Host positioning method, device, electronic equipment and computer program product

Abstract

The present application provides a host positioning method, device, electronic device and computer program product, the method comprising: establishing a network topology of a host cluster according to the network policy and host address of each first host device in the host cluster; performing log clustering on the alarm data and log data generated by the host cluster to obtain corresponding log event templates; determining a high-frequency log event template in each log event template according to a preset condition; locating the corresponding faulty host device according to the high-frequency parameter information in the high-frequency log event template, and locating a second host device associated with the faulty host device according to the faulty host device and the network topology. The host positioning method provided in the embodiment of the present application does not require manual participation, can actively locate the faulty host device according to the log event template, and actively locate other potential problem host devices associated with the faulty host device, thereby improving the operation and maintenance efficiency of the host device.

Description

Technical Field

[0001] The present application relates to the field of data processing technology, and in particular to a host positioning method, device, electronic device and computer program product. Background Art

[0002] In the process of locating faulty host devices in large host clusters such as data collection platforms, the existing methods for locating faulty host devices are mainly manual inspection methods, that is, the alarm data and log data in the data collection platform are checked by manual inspection machine methods, and the faulty host device is located according to the inspection results, but the faulty host device cannot be actively located. In addition, when a host device in a large host cluster fails, it is usually that multiple related host devices have corresponding failures at the same time. It is difficult to actively locate other potential problem host devices associated with the faulty host device through manual inspection methods, which makes the operation and maintenance efficiency of the host device low. Summary of the invention

[0003] The present application provides a host positioning method, device, electronic device and computer program product, aiming to improve the operation and maintenance efficiency of the host device.

[0004] In a first aspect, the present application provides a host positioning method, comprising:

[0005] Establishing a network topology of the host cluster according to the network policies and host addresses of the first host devices in the host cluster;

[0006] Perform log clustering on the alarm data and log data generated by the host cluster to obtain corresponding log event templates;

[0007] Determine a high-frequency log event template among the log event templates according to a preset condition;

[0008] The corresponding faulty host device is located according to the high-frequency parameter information in the high-frequency log event template, and the second host device associated with the faulty host device is located according to the faulty host device and the network topology.

[0009] In one embodiment, the step of performing log clustering on the alarm data and log data generated by the host cluster to obtain corresponding log event templates includes:

[0010] Segmenting the alarm data and log data generated by the host cluster within a preset time period according to a time window method to obtain alarm data at multiple times and log data at multiple times;

[0011] Performing preset structured clustering according to the alarm title data in the alarm data at each of the moments and the target parameter information in the log data at each of the moments, to obtain each to-be-processed log event template and its corresponding event ID;

[0012] The log event templates to be processed corresponding to the same event ID are clustered again to obtain the corresponding log event templates.

[0013] The preset condition includes an alarm level, and the step of determining a high-frequency log event template in each of the log event templates according to the preset condition includes:

[0014] If the preset condition is the alarm level, determining whether there is a first target log event template with an alarm level greater than a preset alarm level in each log event template;

[0015] If the first target log event template exists, the first target log event template is determined as the high-frequency log event template.

[0016] The preset condition also includes the frequency of occurrence, and the step of determining the high-frequency log event template in each of the log event templates according to the preset condition also includes:

[0017] If the preset condition is the occurrence frequency, determining whether there is a second target log event template whose occurrence frequency is greater than the preset occurrence frequency in each log event template;

[0018] If the second target log event template exists, the second target log event template is determined as the high-frequency log event template.

[0019] The step of establishing the network topology of the host cluster according to the network policies and host addresses of the first host devices in the host cluster comprises:

[0020] Determine a policy type corresponding to the network policy of each of the first host devices, and cluster first host devices of the same policy type into the same sub-host cluster;

[0021] Establishing a host topology of each of the sub-host clusters according to a topology algorithm and a host address corresponding to a first host device in each of the sub-host clusters;

[0022] The network topology is established according to each of the host topologies.

[0023] The step of locating the corresponding faulty host device according to the high-frequency parameter information in the high-frequency log event template comprises:

[0024] Determining the high-frequency parameter information according to the host address occurrence frequency of each host address in the high-frequency log event template and a preset frequency threshold;

[0025] The host device corresponding to the high-frequency parameter information is determined as the faulty host device.

[0026] The step of locating a second host device associated with the faulty host device according to the faulty host device and the network topology comprises:

[0027] Determine the corresponding target sub-host cluster according to the policy type of the faulty host device;

[0028] A second host device associated with the faulty host device is located according to the host address of the faulty host device and the host topology in the target sub-host cluster.

[0029] In a second aspect, the present application further provides a host positioning device, comprising:

[0030] An establishing module, used to establish a network topology of the host cluster according to the network policy and host address of each first host device in the host cluster;

[0031] A clustering module, used for performing log clustering on the alarm data and log data generated by the host cluster to obtain corresponding log event templates;

[0032] A determination module, used to determine a high-frequency log event template among the log event templates according to a preset condition;

[0033] The positioning module is used to locate the corresponding faulty host device according to the high-frequency parameter information in the high-frequency log event template, and locate the second host device associated with the faulty host device according to the faulty host device and the network topology.

[0034] In a third aspect, the present application further provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein when the processor executes the program, the steps of the host positioning method described in the first aspect are implemented.

[0035] In a fourth aspect, the present application further provides a computer program product, wherein the computer program product comprises a computer program, and when the computer program is executed by the processor, the steps of the host positioning method described in the first aspect are implemented.

[0036] The host positioning method, device, electronic device and computer program product provided by the present application do not require manual participation in the process of locating the faulty host device. The corresponding log event template is actively clustered based on the alarm data and log data generated by the host cluster, and the high-frequency log event template in the log event template is actively queried. The faulty host device is actively located based on the high-frequency parameter information in the high-frequency log event template, thereby improving the operation and maintenance efficiency of the faulty host device. At the same time, in the process of locating other problem host devices associated with the faulty host device, other potential problem host devices associated with the faulty host device are quickly and actively located in combination with the network topology of the established host cluster, thereby improving the operation and maintenance efficiency of other potential problem host devices associated with the faulty host device. BRIEF DESCRIPTION OF THE DRAWINGS

[0037] In order to more clearly illustrate the technical solutions in the present application or the prior art, a brief introduction will be given below to the drawings required for use in the embodiments or the description of the prior art. Obviously, the drawings described below are some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative work.

[0038] Figure 1 This is one of the flow charts of the host location method provided by this application;

[0039] Figure 2 This is the second flow chart of the host positioning method provided by this application;

[0040] Figure 3 It is a structural schematic diagram of the host positioning device provided by the present application;

[0041] Figure 4 It is a structural schematic diagram of the electronic device provided by this application. DETAILED DESCRIPTION

[0042] In order to make the purpose, technical solutions and advantages of this application clearer, the technical solutions in this application will be clearly and completely described below in conjunction with the drawings in this application. Obviously, the described embodiments are part of the embodiments of this application, not all of them. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0043] Combine the following Figures 1 to 4 The present invention describes a host positioning method, device, electronic device and computer program product provided by the present application.

[0044] Specifically, the present application provides a host positioning method, referring to Figure 1 , Figure 1This is one of the flow charts of the host positioning method provided by this application.

[0045] The embodiments of the present application provide embodiments of a host positioning method. It should be noted that, although a logical order is shown in the flow chart, under certain data, the steps shown or described may be completed in an order different from that shown here.

[0046] The embodiments of the present application take an electronic device as an example of an execution subject. The embodiments of the present application take a management system as one of the manifestations of the electronic device and do not limit the electronic device.

[0047] The host positioning method provided in the embodiment of the present application includes:

[0048] Step S10: establishing a network topology of the host cluster according to the network policies and host addresses of the first host devices in the host cluster.

[0049] The management system automatically sorts out each host cluster in the data collection platform at preset intervals, that is, obtains the network policy and host address of each host device running in each host cluster, wherein the preset duration is set according to the actual situation. It should be noted that there are multiple large host clusters in a data collection platform. This embodiment takes one of the host clusters as an example, and the other host clusters are handled similarly.

[0050] Specifically, the management system automatically establishes a controller at a preset time interval, obtains the information of the connection point through the switch to obtain the various first host devices running in the host cluster within the preset time and their corresponding related information, the related information includes but is not limited to the host name and host address (host IP address). At the same time, the management system adds a corresponding host identifier for each identified first host device. Then, the management system quickly connects each first host device through the Paramiko library (Paramiko is a library in Python (crawler), Paramiko follows the SSH2 protocol, supports identity authentication, key processing, and other SSH (Secure Shell, encrypted network protocol) functions, simulating Ansible), traverses all first host devices in the host cluster to identify the network policy of each first host device. Finally, the management system classifies the network policies of each first host device in the host cluster, and establishes the network topology of the host cluster according to the classification results and the host addresses of each first host device, as described in steps S101 to S103. In addition, the management system stores the established network topology in the graph database for visualization and query use, and at the same time, checks and updates the network topology through the automated script at regular intervals, and updates the updated network topology to the graph database synchronously.

[0051] Step S101, determining the policy type corresponding to the network policy of each of the first host devices, and clustering the first host devices of the same policy type into the same sub-host cluster;

[0052] Step S102, establishing a host topology of each of the sub-host clusters according to a topology algorithm and a host address corresponding to a first host device in each of the sub-host clusters;

[0053] Step S103: establishing the network topology according to each of the host topologies.

[0054] Specifically, the management system determines the policy type corresponding to the network policy of each first host device, and classifies each first host device according to the policy type of each first host device, that is, clusters the first host devices of the same policy type into the same sub-host cluster. It should be noted that the business processes and data associations of the first host devices in the same sub-host cluster are related. Then, the management system establishes the host topology of the first host devices in each sub-host cluster based on the topology algorithm and the host addresses corresponding to the first host devices in each sub-host cluster. Finally, the management system summarizes the host topologies in each sub-host cluster to establish the network topology of the host cluster. It should be noted that in an actual production environment, the network policies of different business systems (such as EMOS, Zongzi, etc.) are different, that is, different business systems are independent of each other, and there is a firewall for the IP link. The network policy of the host device represents the network policy of the business system.

[0055] In this embodiment, for example, within a preset time period, it is identified that there are 4 running host devices in a certain host cluster, namely host device 1, host device 2, host device 3 and host device 4, and the host addresses of the 4 host devices are host device 1: 192.168.2.111; host device 2: 192.168.2.112; host device 3: 192.168.2.113; host device 4: 192.168.2.114, and the policy types corresponding to the network policies of the 4 host devices are host device 1: sw-g1; host device 2: sw-g1; host device 3: sw-g2; host device 4: sw-g2. The management system clusters host device 1 and host device 2 into sub-host cluster 1, that is, 192.168.2.111 and 192.168.2.112 establish the host topology sw-g1 of sub-host cluster 1. Host devices 3 and 4 are clustered into sub-host cluster 2, that is, 192.168.2.113 and 192.168.2.114 establish the host topology sw-g2 of sub-host cluster 2. At the same time, the management system uses the host topology sw-g1 of host cluster 1 and the host topology sw-g2 of sub-host cluster 2 to establish the network topology of a certain host cluster. The specific representation of the network topology through the Paramiko library is shown in Table 1, which is the network topology of the host cluster.

[0056] Table 1 Network topology of host cluster

[0057]

[0058] This embodiment constructs the host device host topology in each sub-host cluster by using the policy type corresponding to the network policy, and then establishes the network topology of the host cluster according to the host device host topology in each sub-host cluster, thereby ensuring that the constructed network topology has high accuracy.

[0059] Step S20, performing log clustering on the alarm data and log data generated by the host cluster to obtain corresponding log event templates.

[0060] Management system determines the log data (Log) and alarm data (Alarm) that host cluster produces in preset duration, log data and alarm data are clustered for the first time according to similar log data and similar alarm data clustering method, obtain each pending log event template, then according to the event template ID mapping relations pre-set in the system, obtain the event ID (Identity Document, identity card identification number) corresponding to each pending log event template, each pending log event template is corresponding to a unique event ID. Then, management system carries out clustering for the second time according to each pending log event template and its corresponding event ID, is about to summarize all pending log event templates with similarity into the same log event template that can cover key information, wherein, log event template is also the log summary of key information, and log summary both possesses very strong generalization and retains more detailed information. The specific process of obtaining log event template by log clustering is as described in step S201 to step S203.

[0061] It should be noted that each log event template carries its corresponding alarm level information and occurrence frequency information. Alarm data refers to data such as abnormal events generated by the monitoring system. In the process of log clustering, it is difficult to extract more available information from the body of the alarm data. For example, if the alarm data is "Daemon startup without any loadedmodules", it is impossible to extract valid parameter information based on the alarm data. Therefore, the result obtained by clustering the alarm data is used as the event template. Log data refers to text-based software operation records. Log data is generally a structured or semi-structured data type. In the process of log clustering, valid parameter information including but not limited to time information, host name, host address and log summary template can be extracted from the log data. For example, if the log data is "Received block blk_-567246582456 of size 61706684 from / 10.251.92.84", the host name, host address and log summary template parameter information can be extracted from the log data.

[0062] Step S30, determining a high-frequency log event template among the log event templates according to a preset condition.

[0063] The management system determines the preset conditions for determining the high-frequency log event template in the system, extracts the target log event template that meets the preset conditions from each log event template, and determines the target log event template as the high-frequency log event template in each log event template, wherein the preset conditions are set according to actual conditions, and the preset conditions include but are not limited to the alarm level and occurrence frequency of the log event template. The high-frequency log event template is the log event template for locating the faulty host device, as described in steps S301 to S304.

[0064] Further, the specific description of step S301 to step S304 is as follows:

[0065] Step S301, if the preset condition is the alarm level, determining whether there is a first target log event template with an alarm level greater than a preset alarm level in each log event template;

[0066] Step S302: If the first target log event template exists, determine the first target log event template as the high-frequency log event template.

[0067] Specifically, if it is determined that the preset condition is the alarm level of the log event template, the management system determines the alarm level of each log event template, and compares the alarm level of each log event template with the preset alarm level to determine whether there is a target alarm level with an alarm level greater than the preset alarm level in the alarm levels of each log event template, wherein the preset alarm level is set according to the actual situation. If it is determined that there is a target alarm level, the management system determines the log event template corresponding to the target alarm level as the first target log event template, and determines the first target log event template as the high-frequency log event template among the log event templates.

[0068] This embodiment extracts high-frequency log event templates from various log event templates according to the alarm levels of the log event templates, so that the high-frequency log event templates are representative for analysis, and the results obtained by analyzing the high-frequency log event templates are highly accurate.

[0069] Step S303, if the preset condition is the occurrence frequency, determining whether there is a second target log event template whose occurrence frequency is greater than the preset occurrence frequency in each log event template;

[0070] Step S304: If the second target log event template exists, the second target log event template is determined as the high-frequency log event template.

[0071] Specifically, if the preset condition is determined to be the occurrence frequency of the log event template, the management system determines the occurrence frequency of each log event template, and compares the occurrence frequency of each log event template with the preset occurrence frequency to determine whether there is a target occurrence frequency greater than the preset occurrence frequency in the occurrence frequency of each log event template, wherein the preset occurrence frequency is set according to actual conditions. If it is determined that there is a target occurrence frequency, the management system determines the log event template corresponding to the target occurrence frequency as the second target log event template, and determines the second target log event template as the high-frequency log event template among the log event templates.

[0072] This embodiment extracts a high-frequency log event template from various log event templates according to the occurrence frequency of the log event template, so that the high-frequency log event template is representative for analysis, and the result obtained by analyzing the high-frequency log event template has high accuracy.

[0073] Step S40: locate the corresponding faulty host device according to the high-frequency parameter information in the high-frequency log event template, and locate the second host device associated with the faulty host device according to the faulty host device and the network topology.

[0074] The management system determines the preset analysis parameters, which include but are not limited to the host name and host address, and reduces the dimension of the parameter information of the high-frequency log event template according to the preset analysis parameters, that is, obtains each preset analysis parameter in the high-frequency log event template, compares the occurrence frequency of each preset analysis parameter with the preset frequency threshold, obtains the corresponding comparison result, and obtains the high-frequency parameter information in the high-frequency log event template according to the comparison result, wherein the preset frequency threshold is set according to the actual situation, and the comparison result can be that the target analysis parameter exists in each preset analysis parameter, and the occurrence frequency of the target analysis parameter is greater than or equal to the preset frequency threshold, and the comparison result can also be that the target analysis parameter does not exist in each preset analysis parameter. Then, the management system determines the host device corresponding to the high-frequency parameter information as a faulty host device, and locates the second host device associated with the faulty host device according to the faulty host device and the host topology in the network topology, wherein the second host device is other potential problem host devices associated with the faulty host device, as described in steps S401 to S404.

[0075] Further, the specific description of step S401 to step S304 is as follows:

[0076] Step S401, determining the high-frequency parameter information according to the host address occurrence frequency of each host address in the high-frequency log event template and a preset frequency threshold;

[0077] Step S402: determining the host device corresponding to the high-frequency parameter information as the faulty host device.

[0078] It should be noted that, for the convenience of explanation, this embodiment sets the preset analysis parameter as the host address. Specifically, the management system obtains each host address in the high-frequency log event template, as well as the host address occurrence frequency of each host address, compares the occurrence frequency of each host address with the preset frequency threshold, determines the occurrence frequency of the target host address that is greater than or equal to the preset frequency threshold among the occurrence frequencies of each host address, and determines the occurrence frequency of the target host address as the high-frequency parameter information. Then, the management system determines the host device corresponding to the high-frequency parameter information as a faulty host device.

[0079] In the process of locating the faulty host device, this embodiment actively locates the faulty host device according to the frequency of occurrence of the host address in the high-frequency log event template, thereby ensuring the accuracy of locating the faulty host device and improving the operation and maintenance efficiency of the faulty host device.

[0080] Step S403, determining a corresponding target sub-host cluster according to the policy type of the faulty host device;

[0081] Step S404: locate a second host device associated with the faulty host device according to the host address of the faulty host device and the host topology in the target sub-host cluster.

[0082] The management system determines the target sub-host cluster to which the faulty host device belongs according to the policy type of the faulty host device, and locates other potential problem host devices (second host devices) associated with the faulty host device according to the host address of the faulty host device and the host topology in the target sub-host cluster.

[0083] In the process of locating other problematic host devices, this embodiment combines the established network topology of the host cluster to perform rapid and active positioning, thereby ensuring the accuracy of the located other problematic host devices and improving the operation and maintenance efficiency of other potential problematic host devices.

[0084] In this embodiment, for example, the preset frequency threshold is 300, and the network topology is {sw-g1: "221.177.88.249"; "221.177.88.248"; "221.177.88.247"}; {sw-g2: "221.177.88.195"; "221.177.88.194"}; {sw-g3: "221.177.72.159"; "221.17 7.72.158"; "221.177.72.157"}, the three host addresses in the high-frequency log event template and their corresponding host address occurrence frequencies are {host address 221.177.88.249, host address occurrence frequency 340}, {host address 221.177.88.195, host address occurrence frequency 130} and {host address 221.177.72.159, host address occurrence frequency 124}. Based on the analysis of the high-frequency log event template, the management system determines the host address with an occurrence frequency of more than 300 as the target host address occurrence frequency. The target host address occurrence frequency is also the high-frequency parameter information in the high-frequency log event template, and determines the host device corresponding to the host address 221.177.88.249 as the faulty host device. According to the host topology of sw-g1 to which the host address 221.177.88.249 belongs, other potential problem host devices (the second host device) are located. The host addresses of the second host devices are {"221.177.88.248"; "221.177.88.247"} respectively.

[0085] This embodiment provides a host location method. In the process of locating a faulty host device, no manual intervention is required. The corresponding log event template is actively clustered based on the alarm data and log data generated by the host cluster, and the high-frequency log event template in the log event template is actively queried. The faulty host device is actively located based on the high-frequency parameter information in the high-frequency log event template, thereby improving the operation and maintenance efficiency of the faulty host device. At the same time, in the process of locating other problem host devices associated with the faulty host device, other potential problem host devices associated with the faulty host device are quickly and actively located in combination with the network topology of the established host cluster, thereby improving the operation and maintenance efficiency of other potential problem host devices associated with the faulty host device.

[0086] Further, refer to Figure 2 , Figure 2 This is the second flow chart of the host positioning method provided by the present application, and the step 20 includes:

[0087] Step S201, segmenting the alarm data and log data generated by the host cluster within a preset time period according to a time window method to obtain alarm data at multiple moments and log data at multiple moments;

[0088] Step S202, performing preset structured clustering according to the alarm title data in the alarm data at each of the moments and the target parameter information in the log data at each of the moments, to obtain each log event template to be processed and its corresponding event ID;

[0089] Step S203: re-clustering the to-be-processed log event templates corresponding to the same event ID to obtain corresponding log event templates.

[0090] It should be noted that log clustering includes log data clustering and alarm data clustering. In the process of alarm data clustering, since the alarm data is titled with a highly summarized alarm event type, the alarm data clustering is to cluster the alarm data with the same alarm title. In the process of log data clustering, irrelevant variable strings are extracted and removed from the log data according to a preset regular expression. The irrelevant variable strings include but are not limited to the log date string, the directory path string, and the log level string. A log summary template is generated, and the required parameter information (target parameter information) is retained, including but not limited to the node information and the host address information (host IP information). The target parameter information and the log summary template are clustered.

[0091] Specifically, the management system segments the alarm data and log data generated by the host cluster within a preset time period according to a time window method, and obtains alarm data at multiple time points, as well as log data at multiple time points. The time window method is set according to actual conditions. For example, the alarm data and log data generated by the host cluster within a 1-hour period (such as 00:00-00:59) are obtained, and the alarm data and log data are segmented according to the time window method to obtain alarm data and log data at 60 time points such as 00:00, 00:01, 00:02...00:59.

[0092] Next, the management system processes the log data at each moment through Logpraser (statistical program), that is, it performs structured decomposition of the log data at each moment through regular expressions, and extracts the event template (log summary template) and target parameter information of the log data, and at the same time, determines the alarm title data in the alarm data at each moment, wherein the alarm title data includes but is not limited to the generation date, generation time and alarm data level of the alarm data. Then, the management system will extract the log summary template and target parameter information of the log data of each time period, as well as the alarm title data in the alarm data at each moment for preset structured clustering to obtain each log event template to be processed. In this embodiment, for example, the log data generated by a certain HDFS (Hadoop Distributed File System) at 2021 / 06 / 11 00:00:00 is: 2021 / 06 / 11 00:00:00 INFO DataNode$PacketResponder: Received-block-blk_5672465824 of size 61706684 from 10.251.92.84, and the log data is clustered by Logpraser to obtain the log event template to be processed with a preset structure as shown in Table 2, which is a log event template to be processed. Among them, Timestamp timestamp data includes date data and time data, Level is the level of the log event template to be processed, Component is the component, Event Template is the event template, and Parameters is the parameter information.

[0093] Table 2 Template of log events to be processed

[0094]

[0095] Finally, the management system obtains the event ID corresponding to each pending log event template according to the event template ID mapping relationship, and re-clusters the pending log event templates corresponding to the same event ID to obtain the corresponding log event templates, as shown in Table 3, which is the log event template with event ID ec44eb6f.

[0096] Table 3 Log event template

[0097]

[0098] This embodiment provides a host positioning method, which combines the alarm title data of the alarm data and the target parameter information in the log data for clustering to obtain corresponding log event templates to be processed, and then clusters again according to the log event templates to be processed and their corresponding event IDs, and classifies the key information of the same type of event ID to obtain representative log event templates for each type of event ID, so that the results obtained by analyzing the log event templates corresponding to each type of event ID have high accuracy, that is, the faulty host device can be actively and accurately located through the log event template, thereby improving the operation and maintenance efficiency of the faulty host device.

[0099] Furthermore, the host positioning device provided in the present application is described below. The host positioning device described below and the host positioning method described above can refer to each other.

[0100] like Figure 3 As shown, Figure 3 : is a schematic diagram of the structure of the host positioning device provided by the present application, the host positioning device comprises:

[0101] Establishing module 301, used to establish the network topology of the host cluster according to the network policy and host address of each first host device in the host cluster;

[0102] The clustering module 302 is used to perform log clustering on the alarm data and log data generated by the host cluster to obtain corresponding log event templates;

[0103] A determination module 303 is used to determine a high-frequency log event template in each of the log event templates according to a preset condition;

[0104] The positioning module 304 is used to locate the corresponding faulty host device according to the high-frequency parameter information in the high-frequency log event template, and locate the second host device associated with the faulty host device according to the faulty host device and the network topology.

[0105] Furthermore, the clustering module 302 is also used for:

[0106] Segmenting the alarm data and log data generated by the host cluster within a preset time period according to a time window method to obtain alarm data at multiple times and log data at multiple times;

[0107] Performing preset structured clustering according to the alarm title data in the alarm data at each of the moments and the target parameter information in the log data at each of the moments, to obtain each to-be-processed log event template and its corresponding event ID;

[0108] The log event templates to be processed corresponding to the same event ID are clustered again to obtain the corresponding log event templates.

[0109] Furthermore, the determining module 303 is further configured to:

[0110] If the preset condition is the alarm level, determining whether there is a first target log event template with an alarm level greater than a preset alarm level in each log event template;

[0111] If the first target log event template exists, the first target log event template is determined as the high-frequency log event template.

[0112] Furthermore, the determining module 303 is further configured to:

[0113] If the preset condition is the occurrence frequency, determining whether there is a second target log event template whose occurrence frequency is greater than the preset occurrence frequency in each log event template;

[0114] If the second target log event template exists, the second target log event template is determined as the high-frequency log event template.

[0115] Furthermore, the establishing module 301 is also used for:

[0116] Determine a policy type corresponding to the network policy of each of the first host devices, and cluster first host devices of the same policy type into the same sub-host cluster;

[0117] Establishing a host topology of each of the sub-host clusters according to a topology algorithm and a host address corresponding to a first host device in each of the sub-host clusters;

[0118] The network topology is established according to each of the host topologies.

[0119] Furthermore, the positioning module 304 is also used for:

[0120] Determining the high-frequency parameter information according to the host address occurrence frequency of each host address in the high-frequency log event template and a preset frequency threshold;

[0121] The host device corresponding to the high-frequency parameter information is determined as the faulty host device.

[0122] Furthermore, the positioning module 304 is also used for:

[0123] Determine the corresponding target sub-host cluster according to the policy type of the faulty host device;

[0124] A second host device associated with the faulty host device is located according to the host address of the faulty host device and the host topology in the target sub-host cluster.

[0125] The specific embodiments of the host positioning device provided in the present application are basically the same as the embodiments of the host positioning method described above, and will not be described in detail here.

[0126] Figure 4 An example of a physical structure diagram of an electronic device is shown in FIG. Figure 4 As shown, the electronic device may include: a processor 410, a communication interface 420, a memory 430 and a communication bus 440, wherein the processor 410, the communication interface 420 and the memory 430 communicate with each other through the communication bus 440. The processor 410 may call the logic instructions in the memory 430 to execute the host positioning method, which includes:

[0127] Establishing a network topology of the host cluster according to the network policies and host addresses of the first host devices in the host cluster;

[0128] Perform log clustering on the alarm data and log data generated by the host cluster to obtain corresponding log event templates;

[0129] Determine a high-frequency log event template among the log event templates according to a preset condition;

[0130] The corresponding faulty host device is located according to the high-frequency parameter information in the high-frequency log event template, and the second host device associated with the faulty host device is located according to the faulty host device and the network topology.

[0131] In addition, the logic instructions in the above-mentioned memory 430 can be implemented in the form of a software functional unit and can be stored in a computer-readable storage medium when it is sold or used as an independent product. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art, and the computer software product is stored in a storage medium, including several instructions to enable a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a disk or an optical disk.

[0132] On the other hand, the present application further provides a computer program product, the computer program product comprising a computer program stored on a non-transitory computer-readable storage medium, the computer program comprising program instructions, and when the program instructions are executed by a computer, the computer can execute the host positioning method provided by the above methods, the method comprising:

[0133] Establishing a network topology of the host cluster according to the network policies and host addresses of the first host devices in the host cluster;

[0134] Perform log clustering on the alarm data and log data generated by the host cluster to obtain corresponding log event templates;

[0135] Determine a high-frequency log event template among the log event templates according to a preset condition;

[0136] The corresponding faulty host device is located according to the high-frequency parameter information in the high-frequency log event template, and the second host device associated with the faulty host device is located according to the faulty host device and the network topology.

[0137] In another aspect, the present application further provides a non-transitory computer-readable storage medium having a computer program stored thereon, and when the computer program is executed by a processor, the host positioning method provided above is implemented, and the method includes:

[0138] Establishing a network topology of the host cluster according to the network policies and host addresses of the first host devices in the host cluster;

[0139] Perform log clustering on the alarm data and log data generated by the host cluster to obtain corresponding log event templates;

[0140] Determine a high-frequency log event template among the log event templates according to a preset condition;

[0141] The corresponding faulty host device is located according to the high-frequency parameter information in the high-frequency log event template, and the second host device associated with the faulty host device is located according to the faulty host device and the network topology.

[0142] The device embodiments described above are merely illustrative, wherein the units described as separate components may or may not be physically separated, and the components displayed as units may or may not be physical units, that is, they may be located in one place, or they may be distributed on multiple network units. Some or all of the modules may be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative labor.

[0143] Through the description of the above implementation methods, those skilled in the art can clearly understand that each implementation method can be implemented by means of software plus a necessary general hardware platform, and of course, it can also be implemented by hardware. Based on this understanding, the above technical solution is essentially or the part that contributes to the prior art can be embodied in the form of a software product, and the computer software product can be stored in a computer-readable storage medium, such as ROM / RAM, a disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to execute the methods described in each embodiment or some parts of the embodiments.

[0144] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present application, rather than to limit it. Although the present application has been described in detail with reference to the aforementioned embodiments, those skilled in the art should understand that they can still modify the technical solutions described in the aforementioned embodiments, or make equivalent replacements for some of the technical features therein. However, these modifications or replacements do not deviate the essence of the corresponding technical solutions from the spirit and scope of the technical solutions of the embodiments of the present application.

Claims

1. A host positioning method, characterized in that: include: Establishing a network topology of the host cluster according to the network policies and host addresses of the first host devices in the host cluster; Perform log clustering on the alarm data and log data generated by the host cluster to obtain corresponding log event templates; Determine a high-frequency log event template among the log event templates according to a preset condition; Locating a corresponding faulty host device according to the high-frequency parameter information in the high-frequency log event template, and locating a second host device associated with the faulty host device according to the faulty host device and the network topology; The step of establishing the network topology of the host cluster according to the network policies and host addresses of the first host devices in the host cluster comprises: Determine a policy type corresponding to the network policy of each of the first host devices, and cluster first host devices of the same policy type into the same sub-host cluster; Establishing a host topology of each of the sub-host clusters according to a topology algorithm and a host address corresponding to a first host device in each of the sub-host clusters; Establishing the network topology according to each of the host topologies; The step of locating a second host device associated with the faulty host device according to the faulty host device and the network topology comprises: Determine the corresponding target sub-host cluster according to the policy type of the faulty host device; A second host device associated with the faulty host device is located according to the host address of the faulty host device and the host topology in the target sub-host cluster.

2. The host positioning method according to claim 1, characterized in that: The step of performing log clustering on the alarm data and log data generated by the host cluster to obtain corresponding log event templates comprises: Segmenting the alarm data and log data generated by the host cluster within a preset time period according to a time window method to obtain alarm data at multiple times and log data at multiple times; Performing preset structured clustering according to the alarm title data in the alarm data at each of the moments and the target parameter information in the log data at each of the moments, to obtain each to-be-processed log event template and its corresponding event ID; The log event templates to be processed corresponding to the same event ID are clustered again to obtain the corresponding log event templates.

3. The host positioning method according to claim 1, characterized in that: The preset condition includes an alarm level, and the step of determining a high-frequency log event template in each of the log event templates according to the preset condition includes: If the preset condition is the alarm level, determining whether there is a first target log event template with an alarm level greater than a preset alarm level in each log event template; If the first target log event template exists, the first target log event template is determined as the high-frequency log event template.

4. The host positioning method according to claim 1, characterized in that: The preset condition also includes the frequency of occurrence, and the step of determining the high-frequency log event template in each of the log event templates according to the preset condition also includes: If the preset condition is the occurrence frequency, determining whether there is a second target log event template whose occurrence frequency is greater than the preset occurrence frequency in each log event template; If the second target log event template exists, the second target log event template is determined as the high-frequency log event template.

5. The host positioning method according to claim 1, characterized in that: The step of locating the corresponding faulty host device according to the high-frequency parameter information in the high-frequency log event template comprises: Determining the high-frequency parameter information according to the host address occurrence frequency of each host address in the high-frequency log event template and a preset frequency threshold; The host device corresponding to the high-frequency parameter information is determined as the faulty host device.

6. A host positioning device, characterized in that: include: An establishing module, used to establish a network topology of the host cluster according to the network policy and host address of each first host device in the host cluster; A clustering module, used for performing log clustering on the alarm data and log data generated by the host cluster to obtain corresponding log event templates; A determination module, used to determine a high-frequency log event template among the log event templates according to a preset condition; A positioning module, used to locate the corresponding faulty host device according to the high-frequency parameter information in the high-frequency log event template, and locate a second host device associated with the faulty host device according to the faulty host device and the network topology; The establishment module is also used to: determine the policy type corresponding to the network policy of each of the first host devices, and cluster the first host devices of the same policy type into the same sub-host cluster; establish the host topology of each of the sub-host clusters according to the topology algorithm and the host address corresponding to the first host device in each of the sub-host clusters; establish the network topology according to each of the host topologies; The positioning module is also used to: determine the corresponding target sub-host cluster according to the policy type of the faulty host device; and locate a second host device associated with the faulty host device according to the host address of the faulty host device and the host topology in the target sub-host cluster.

7. An electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the host positioning method according to any one of claims 1 to 5 are implemented.

8. A computer program product, comprising a computer program, characterized in that: When the computer program is executed by a processor, the steps of the host positioning method according to any one of claims 1 to 5 are implemented.

Images