Log diagnosis method and apparatus

Abstract

The application provides a log diagnosis method and device, the method comprises the following steps: collecting log data to form a log object; splitting the log object into multiple log blocks based on preset splitting parameters; extracting information from each log block based on a preset log diagnosis knowledge base to obtain key information of each log block and determine a solution for each log block; wherein the key information at least includes error information; and obtaining a diagnosis result of the log object according to the key information of each log block and the solution for each log block. By collecting scattered log data to form a log object and splitting the log object into more easily processed log blocks, analyzing the log blocks based on a log diagnosis knowledge base to obtain key information including error information and a solution, the diagnosis result of the log object can be quickly obtained without manual processing, thereby improving the diagnosis efficiency and providing a log diagnosis result in a timely manner.

Description

Technical Field

[0001] This invention relates to the field of log processing technology, and in particular to a log diagnosis method and apparatus. Background Technology

[0002] During system development and maintenance, a large number of logs are generated. Logs are crucial for development and maintenance personnel to analyze data and locate problems. Traditional log services only provide log collection, parsing, and querying services. If log diagnosis is required, it relies on the experience of human experts, which requires a lot of manpower and is time-consuming and labor-intensive. Moreover, in a distributed environment, logs are not only scattered, but the log content itself is also just plain text strings, resulting in low diagnostic efficiency and the inability to provide log diagnostic results in a timely manner. Summary of the Invention

[0003] The purpose of this invention is to provide a log diagnostic method, apparatus, computer device, computer-readable storage medium, and computer program product that can provide log diagnostic results in a timely manner.

[0004] In a first aspect, the present invention provides a log diagnostic method, comprising:

[0005] Collect log data and create log objects;

[0006] Based on preset splitting parameters, the log object is split into multiple log blocks;

[0007] Based on a pre-set log diagnostic knowledge base, information is extracted from each log block to obtain key information for each log block, and a solution for each log block is determined; the key information includes at least error information.

[0008] Based on the key information and solutions for each log block, diagnostic results for the log object are obtained.

[0009] In a second aspect, the present invention provides a log diagnostic device, comprising:

[0010] The log collection module is used to collect log data and form log objects.

[0011] The log splitting module is used to split the log object into multiple log blocks based on preset splitting parameters;

[0012] The knowledge base matching module is used to extract information from each log block based on a preset log diagnosis knowledge base to obtain key information for each log block and determine a solution for each log block; the key information includes at least error information.

[0013] The log diagnostic module is used to obtain diagnostic results for log objects based on the key information and solutions for each log block.

[0014] Thirdly, the present invention provides a computer device, including a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor executes the computer program to implement the log diagnosis method as described above.

[0015] Fourthly, the present invention provides a computer-readable storage medium storing a computer program that performs the above-described log diagnostic method in response to execution of the computer program by a processor.

[0016] Fifthly, the present invention provides a computer program product comprising a computer program that, when executed by a processor, implements the log diagnosis method as described above.

[0017] The log diagnosis method provided in this invention collects log data to form a log object; based on preset splitting parameters, the log object is split into multiple log blocks; based on a preset log diagnosis knowledge base, information is extracted from each log block to obtain key information for each log block, and a solution for each log block is determined; wherein, the key information includes at least error information; based on the key information and the solution for each log block, a diagnosis result for the log object is obtained. By collecting scattered log data to form a log object and splitting it into more easily processed log blocks, and analyzing the log blocks based on the log diagnosis knowledge base to obtain key information including error information and solutions, the diagnosis result of the log object can be quickly obtained without manual processing, thereby improving diagnosis efficiency and providing timely log diagnosis results. Attached Figure Description

[0018] The following figures are intended only to illustrate and explain the present invention and do not limit the scope of the invention. Wherein:

[0019] Figure 1 This is a schematic flowchart of the log diagnosis method according to an embodiment of the present invention;

[0020] Figure 2 This is a schematic diagram illustrating the implementation process of step 101 in a specific embodiment of the present invention;

[0021] Figure 3 This is a schematic diagram illustrating the implementation process of step 102 in a specific embodiment of the present invention;

[0022] Figure 4 This is a schematic diagram illustrating the implementation process of step 103 in a specific embodiment of the present invention;

[0023] Figure 5 This is a schematic flowchart of a log diagnosis method according to a specific embodiment of the present invention;

[0024] Figure 6 This is a schematic diagram of the log diagnostic device in an embodiment of the present invention;

[0025] Figure 7 This is a schematic diagram of the log diagnostic device in a specific embodiment of the present invention;

[0026] Figure 8 This is a schematic diagram of the log diagnostic device in another specific embodiment of the present invention;

[0027] Figure 9 This is a schematic diagram of the structure of a computer device according to an embodiment of the present invention. Detailed Implementation

[0028] The present application will now be described in further detail with reference to the accompanying drawings and embodiments. Through these descriptions, the features and advantages of the present application will become clearer and more apparent.

[0029] The term “exemplary” as used herein means “serving as an example, embodiment, or illustration.” Any embodiment illustrated herein as “exemplary” is not necessarily to be construed as superior to or better than other embodiments. Although various aspects of embodiments are shown in the accompanying drawings, the drawings are not necessarily drawn to scale unless specifically indicated otherwise.

[0030] Furthermore, the technical features involved in the different embodiments of this application described below can be combined with each other as long as they do not conflict with each other.

[0031] This invention provides a log diagnostic method to provide timely log diagnostic results, such as... Figure 1 As shown, it includes:

[0032] Step 101: Collect log data and create log objects;

[0033] When implementing step 101, the implementation process is as follows: Figure 2 As shown, it includes:

[0034] Step 201: Receive log data in file format uploaded by the network application interface;

[0035] Step 202: Listen to the server's log content and obtain log data in line format;

[0036] Step 203: Based on the file ID of the log data, associate and merge the log data into a log object.

[0037] In practical implementation, to handle both line-based and file-based logs simultaneously, this invention provides two log collection methods. The first method involves receiving log content actively uploaded and appended via a Web Application Programming Interface (Web API), supporting both file streams and text formats, primarily for file-based log data. The second method utilizes LogAgent (an open-source log collection tool) to monitor log files on the server and reports the monitored log content to the log service, primarily for line-based log data. In practice, log data uploads may occur in batches, meaning log data uploaded at different times may be related. In this case, log data with the same file ID can be associated and merged into a single log object based on the file ID, allowing related log data to be processed together and facilitating viewing by operators. The file ID is an identifier automatically assigned to log files by the log system based on the application system and file directory to distinguish different log files.

[0038] In specific embodiments, the collected log data generally conforms to log specifications. Specifically, log levels are divided into [WARN], [ERROR], and [INFO]; console ANSI (outputting characters of various colors through the console) color highlighting is supported; log exceptions and errors are identified by indicators such as Error and Failure; and log content is composed in chronological order.

[0039] Step 102: Based on the preset splitting parameters, split the log object into multiple log blocks;

[0040] In practice, after a log object is formed, the text content of the log object is split according to preset splitting parameters. For example, it can be the log extraction rules entered by the user in the log service, such as the log content between the 3rd "," and the 5th "["; or it can be the log specification in the standard component (a specification formed by some commonly used log splitting rules), and a log object is split into several log blocks.

[0041] In a specific embodiment, to facilitate the differentiation of log blocks, step 102 is implemented as follows: Figure 3 As shown, it includes:

[0042] Step 301: Split the log object into multiple log blocks according to the preset splitting parameters;

[0043] Step 302: Calculate the hash value of each log block and use the hash value of each log block as the identifier of each log block.

[0044] Since hash values ​​are unique, using the hash value of each log block as an identifier can distinguish multiple log blocks and facilitate quick location of log blocks in subsequent use.

[0045] In a specific embodiment, newly added unprocessed log content is placed in memory in real time according to time order and processed in chronological order. If a segmentation rule is matched, the current log content in the cache, offset (character displacement), and hash value are combined to form a log block and stored in object storage. Multiple log blocks form a log object. In order to improve the efficiency of log analysis, log summarization is performed at the log block level. Important information such as log lines at the beginning and end of the log block and error messages are retained, while other information is abbreviated or hidden. Only the number of hidden lines and characters is displayed, thereby reducing the signal-to-noise ratio.

[0046] In practice, when splitting log blocks, they can be divided into problematic log blocks and non-problematic log blocks based on error information. To further improve the efficiency of log diagnosis, only problematic log blocks need to be processed when implementing steps 103 and 104.

[0047] Step 103: Based on the preset log diagnosis knowledge base, extract information from each log block to obtain the key information of each log block and determine the solution for each log block; wherein, the key information includes at least error information;

[0048] In practice, the aforementioned log diagnostic knowledge base is pre-built, including multiple rules and corresponding solutions for each rule. Generally, based on common log errors, the rules corresponding to the errors and the solutions for each type of error can be extracted, and the knowledge base can be built according to their correspondence. The knowledge base typically contains multiple pieces of knowledge, each of which is a unit describing a problem, a solution, and a matching rule.

[0049] Accordingly, the specific implementation process of step 103 is as follows: Figure 4 As shown, it includes:

[0050] Step 401: Based on multiple rules in the log diagnostic knowledge base, perform feature matching on the content of each log block to determine the rules in the log diagnostic knowledge base that match each log block, and extract the key information of each log block;

[0051] Step 402: Determine the solution for each log block based on the rules that match each log block.

[0052] In a specific embodiment, in addition to error information, the key information also includes: basic information, environment information, and step information. The basic information refers to information such as the application to which the log belongs and the file directory; the environment information refers to information such as the server IP, system information, and environment variables of the log; and the step information refers to the key log information that the log system analyzes and extracts from the split log blocks, which serves as the step information of the log.

[0053] In the specific implementation of step 401, based on multiple rules in the log diagnostic knowledge base, the content of each log block can be matched using features such as regular expressions, keywords, or similarity. The specific method can be selected according to actual needs.

[0054] Because the log diagnostic knowledge base can only encompass a limited number of rules when pre-built, there may be situations where feature matching of a log block's content is performed based on multiple rules from the knowledge base, and it's impossible to determine which rule in the knowledge base matches the log block. In such cases, the log diagnostic method provided in the specific implementation, such as... Figure 5 As shown, in Figure 1 In addition to this, it also includes:

[0055] Step 501: Perform knowledge mining on the log block to obtain the rules corresponding to the log block;

[0056] Step 502: After verifying the validity of the rule corresponding to the log block, determine the solution corresponding to the rule and enter the rule and the solution corresponding to the rule into the log diagnostic knowledge base.

[0057] Specifically, the implementation process of step 501 includes:

[0058] The log block is preprocessed to obtain a preprocessed log block.

[0059] Feature extraction and similarity calculation are performed on the preprocessed log blocks to obtain the key information of the log blocks;

[0060] Cluster analysis is performed on the key information of this log block to obtain the corresponding rules.

[0061] In specific embodiments, the preprocessing process generally includes: deleting invisible special characters, such as newline characters; removing irrelevant or duplicate log content; expanding the keywords of the log content using synonyms; segmenting and word-segmenting the log content of the log block; and processing the English tenses to place them under the same tense because the recognition results of different tenses are inconsistent due to the presence of English in the log content.

[0062] Next, the key content of the preprocessed log block is extracted using the TF-IDF (Term Frequency-Inverse Document Frequency) method, and Word2vec (a group of related models used to generate word vectors) is used to vectorize the extracted key content to obtain the word vectors of the key content of the log block.

[0063] Based on the word vectors obtained above, the doc2vec algorithm is used to determine the sentence vectors of the key content of the log block. Then, the cosine similarity between any two vectors is calculated based on these sentence vectors. In practice, the BERT model (Bidirectional Encoder Representation from Transformers) can also be used for feature extraction and similarity calculation of the key content; this is not a limitation here.

[0064] Cosine similarity is used as the distance algorithm, and the DNSCAN density clustering model is used for cluster analysis. This involves calculating the distance between each pair of nodes in a cluster, finding the centroid as the representative of the cluster, and thus identifying the representative of the group to determine the rule corresponding to the log block. In practice, other unsupervised models or classification models can also be used instead of the cluster analysis model; no specific limitation is made here.

[0065] After determining the rules corresponding to a log block through knowledge mining, it is necessary to verify whether the rules corresponding to the log block are valid. After the operator verifies that the rules corresponding to the log block are valid, the corresponding solution is determined and entered into the log diagnostic knowledge base along with the mined rules to evolve the knowledge base and continuously improve the accuracy and efficiency of diagnosis.

[0066] Step 104: Based on the key information of each log block and the solution for each log block, obtain the diagnostic results for the log object.

[0067] In a specific embodiment, after determining the key information and solution for each log block through knowledge base matching, a diagnostic result for a log object can be obtained by following the order of the log blocks.

[0068] In a specific embodiment, to more intuitively display the diagnostic results and facilitate subsequent review or data retrieval, the provided log diagnostic method further includes storing the identifier, key information, and solution of each log block in a database using key-value pairs. Specifically, since the file IDs corresponding to log blocks under the same log object are consistent, the file ID is used as the key in the database, and the identifiers of the multiple log blocks contained therein are stored as values. Then, using the identifier of a log block as the key, the key information, solution, and specific log content of that log block are stored as the value corresponding to this key. Through the key-value pair storage method, the diagnostic results of the log object can be clearly displayed.

[0069] Depend on Figure 1As can be seen from the steps described, the log diagnosis method provided in this embodiment of the invention involves: collecting log data to form a log object; splitting the log object into multiple log blocks based on preset splitting parameters; extracting key information from each log block based on a preset log diagnosis knowledge base to determine a solution for each log block; wherein the key information includes at least error information; and obtaining the diagnosis result of the log object based on the key information and the solution for each log block. By collecting scattered log data to form a log object and splitting it into more easily processed log blocks, and analyzing the log blocks based on the log diagnosis knowledge base to obtain key information including error information and solutions, the diagnosis result of the log object can be obtained quickly without manual processing, thereby improving diagnosis efficiency and providing timely log diagnosis results.

[0070] To address the problems of scattered logs, high information noise, low problem-solving efficiency, and lack of automated diagnosis in existing systems, the log diagnosis method provided in this invention offers multiple log collection methods, enabling diagnosis of both line-based and file-based logs. Compared to solutions that can only diagnose lines, this method processes the entire DevOps process, allowing for diagnosis based on context. Through association, merging, segmentation, parsing, and analysis of log data, the logs are divided into a hierarchical structure progressively from log objects to log blocks to key information (basic information, environmental information, error information, etc.). Furthermore, by matching a knowledge base to determine solutions, it provides automated problem localization capabilities, eliminating the need for significant manual input. Simultaneously, the key-value pair data storage method enables structured display of diagnostic results, using log block summaries to show only key content, improving log display efficiency. Moreover, by utilizing automated knowledge base mining techniques to continuously evolve the knowledge base, the cost of using the diagnostic method is reduced, and diagnostic efficiency is continuously improved.

[0071] Based on the same inventive concept, embodiments of the present invention also provide a log diagnostic device, the principle of which is similar to the log diagnostic method, and the repeated parts will not be described again. The specific structure is as follows: Figure 6 As shown, it includes:

[0072] Log collection module 601 is used to collect log data and form log objects;

[0073] Log splitting module 602 is used to split a log object into multiple log blocks based on preset splitting parameters;

[0074] The knowledge base matching module 603 is used to extract information from each log block based on a preset log diagnosis knowledge base to obtain key information for each log block and determine a solution for each log block; wherein, the key information includes at least error information.

[0075] The log diagnostic module 604 is used to obtain diagnostic results for log objects based on the key information and solutions for each log block.

[0076] In specific implementation, the log collection module 601 is used for:

[0077] Receive log data in file format uploaded via a web application programming interface;

[0078] Listen to the server's log content and obtain log data in line format;

[0079] Log data is associated and merged into a log object based on the file ID of the log data.

[0080] In a specific embodiment, the log splitting module 602 is specifically used for:

[0081] The log object is split into multiple log blocks according to the preset splitting parameters;

[0082] Calculate the hash value of each log block and use the hash value of each log block as its identifier.

[0083] In practical implementation, the log diagnostic knowledge base is pre-built, including multiple rules and the corresponding solutions for each rule. Accordingly, the knowledge base matching module 603 is specifically used for:

[0084] Based on multiple rules in the log diagnostic knowledge base, feature matching is performed on the content of each log block to determine the rules in the log diagnostic knowledge base that match each log block, and the key information of each log block is extracted.

[0085] The solution for each log block is determined based on the rules that match each log block.

[0086] In a specific embodiment, the key information also includes: basic information, environmental information, and step information.

[0087] Based on multiple rules in the log diagnostic knowledge base, feature matching is performed on the content of log blocks. If no matching rule in the log diagnostic knowledge base can be determined for the log block, the log diagnostic device provided in the specific implementation, such as... Figure 7 As shown, in Figure 6 In addition, it also includes: Knowledge Base Mining Module 701, used for:

[0088] Perform knowledge mining on this log block to obtain the rules corresponding to this log block;

[0089] After verifying the validity of the rule corresponding to the log block, determine the solution corresponding to the rule and enter the rule and the solution corresponding to the rule into the log diagnostic knowledge base.

[0090] In a specific embodiment, the knowledge base mining module 701 is specifically used for:

[0091] The log block is preprocessed to obtain a preprocessed log block.

[0092] Feature extraction and similarity calculation are performed on the preprocessed log blocks to obtain the key information of the log blocks;

[0093] Cluster analysis is performed on the key information of this log block to obtain the corresponding rules.

[0094] In specific embodiments, to more intuitively display the diagnostic results and facilitate subsequent review or data retrieval, such as... Figure 8 The log diagnostic device shown is in Figure 6 In addition to this, it also includes:

[0095] Data storage module 801 is used for:

[0096] The identifier, key information, and solution for each log block are stored in the database as key-value pairs.

[0097] This invention also provides a computer device. Figure 9 This is a schematic diagram of a computer device in an embodiment of the present invention. This computer device is capable of implementing all steps in the log diagnosis method described in the above embodiments. Specifically, the computer device includes the following components:

[0098] Processor 901, memory 902, communications interface 903, and communication bus 904;

[0099] The processor 901, memory 902, and communication interface 903 communicate with each other through the communication bus 904; the communication interface 903 is used to realize information transmission between related devices.

[0100] The processor 901 is used to call the computer program in the memory 902, and when the processor executes the computer program, it implements the log diagnosis method in the above embodiment.

[0101] This invention also provides a computer-readable storage medium storing a computer program that performs the above-described log diagnostic method in response to the computer program being executed by a processor.

[0102] This invention also provides a computer program product, which includes a computer program that, when executed by a processor, implements the above-described log diagnosis method.

[0103] While this invention provides the method operation steps as described in the embodiments or flowcharts, more or fewer operation steps may be included based on conventional or non-inventive labor. The order of steps listed in the embodiments is merely one possible execution order among many and does not represent the only possible execution order. In actual device or client product execution, the methods shown in the embodiments or drawings can be executed sequentially or in parallel (e.g., in a parallel processor or multi-threaded processing environment).

[0104] Those skilled in the art will understand that the embodiments of this specification can be provided as methods, apparatus (systems), or computer program products. Therefore, the embodiments of this specification can take the form of entirely hardware embodiments, entirely software embodiments, or embodiments combining software and hardware aspects. Furthermore, the invention can take the form of a computer program product embodied on one or more computer-usable storage media (including but not limited to disk storage, CD-ROM, optical storage, etc.) containing computer-usable program code.

[0105] This invention is described with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions can be provided to a processor of a general-purpose computer, special-purpose computer, embedded processor, or other programmable data processing apparatus to produce a machine, such that the instructions, which execute via the processor of the computer or other programmable data processing apparatus, generate instructions for implementing the flowchart... Figure 1 One or more processes and / or boxes Figure 1 A device that provides the functions specified in one or more boxes.

[0106] These computer program instructions may also be stored in a computer-readable storage medium that can direct a computer or other programmable data processing device to function in a particular manner, such that the instructions stored in the computer-readable storage medium produce an article of manufacture including instruction means, which are implemented in a process Figure 1 One or more processes and / or boxes Figure 1 The function specified in one or more boxes.

[0107] These computer program instructions may also be loaded onto a computer or other programmable data processing apparatus to cause a series of operational steps to be performed on the computer or other programmable apparatus to produce a computer-implemented process, thereby providing instructions that execute on the computer or other programmable apparatus for implementing the process. Figure 1 One or more processes and / or boxes Figure 1 The steps of the function specified in one or more boxes.

[0108] The various embodiments in this specification are described in a progressive manner. Similar or identical parts between embodiments can be referred to mutually. Each embodiment focuses on describing the differences from other embodiments. In particular, the system embodiments are basically similar to the method embodiments, so the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments. In this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations.

[0109] It should be noted that, unless otherwise specified, the embodiments and features described in the present invention can be combined with each other. The present invention is not limited to any single aspect, nor to any single embodiment, nor to any combination and / or substitution of these aspects and / or embodiments. Furthermore, each aspect and / or embodiment of the present invention can be used alone or in combination with one or more other aspects and / or embodiments thereof.

[0110] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them. Although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some or all of the technical features therein. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the scope of the technical solutions of the embodiments of the present invention, and they should all be covered within the scope of the claims and specification of the present invention.

Claims

1. A log diagnostic method characterized by, include: Collect log data, and based on the file ID of the log data, associate and merge log data with the same file ID into the same log object. The file ID is used to indicate a distinguishing identifier assigned to the log file by the log system according to the application system and file directory. The log data is in file format and line format. Based on preset splitting parameters, the log object is split into multiple log blocks; Based on a pre-set log diagnostic knowledge base, information is extracted from each log block to obtain key information for each log block, and a solution for each log block is determined; the key information includes at least error information. Based on the key information and solutions for each log block, the diagnostic results for the log object are obtained; The log diagnostic knowledge base is pre-built, including multiple rules and solutions corresponding to each rule. When the key information and solutions for a log block cannot be determined based on the pre-built log diagnostic knowledge base, the method further includes: The log block is preprocessed to obtain a preprocessed log block. Feature extraction and similarity calculation are performed on the preprocessed log blocks to obtain the key information of the log blocks; Cluster analysis is performed on the key information of the log block to obtain the rules corresponding to the log block; After verifying the validity of the rule corresponding to the log block, determine the solution corresponding to the rule, and enter the rule and the solution corresponding to the rule into the log diagnostic knowledge base.

2. The log diagnostic method according to claim 1, characterized in that, Based on a pre-defined log diagnostic knowledge base, information is extracted from each log block to obtain key information for each log block, and a solution is determined for each log block, including: Based on multiple rules in the log diagnostic knowledge base, feature matching is performed on the content of each log block to determine the rules in the log diagnostic knowledge base that match each log block, and the key information of each log block is extracted. The solution for each log block is determined based on the rules that match each log block.

3. The log diagnostic method according to claim 2, characterized by, The key information also includes: basic information, environmental information, and step information.

4. The log diagnostic method according to claim 1, characterized in that, Collect log data, including: Receive log data in file format uploaded via a web application programming interface; Listen to the server's log content and obtain log data in line format.

5. The log diagnostic method according to claim 1, characterized in that, Based on preset splitting parameters, the log object is split into multiple log blocks, including: The log object is split into multiple log blocks according to the preset splitting parameters; Calculate the hash value of each log block and use the hash value of each log block as its identifier.

6. The log diagnostic method according to claim 5, characterized in that, Also includes: The identifier, key information, and solution for each log block are stored in the database as key-value pairs.

7. A log diagnostic device, characterized in that, include: The log collection module is used to collect log data. Based on the file ID of the log data, log data with the same file ID are associated and merged into the same log object. The file ID is used to indicate a distinguishing identifier assigned to the log file by the log system according to the application system and file directory. The log data is in file format and line format. The log splitting module is used to split the log object into multiple log blocks based on preset splitting parameters; The knowledge base matching module is used to extract information from each log block based on a preset log diagnosis knowledge base to obtain key information for each log block and determine a solution for each log block; the key information includes at least error information. The log diagnostic module is used to obtain diagnostic results for log objects based on the key information and solutions for each log block. The log diagnostic knowledge base is pre-built, including multiple rules and solutions corresponding to each rule. When the key information and solutions for a log block cannot be determined based on the pre-built log diagnostic knowledge base, the log diagnostic device further includes: The knowledge base mining module is used for: The log block is preprocessed to obtain a preprocessed log block. Feature extraction and similarity calculation are performed on the preprocessed log blocks to obtain the key information of the log blocks; Cluster analysis is performed on the key information of the log block to obtain the rules corresponding to the log block; After verifying the validity of the rule corresponding to the log block, determine the solution corresponding to the rule, and enter the rule and the solution corresponding to the rule into the log diagnostic knowledge base.

8. The log diagnostic device according to claim 7, characterized in that, The knowledge base matching module is used for: Based on multiple rules in the log diagnostic knowledge base, feature matching is performed on the content of each log block to determine the rules in the log diagnostic knowledge base that match each log block, and the key information of each log block is extracted. The solution for each log block is determined based on the rules that match each log block.

9. The log diagnostic device according to claim 8, characterized in that, The key information also includes: basic information, environmental information, and step information.

10. The log diagnostic device according to claim 7, characterized in that, The log collection module is used for: Receive log data in file format uploaded via a web application programming interface; Listen to the server's log content and obtain log data in line format.

11. The log diagnostic device according to claim 7, characterized in that, The log splitting module is used for: The log object is split into multiple log blocks according to the preset splitting parameters; Calculate the hash value of each log block and use the hash value of each log block as its identifier.

12. The log diagnostic device according to claim 11, characterized in that, Also includes: Data storage module, used for: The identifier, key information, and solution for each log block are stored in the database as key-value pairs.

13. A computer device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 6.

14. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores a computer program that, in response to execution by a processor, performs the operation of the log diagnostic method according to any one of claims 1 to 6.

15. A computer program product, characterized in that, The computer program product includes a computer program that, when executed by a processor, implements the log diagnostic method according to any one of claims 1 to 6.

Images