scores.

[0074] In some embodiments, a computing device may determine, based on a set of log entries, at least one first performance metric for characterizing the set of log entries, the at least one first performance metric indicating at least one of the following: analyzability, maintainability, security, and supportability. The computing device may also determine, based on parameters collected during the log processing process and related to the processing, at least one second performance metric for characterizing confidence in the log processing process, the second performance metric indicating at least one of the following: speed, queryability, scalability, supportability for different log sources, and ability to perform advanced analysis on the log processing process. Based on the at least one first performance metric and the at least one second performance metric, the computing device may perform adjustments to at least one of the set of log entries and the processing to optimize the at least one item. Adjustments include, but are not limited to: modifying the format in which the set of log entries is recorded; modifying the content recorded by each (type) of log entries in the set of log entries; adjusting one or more nodes of a hierarchical data structure and their associated log entries; and parameters used in the various processing and analysis processes described above.

[0075] Figure 8 8 is a schematic block diagram of an example electronic device 800 that can be used to implement an embodiment of the present disclosure. For example, the electronic device 800 can be used to implement Figure 1 800. As shown in the figure, the electronic device 800 includes a central processing unit (CPU) 801, which can perform various appropriate actions and processes according to computer program instructions stored in a read-only memory (ROM) 802 or computer program instructions loaded from a storage unit 808 into a random access memory (RAM) 803. In the RAM 803, various programs and data required for the operation of the device 800 can also be stored. The CPU 801, ROM 802, and RAM 803 are connected to each other via a bus 804. An input / output (I / O) interface 805 is also connected to the bus 804.

[0076] Various components in device 800 are connected to I / O interface 805, including an input unit 806, such as a keyboard, mouse, etc.; an output unit 807, such as various types of displays, speakers, etc.; a storage unit 808, such as a magnetic disk, optical disk, etc.; and a communication unit 809, such as a network card, modem, wireless communication transceiver, etc. The communication unit 809 allows device 800 to exchange information / data with other devices via a computer network such as the Internet and / or various telecommunication networks.

[0077] The processing unit 801 performs the various methods and processes described above, such as processes 200, 400, 500, and 600. For example, in some embodiments, the various methods and processes described above can be implemented as a computer software program or computer program product, which is tangibly contained in a machine-readable medium, such as a storage unit 808. In some embodiments, part or all of the computer program can be loaded and / or installed on the device 800 via the ROM 802 and / or the communication unit 809. When the computer program is loaded into the RAM 803 and executed by the CPU 801, one or more steps in any of the processes described above can be performed. Alternatively, in other embodiments, the CPU 801 can be configured to perform processes such as processes 200, 400, 500, and 600 by any other appropriate means (e.g., by means of firmware).

[0078] The present disclosure may be a method, an apparatus, a system and / or a computer program product. The computer program product may include a computer-readable storage medium carrying computer-readable program instructions for executing various aspects of the present disclosure.

[0079] A computer-readable storage medium may be a tangible device that can hold and store instructions used by an instruction execution device. A computer-readable storage medium may be, for example, but not limited to, an electrical storage device, a magnetic storage device, an optical storage device, an electromagnetic storage device, a semiconductor storage device, any non-transitory storage device, or any suitable combination of the foregoing. More specific examples (a non-exhaustive list) of computer-readable storage media include: a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), a static random access memory (SRAM), a portable compact disc read-only memory (CD-ROM), a digital versatile disk (DVD), a memory stick, a floppy disk, a mechanical encoding device, such as a punch card or a raised structure in a groove on which instructions are stored, and any suitable combination of the foregoing. As used herein, a computer-readable storage medium is not to be construed as a transient signal per se, such as a radio wave or other freely propagating electromagnetic wave, an electromagnetic wave propagating through a waveguide or other transmission medium (e.g., a light pulse through a fiber optic cable), or an electrical signal transmitted through an electrical wire.

[0080] The computer-readable program instructions described herein can be downloaded from a computer-readable storage medium to each computing / processing device, or downloaded to an external computer or external storage device via a network, such as the Internet, a local area network, a wide area network, and / or a wireless network. The network can include copper transmission cables, fiber optic transmission, wireless transmission, routers, firewalls, switches, gateway computers, and / or edge servers. The network adapter card or network interface in each computing / processing device receives the computer-readable program instructions from the network and forwards the computer-readable program instructions to be stored in the computer-readable storage medium in each computing / processing device.

[0081] The computer program instructions for performing the operations of the present disclosure may be assembly instructions, instruction set architecture (ISA) instructions, machine instructions, machine-dependent instructions, microcode, firmware instructions, state setting data, or source code or object code written in any combination of one or more programming languages, including object-oriented programming languages such as Smalltalk, C++, and conventional procedural programming languages such as "C" language or similar programming languages. Computer-readable program instructions may be executed entirely on a user's computer, partially on a user's computer, as an independent software package, partially on a user's computer, partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer via any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., utilizing an Internet service provider to connect via the Internet). In some embodiments, an electronic circuit, such as a programmable logic circuit, a field programmable gate array (FPGA), or a programmable logic array (PLA), may be personalized by utilizing the state information of the computer-readable program instructions. The electronic circuit may execute the computer-readable program instructions, thereby realizing various aspects of the present disclosure.

[0082] Various aspects of the present disclosure are described herein with reference to flowcharts and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the present disclosure. It should be understood that each block of the flowcharts and / or block diagrams, and combinations of blocks in the flowcharts and / or block diagrams, can be implemented by computer-readable program instructions.

[0083] These computer-readable program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, or other programmable data processing device, thereby producing a machine such that when these instructions are executed by the processing unit of the computer or other programmable data processing device, a device is generated that implements the functions / actions specified in one or more blocks in the flowchart and / or block diagram. These computer-readable program instructions can also be stored in a computer-readable storage medium, where these instructions cause the computer, programmable data processing device, and / or other device to operate in a specific manner. Thus, the computer-readable medium storing the instructions comprises an article of manufacture that includes instructions for implementing various aspects of the functions / actions specified in one or more blocks in the flowchart and / or block diagram.

[0084] Computer-readable program instructions may also be loaded onto a computer, other programmable data processing apparatus, or other device so that a series of operational steps are performed on the computer, other programmable data processing apparatus, or other device to produce a computer-implemented process, thereby causing the instructions executed on the computer, other programmable data processing apparatus, or other device to implement the functions / actions specified in one or more blocks in the flowchart and / or block diagram.

[0085] The flow charts and block diagrams in the accompanying drawings show the possible architecture, functions and operations of the systems, methods and computer program products according to multiple embodiments of the present disclosure. In this regard, each box in the flow chart or block diagram can represent a part of a module, program segment or instruction, and the part of the module, program segment or instruction contains one or more executable instructions for realizing the prescribed logical function. In some alternative implementations, the functions marked in the box can also occur in a sequence different from that marked in the accompanying drawings. For example, two consecutive boxes can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart can be implemented by a dedicated hardware-based system that performs the prescribed function or action, or can be implemented by a combination of dedicated hardware and computer instructions.

[0086] The embodiments of the present disclosure have been described above. The above description is exemplary, not exhaustive, and is not limited to the disclosed embodiments. Many modifications and variations will be apparent to those skilled in the art without departing from the scope and spirit of the described embodiments. The terminology used herein is selected to best explain the principles of the embodiments, practical applications, or improvements to the technology in the market, or to enable other persons skilled in the art to understand the embodiments disclosed herein.

Claims

1. A method for obtaining a hierarchical data structure for storing log entries, comprising: receiving a request for processing a target log entry; The hierarchical data structure can be obtained by: Obtain corresponding feature information included in each log entry of a set of log entries; determining a plurality of log entry patterns based on the corresponding characteristic information, wherein pattern characteristic information of each log entry pattern corresponds to characteristic information of a subset of log entries in the set of log entries; as well as storing the set of log entries in a hierarchical data structure such that each log entry is associated with at least one node of a plurality of nodes of the hierarchical data structure, the plurality of nodes corresponding to the plurality of log entry patterns, respectively, and the plurality of nodes being organized hierarchically based on the respective corresponding log entry patterns, and wherein the request comprises a first request to analyze a first node of the plurality of nodes; as well as processing the target log entry based on the hierarchical data structure, wherein the processing comprises: determining a first target subset of log entries associated with the first node; and Determining, based on the first target log entry subset and using a natural language processing model, a first pattern associated with the first target log entry subset for responding to the first request by: combining target log entries in the first target log entry subset to obtain a first combined log text; Determining a first feature representation for the first combined log text using the natural language processing model; and determining the first pattern by using the first feature representation as an input to a classifier module; wherein the first pattern comprises key information in the first target log entry subset, and wherein the natural language processing model comprises a pre-trained neural network; and Redundant information recorded in the first target subset of log entries is removed based on the first pattern. 2 . The method of claim 1 , wherein in the hierarchical data structure, each log entry is associated with at least a top node, the top node being located in a top level of the hierarchical data structure. 3 . The method of claim 2 , wherein each log entry is further associated with a branch node, the branch node being located at a level lower than the top level in the hierarchical data structure, and the branch node being associated with the top node.

4. The method according to claim 1, further comprising: In response to receiving a log entry to be stored, determining first characteristic information of the log entry to be stored; Determining at least one target node based on the first feature information, wherein pattern feature information corresponding to the at least one target node matches the first feature information; as well as The log entry to be stored is stored in association with the at least one target node.

5. The method of claim 4, wherein determining the at least one target node comprises: determining, based on the first characteristic information, a branch node located in a bottom layer of the hierarchical data structure, and matching pattern characteristic information associated with the determined branch node with the first characteristic information; Based on the hierarchical data structure, determining a top node located in a top level of the hierarchical data structure and associated with the determined branch node; as well as If the first feature information matches the pattern feature information associated with the top node, the branch node and the top node are determined as target nodes.

6. The method according to claim 5, further comprising: If the first characteristic information does not match the pattern characteristic information associated with the top node, storing the log entry to be stored in a cache; In response to the log entries to be stored in the cache reaching a predetermined number, clustering the predetermined number of log entries to be stored to determine additional pattern feature information; as well as creating an additional top node in the hierarchical data structure based on the additional pattern characteristic information, the additional top node corresponding to the additional log entry pattern determined based on the additional pattern characteristic information; and The branch node and the additional top node are determined as target nodes.

7. The method according to claim 1, wherein obtaining the characteristic information comprises: identifying a format in which the set of log entries are recorded; Based on the identified format, determining a predetermined rule for extracting the corresponding feature information; as well as Based on the predetermined rule, the corresponding feature information is extracted.

8. The method of claim 1 , wherein the request comprises a query request related to at least a target log entry pattern, and processing the target log entry comprises: determining at least one target node among the plurality of nodes that matches the target log entry pattern; as well as A target log entry associated with the at least one target node is determined from the set of log entries for use in responding to the query request.

9. The method according to claim 1 , wherein the request further comprises a second request for analyzing the first pattern and a second pattern having an association relationship with the first pattern, and processing the target log entry further comprises: combining a second target log entry subset associated with the second pattern to obtain a second combined log text; Determine a second feature representation for the second combined log text using the natural language processing model; as well as Based on the first feature representation and the second feature representation, a third pattern is determined for responding to the second request, wherein pattern feature information of the third pattern identifies key information in the content recorded by both the first target log entry subset and the second target log entry subset.

10. An electronic device comprising: processor; as well as A memory coupled to the processor, the memory having instructions stored therein, the instructions causing the electronic device to perform actions when executed by the processor, the actions comprising: receiving a request for processing a target log entry; Acquiring a hierarchical data structure at the electronic device, wherein acquiring comprises: Obtain corresponding feature information included in each log entry of a set of log entries; determining a plurality of log entry patterns based on the corresponding characteristic information, wherein the pattern characteristic information of each log entry pattern corresponds to characteristic information of a subset of the log entries in the set of log entries; and storing the set of log entries in a hierarchical data structure such that each log entry is associated with at least one node of a plurality of nodes in the hierarchical data structure, the plurality of nodes corresponding to the plurality of log entry patterns, respectively; and The plurality of nodes are organized hierarchically based on respective corresponding log entry patterns, and wherein the request comprises a first request for analyzing a first node of the plurality of nodes; and processing the target log entry based on the hierarchical data structure, wherein the processing comprises: determining a first target subset of log entries associated with the first node; and Determining, based on the first target log entry subset and using a natural language processing model, a first pattern associated with the first target log entry subset for responding to the first request by: determining a first feature representation of a first target subset of log entries; and determining the first pattern by using the first feature representation as input to a classifier module; wherein the first pattern comprises key information in the first target log entry subset, and wherein the natural language processing model comprises a pre-trained neural network; and Redundant information recorded in the first target subset of log entries is removed based on the first pattern. 11 . The electronic device of claim 10 , wherein in the hierarchical data structure, each log entry is associated with at least a top node, the top node being located in a top level of the hierarchical data structure. 12 . The electronic device of claim 11 , wherein each log entry is further associated with a branch node, the branch node being located at a level lower than the top level in the hierarchical data structure, and the branch node being associated with the top node.

13. The electronic device according to claim 10, wherein the actions further comprise: In response to receiving a log entry to be stored, determining first characteristic information of the log entry to be stored; Determining at least one target node based on the first feature information, wherein pattern feature information corresponding to the at least one target node matches the first feature information; as well as The log entry to be stored is stored in association with the at least one target node.

14. The electronic device of claim 13, wherein determining the at least one target node comprises: determining, based on the first characteristic information, a branch node located in a bottom layer of the hierarchical data structure, and matching pattern characteristic information associated with the determined branch node with the first characteristic information; Based on the hierarchical data structure, determining a top node located in a top level of the hierarchical data structure and associated with the determined branch node; as well as If the first feature information matches the pattern feature information associated with the top node, the branch node and the top node are determined as target nodes.

15. The electronic device according to claim 14, wherein the actions further comprise: If the first characteristic information does not match the pattern characteristic information associated with the top node, storing the log entry to be stored in a cache; In response to the log entries to be stored in the cache reaching a predetermined number, clustering the predetermined number of log entries to be stored to determine additional pattern feature information; as well as creating an additional top node in the hierarchical data structure based on the additional pattern characteristic information, the additional top node corresponding to the additional log entry pattern determined based on the additional pattern characteristic information; and The branch node and the additional top node are determined as target nodes.

16. The electronic device according to claim 10, wherein acquiring the characteristic information comprises: identifying a format in which the set of log entries are recorded; Based on the identified format, determining a predetermined rule for extracting the corresponding feature information; as well as Based on the predetermined rule, the corresponding feature information is extracted.

17. The electronic device of claim 10, wherein the request comprises a query request related to at least a target log entry pattern, and processing the target log entry comprises: determining at least one target node among the plurality of nodes that matches the target log entry pattern; as well as A target log entry associated with the at least one target node is determined from the set of log entries for use in responding to the query request.

18. The electronic device according to claim 10, wherein the request further comprises a second request for analyzing the first pattern and a second pattern associated with the first pattern, and processing the target log entry further comprises: combining a second target log entry subset associated with the second pattern to obtain a second combined log text; Determine a second feature representation for the second combined log text using the natural language processing model; as well as Based on the first feature representation and the second feature representation, a third pattern is determined for responding to the second request, wherein pattern feature information of the third pattern identifies key information in the content recorded by both the first target log entry subset and the second target log entry subset.

19. A computer program product tangibly stored on a computer-readable medium and comprising machine-executable instructions which, when executed, cause a machine to perform the method according to any one of claims 1 to 9.

Images