Log analysis method, apparatus, and electronic device

Abstract

Embodiments of the present application disclose a log analysis method and device and electronic equipment. The method comprises: obtaining a plurality of logs; obtaining a target log based on the plurality of logs; obtaining a first reference log based on a pre-constructed relationship model, the plurality of logs and the target log; obtaining a correlation between the plurality of logs; obtaining a second reference log based on the correlation between the plurality of logs; and obtaining a log analysis result of the target log based on the first reference log and the second reference log. In this way, the first reference log having a first correlation with the target log can be obtained based on the pre-constructed relationship model, and the second reference log having a second correlation with the target log can be obtained based on the correlation between the plurality of logs, so that the log analysis result of the target log can be obtained based on the first reference log and the second reference log, and the accuracy of the log analysis result is improved.

Description

Technical Field

[0001] This application relates to the field of vehicle technology, and more specifically, to a log analysis method, apparatus, and electronic device. Background Technology

[0002] With the development of technology, log diagnostic analysis methods are widely used in various fields. For example, in the field of vehicle technology, as vehicle functions continue to expand, the number of electronic control units on each vehicle is also increasing. In order to provide better services to users, it is necessary to perform diagnostic analysis on the logs reported by the electronic control units and improve the vehicle based on the analysis results.

[0003] In these methods, analysis results can be obtained through script or signaling issuance, message collection and reporting, and manual analysis. However, these methods also suffer from the problem of low accuracy in log analysis. Summary of the Invention

[0004] In view of the above problems, this application proposes a log analysis method, apparatus, and electronic device to improve the above problems.

[0005] In a first aspect, this application provides a log analysis method, the method comprising: acquiring multiple logs, the multiple logs representing the operating status of their respective electronic control units; obtaining a target log based on the multiple logs; obtaining a first reference log based on a pre-constructed relational model, the multiple logs, and the target log, the pre-constructed relational model representing the relationship between multiple electronic control units in a vehicle, the first reference log being a log among the multiple logs that has a first correlation with the target log; acquiring the correlation between the multiple logs; obtaining a second reference log based on the correlation between the multiple logs, the second reference log being a log among the multiple logs that has a second correlation with the target log; and obtaining a log analysis result of the target log based on the first reference log and the second reference log.

[0006] Secondly, this application provides a log analysis device, the device comprising: a log acquisition unit for acquiring multiple logs, the multiple logs representing the operating status of their respective electronic control units; a target log acquisition unit for obtaining a target log based on the multiple logs; a first reference log acquisition unit for obtaining a first reference log based on a pre-built relationship model, the multiple logs, and the target log, the pre-built relationship model representing the relationship between multiple electronic control units in a vehicle, the first reference log being a log among the multiple logs that has a first correlation with the target log; a second reference log acquisition unit for acquiring the correlation between the multiple logs; and acquiring a second reference log based on the correlation between the multiple logs, the second reference log being a log among the multiple logs that has a second correlation with the target log; and a log analysis result acquisition unit for obtaining the log analysis result of the target log based on the first reference log and the second reference log.

[0007] Thirdly, this application provides an electronic device including a processor and a memory; one or more programs are stored in the memory and configured to be executed by the processor, the one or more programs being configured to perform the methods described above.

[0008] Fourthly, this application provides a computer-readable storage medium storing program code, wherein the above-described method is executed when the program code is run.

[0009] This application provides a log analysis method, apparatus, electronic device, and storage medium. After acquiring multiple logs representing the operating status of their respective electronic control units (ECUs), a target log is obtained based on these logs. A first reference log with a first correlation relationship to the target log is obtained based on a pre-constructed relationship model representing the relationships between multiple ECUs in a vehicle, the multiple logs, and the target log. The correlation between the multiple logs is then obtained. Based on the correlation between the multiple logs, a second reference log with a second correlation relationship to the target log is obtained. The log analysis result of the target log is obtained based on the first reference log and the second reference log. This method allows for the acquisition of a first reference log with a first correlation relationship to the target log based on a pre-constructed relationship model, and a second reference log with a second correlation relationship to the target log based on the correlation between multiple logs. Therefore, the log analysis result of the target log can be obtained based on the first and second reference logs, improving the accuracy of the log analysis results. Attached Figure Description

[0010] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0011] Figure 1 A flowchart of a log analysis method proposed in an embodiment of this application is shown;

[0012] Figure 2 A flowchart of a log analysis method according to another embodiment of this application is shown;

[0013] Figure 3 This application shows Figure 2 A flowchart of one implementation method proposed in S240;

[0014] Figure 4 A schematic diagram illustrating the working principle of a rule engine proposed in this application is shown;

[0015] Figure 5 A schematic diagram of the workflow of a Drools rules engine proposed in this application is shown;

[0016] Figure 6 A schematic diagram of a rule template proposed in this application is shown;

[0017] Figure 7 This diagram illustrates how a rule engine proposed in this application traverses logs.

[0018] Figure 8 This application shows Figure 2 A flowchart of one implementation method proposed in S260;

[0019] Figure 9 A schematic diagram of a first parse tree proposed in this application is shown;

[0020] Figure 10 A schematic diagram of a second log to be parsed according to this application is shown;

[0021] Figure 11 A schematic diagram of a second parse tree proposed in this application is shown;

[0022] Figure 12 A flowchart of a log analysis method according to another embodiment of this application is shown;

[0023] Figure 13 A schematic diagram of a relational model proposed in this application is shown;

[0024] Figure 14A structural block diagram of a log analysis device according to an embodiment of this application is shown;

[0025] Figure 15 A structural block diagram of an electronic device proposed in this application is shown;

[0026] Figure 16 This is a storage unit in this application embodiment for storing or carrying program code that implements the log analysis method according to this application embodiment. Detailed Implementation

[0027] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. All other embodiments obtained by those skilled in the art based on the embodiments of this application without creative effort are within the scope of protection of this application.

[0028] In this application embodiment, the inventors propose a log analysis method, apparatus, and electronic device. After acquiring multiple logs representing the operating status of their respective electronic control units (ECUs), a target log is obtained based on these logs. A first reference log with a first correlation relationship to the target log is obtained based on a pre-constructed relational model representing the relationships between multiple ECUs in a vehicle, the multiple logs, and the target log; the correlation between the multiple logs is then obtained. Based on the correlation between the multiple logs, a second reference log with a second correlation relationship to the target log is obtained. The log analysis result of the target log is obtained based on the first reference log and the second reference log. This method allows for the acquisition of a first reference log with a first correlation relationship to the target log based on a pre-constructed relational model, and a second reference log with a second correlation relationship to the target log based on the correlation between multiple logs. Therefore, the log analysis result of the target log can be obtained based on the first and second reference logs, improving the accuracy of the log analysis results.

[0029] Please see Figure 1 This application provides a log analysis method, the method comprising:

[0030] S110: Obtain multiple logs, which represent the operating status of their respective electronic control units.

[0031] In vehicle applications, the Electronic Control Unit (ECU) can include EMS (Engine Management System), TCU (Transmission Control Unit), BCM (Body Control Module), ESP (Electronic Stability Program), BMS (Battery Management System), VCU (Vehicle Control Unit), and CCU (Central Control Unit). The ECU's operating status can be either normal operation or a fault. Normal operation means the ECU successfully completes its tasks, while a fault means the ECU fails to execute its tasks.

[0032] One approach is to send a log retrieval command to the target vehicle via the cloud. The log retrieval command can be used to instruct the retrieval of logs from a specified electronic control unit in the target vehicle. In response to the log retrieval command, the target vehicle sends the logs of the specified electronic control unit to the cloud to obtain multiple logs.

[0033] The cloud can store the identifier of each vehicle, the corresponding model of each vehicle, and the identifier of the electronic control unit included in each vehicle.

[0034] Optionally, the target vehicle and designated electronic control unit can be determined based on actual needs. The target vehicle can be multiple vehicles of the same model, one or more specific vehicles, or multiple vehicles of different models but with the same electronic control unit.

[0035] In this application embodiment, when the target vehicle is multiple vehicles of the same model, the vehicles of the same model can be analyzed as a whole by obtaining multiple logs; when the target vehicle is one or more specific vehicles, the specific vehicles can be analyzed as a whole by obtaining multiple logs; when the target vehicle is multiple vehicles of different models but with the same electronic control unit, the same electronic control unit can be analyzed by obtaining multiple logs.

[0036] S120: Based on the multiple logs, obtain the target log.

[0037] One approach is to first parse multiple log entries to obtain their respective contents. Then, based on the actual needs, select one or more log entries whose content is relevant to the actual needs, and use the selected log entries as the target log.

[0038] For example, when fault detection is required, the target log can be selected based on the content of multiple log entries, specifically the log indicating a fault in the corresponding electronic control unit. Similarly, when monitoring the implementation status of a specific function of a designated electronic control unit, the target log can be selected based on the content of multiple log entries, specifically the log indicating the operational status of that function.

[0039] S130: Based on the pre-built relational model, the multiple logs, and the target log, a first reference log is obtained. The pre-built relational model represents the relationship between multiple electronic control units in the vehicle, and the first reference log is the log among the multiple logs that has a first association relationship with the target log.

[0040] The relationships between multiple electronic control units (ECUs) can include dependency, association, and belonging. Dependency can be understood as one ECU needing another ECU to perform a certain function; association can be understood as one ECU needing to interact with another ECU to perform a certain function; belonging can be understood as one ECU being a special type of another ECU. The first association relationship can refer to the association relationship arising from the relationships between ECUs.

[0041] In the embodiments of this application, the relationship matching between electronic control units can be 1-1, 1-N or NN (N is a positive integer). That is, an electronic control unit can have a dependency, association or belonging relationship with only one electronic control unit, an electronic control unit can have a dependency, association or belonging relationship with multiple electronic control units, and multiple electronic control units can have a dependency, association or belonging relationship with multiple electronic control units.

[0042] One approach is to first obtain the relationships between multiple electronic control units based on a pre-built relational model; then, based on the relationships between multiple electronic control units and the electronic control units corresponding to each of the multiple logs, obtain the correlation between the multiple logs; and finally, based on the correlation between the multiple logs, obtain the first reference log that has a first association with the target log.

[0043] S140: Obtain the correlation between the multiple logs.

[0044] One approach is to parse multiple logs based on pre-set rules to obtain parsing results for multiple logs, which can characterize the correlation between multiple logs.

[0045] Among them, the pre-set rules can refer to the rules set in advance based on the log analysis task, and the correlation between multiple logs can be understood as the correlation determined based on the completion of the log analysis task.

[0046] Optionally, you can first obtain the category information of multiple logs based on pre-set rules. The category information can include structured logs, semi-structured logs, or unstructured logs. Then, based on the category information, you can determine the target parsing method for each of the multiple logs. Finally, you can parse the multiple logs based on the target parsing method to obtain the parsing results of the multiple logs.

[0047] S150: Based on the correlation between the plurality of logs, obtain a second reference log, wherein the second reference log is a log among the plurality of logs that has a second association relationship with the target log.

[0048] The second relationship can be understood as the relationship that the user wants to explore, determined based on the log analysis task.

[0049] One approach is to obtain a second reference log that has a second association with the target log based on the correlation between multiple logs.

[0050] S160: Based on the first reference log and the second reference log, obtain the log analysis results of the target log.

[0051] One approach is to perform joint analysis on the first and second reference logs based on actual needs to obtain the log analysis results of the target log.

[0052] For example, when the target log is a log indicating that an electronic control unit failed to successfully execute a task, in order to troubleshoot, the first reference log and the second reference log can be the historical log of the electronic control unit executing the task or the log of other electronic control units related to the task. Thus, based on the historical log, the success rate of the electronic control unit executing the task can be obtained, and whether the failure of the electronic control unit to execute the task was caused by the failure of other electronic control units.

[0053] In this embodiment of the application, a first reference log and a second reference log are obtained through a pre-built relational model and pre-set rules. When a user needs to perform in-depth analysis of a target log, the first reference log and the second reference log that are related to the target log can be prepared in advance, thereby improving the user's ability to drill down into the relationship between logs and making it easier for the user to obtain more accurate log analysis results.

[0054] As another approach, the cloud can also store log diagnostic suggestions that frequently occur in the current business. After obtaining the target log, the target log can be analyzed by combining the first reference log, the second reference log, and the stored log diagnostic suggestions, thereby providing more reference information for log analysis and improving the accuracy of log analysis results.

[0055] Optionally, manual maintenance and adjustments can be made to continuously improve the completeness and accuracy of the relationship model and pre-set rules, target parsing methods, etc., thereby reducing the misjudgment rate of purely manual processing, improving the user experience, and increasing the efficiency of user log analysis.

[0056] This embodiment provides a log analysis method that, after acquiring multiple logs representing the operating status of their respective electronic control units (ECUs), obtains a target log based on these logs. Then, based on a pre-constructed relationship model representing the relationships between multiple ECUs in a vehicle, the multiple logs, and the target log, a first reference log with a first correlation relationship to the target log is obtained, and the correlation between the multiple logs is acquired. Based on the correlation between the multiple logs, a second reference log with a second correlation relationship to the target log is obtained. Finally, based on the first and second reference logs, the log analysis result of the target log is obtained. This method allows for the acquisition of a first reference log with a first correlation relationship to the target log based on a pre-constructed relationship model, and a second reference log with a second correlation relationship to the target log based on the correlation between multiple logs. This enables the acquisition of the target log analysis result based on the first and second reference logs, improving the accuracy of the log analysis results.

[0057] Please see Figure 2 This application provides a log analysis method, the method comprising:

[0058] S210: Obtain multiple logs, which represent the operating status of their respective electronic control units.

[0059] S220: Based on the multiple logs, obtain the target log.

[0060] S230: Based on the pre-built relational model, the multiple logs, and the target log, a first reference log is obtained. The pre-built relational model represents the relationship between multiple electronic control units in the vehicle, and the first reference log is the log among the multiple logs that has a first association relationship with the target log.

[0061] S240: Based on the pre-set rules, obtain the category information of the multiple logs, whereby the category information includes structured logs, semi-structured logs, or unstructured logs.

[0062] As a way, such as Figure 3 As shown, based on the pre-set rules, the category information of the multiple log entries is obtained, including:

[0063] S241: Based on a pre-set constant template, the non-critical fields in the multiple logs are processed to obtain multiple processed logs, which are logs containing only critical fields.

[0064] The constant template can be understood as a template pre-set with knowledge of the domain model related to the vehicle's electronic control unit, used to replace or mask non-critical fields in the log. The constant template can include multiple regular expressions.

[0065] In this embodiment, a field can refer to the smallest constituent element (token) in a log. For example, in an English log, each English word can be understood as a field. Non-critical fields can refer to fields that, based on domain model knowledge, do not provide useful information for log analysis tasks, while critical fields can refer to fields that, based on domain model knowledge, are beneficial to log analysis tasks. A domain model can be understood as a visual representation of conceptual classes within a domain or objects in the real world. A domain model can focus on analyzing the problem domain itself, uncovering important business domain concepts, and establishing relationships between these concepts.

[0066] As one approach, non-critical fields in multiple log entries can be replaced or masked based on regular expressions in a pre-defined constant template, resulting in multiple processed log entries.

[0067] S242: Based on file format matching rules and file content matching rules, obtain the category information of the multiple processed logs, wherein the file format matching rules represent the correspondence between the file format of the log and the category of the log; the file content matching rules represent the correspondence between the content of the log and the category of the log.

[0068] One approach is to obtain category information for multiple processed logs based on file format matching rules, file content matching rules, and a rule engine.

[0069] The full name of the rule engine is Business Rule Management System (BRMS). For example... Figure 4 As shown, a rule engine can separate the business decision-making part of an application and use predefined semantic templates to write business decisions (business rules), which can be configured and managed by users or developers as needed. Currently commonly used rule engine products include Drools, VisualRules, and iLog.

[0070] In this embodiment, multiple processed log category information can be obtained based on file format matching rules, file content matching rules, and the Drools rule engine. Drools can refer to an open-source rule engine developed in Java and provided by the JBoss organization. Drools can liberate complex and variable business rules from hard-coding, storing them as rule scripts in files or specific storage media (such as a database), allowing changes to business rules to take effect immediately in the online environment without modifying project code or restarting the server. The execution flow of the Drools rule engine can be as follows: Figure 5 As shown.

[0071] Optionally, it can be generated based on file format matching rules and file content matching rules, such as Figure 6 The system displays multiple rule templates and stores them in a rule base. By executing the rule engine, rule templates can be retrieved from the rule base, and multiple processed logs can be matched against these retrieved rule templates to obtain the category information of the processed logs.

[0072] Optionally, the file format of the processed log can be determined based on the file extension of the log file.

[0073] Optional, such as Figure 7As shown, the rule engine can traverse multiple processed logs based on step S1, and determine whether the traversal is complete based on step S2. During the traversal, for each processed log, file format matching can be performed based on step S3. If a match is successful, file content matching can be performed based on step S4. If a match is successful, it indicates that the processed log can be parsed, and the category information of the processed log can be confirmed based on the successfully matched file format and file content. At this time, the processed log can be parsed in real time through steps S5 and S6. If the processed log fails to match in step S3 or step S4, it indicates that the processed log cannot be parsed in real time, and then it can enter step S7: lazy loading process, so that the category information of the processed log can be determined and parsed with low priority, or the category information of the processed log can be determined and the content parsed only when a specific process is triggered.

[0074] S250: Determine the target parsing method corresponding to each of the multiple log entries based on the category information.

[0075] One approach is to determine that the target parsing method for the first log to be parsed is to generate a first parse tree based on the number of key fields in the first log to be parsed. The first log to be parsed can be a log in which the category information is unstructured log among multiple processed logs. The first parse tree can represent the correlation between the first logs to be parsed. Similarly, the target parsing method for the second log to be parsed is to generate a second parse tree based on the content of the key fields in the second log to be parsed. The second log to be parsed can be a log in which the category information is structured log and semi-structured log among multiple processed logs. The second parse tree can represent the correlation between the second logs to be parsed.

[0076] Structured logs can refer to logs with fixed data structures and defined relational models, unstructured logs can refer to logs that lack a unified data structure and whose data models are not strictly defined, and semi-structured logs can refer to logs with non-relational models but with basic fixed structural patterns.

[0077] S260: Based on the target parsing method, parse the multiple logs to obtain the parsing results of the multiple logs.

[0078] As a way, such as Figure 8 As shown, the parsing of the multiple log entries based on the target parsing method to obtain the parsing results of the multiple log entries includes:

[0079] S261: Generate the first parse tree based on the number of key fields in the first log to be parsed and the drain algorithm.

[0080] Among them, the drain algorithm is an algorithm for online log parsing. The drain algorithm can parse the first log to be parsed and generate a first parse tree. Different types of logs can be distinguished through the generated first parse tree, and each type of log can be clustered into a log group.

[0081] In the embodiments of the present application, as Figure 9 shown, the top layer of the first parse tree can be the root node, the middle layer can be the internal nodes, and the bottom layer can be the leaf nodes. Among them, the root node and the internal nodes can guide the search process through pre-determined search rules and do not store logs; a leaf node can be used to store a log group, and each log group can include log events and a log ID (Identity Document). The log event can be used to describe the content of the logs in the log group.

[0082] As a way, when the first log to be parsed is obtained, the number of keyword fields of the first log to be parsed can be confirmed, so as to search for the most suitable log group for the first log to be parsed based on the first parse tree, or create a new log group.

[0083] Optionally, the group corresponding to the first log to be parsed can be confirmed based on the correlation. The calculation formula of the correlation can be as follows:

[0084]

[0085] Among them, seq1(i) and seq2(i) can respectively represent the i-th keyword field in the log event and the first log to be parsed, and n can represent the number of keyword fields in the first log to be parsed.

[0086] Optionally, after obtaining the log group with the maximum sinSeq corresponding to the first log to be parsed, the maximum sinSeq can be compared with a pre-defined similarity threshold st. If the maximum simSeq ≥ st, the log group corresponding to the maximum sinSeq can be used as the group corresponding to the first log to be parsed; if the maximum simSeq < st, otherwise, a flag indicating that no suitable log group is matched can be returned, and then a new log group can be created for the first log to be parsed.

[0087] S262: Generate the second parse tree based on the content of the keyword fields of the second log to be parsed and the pre-set business rules.

[0088] The key fields can contain multiple levels of content, and each level can include log attributes. Higher-level content can be nested within lower-level content, and log attributes can be used to characterize the content of a second log entry to be parsed.

[0089] As one approach, multiple levels of target attribute groups can be obtained based on content at multiple levels, log attributes, and pre-set business rules; a second parse tree can be generated based on the second log to be parsed and the multiple levels of target attribute groups.

[0090] Among them, the pre-set business rules can refer to rules designed based on actual needs that are conducive to improving the accuracy of log analysis tasks.

[0091] Optionally, the second log to be parsed can be divided into multiple levels based on specific flags in the log. For example, the second log to be parsed can be as follows: Figure 10 As shown, specific markers can be curly braces, and each pair of curly braces can represent a level. Figure 10 The second log to be parsed can have four levels, from highest to lowest: "Top-Element", "Result", "Conditions", and "VehicleSpeedCheck". "Top-Element" can refer to... Figure 10 The level corresponding to the curly braces in the first line.

[0092] Optionally, log attributes for each level can be obtained based on a specific data structure in the second log to be parsed. For example, the second log to be parsed could be as follows: Figure 10 As shown, a specific data structure can refer to "key" and "value". Log attributes can be "key", so the log attributes corresponding to the "Top-Element" level can include: ID type attribute "CarNumber", time type attribute "TimeStamp", enumeration type attributes "MainType" and "Options", boolean type attribute "Result", etc.

[0093] Optionally, each level may include one or more target attribute groups, and each target attribute group may include one or more log attributes. A target attribute group can form a grouping constraint (ConstraintGroup). The second parse tree can be defined as an LSGT (Log-Structured Group Tree) parse tree. Figure 10 Taking the second log to be parsed as an example, based on the aforementioned content, Figure 10 After processing the multiple levels of the second log to be parsed and the log attributes included in each level, such as... Figure 11As shown, based on pre-set business rules, "MainType" and "Options" in the "Top-Element" level can be grouped together as a single target attribute group, while "CarNumber" and "Result" can be grouped separately as target attribute groups, thus obtaining the target attribute groups corresponding to the "Top-Element" level. Furthermore, based on the value corresponding to "TotalResult" in the "Result" level, [the following can be done]... Figure 10 The second log to be parsed is assigned to the first group, thus generating the second parse tree.

[0094] Optionally, the target attribute grouping can be matched based on the correlation calculation formula in step S261.

[0095] S263: Based on the first parse tree and the second parse tree, obtain the parsing results corresponding to the multiple logs.

[0096] One approach is to obtain the grouping of multiple log entries based on the first and second parse trees, and then use the grouping of multiple log entries as the parsing result corresponding to the multiple log entries.

[0097] S270: Based on the correlation between the plurality of logs, obtain a second reference log, wherein the second reference log is a log among the plurality of logs that has a second association relationship with the target log.

[0098] One approach is to obtain logs in the same log group as the target log based on the first parse tree and the second parse tree, and use the logs in the same group as the second reference logs.

[0099] S280: Based on the first reference log and the second reference log, obtain the log analysis results of the target log.

[0100] This embodiment provides a log analysis method that, through the aforementioned approach, allows for the generation of a first reference log with a first association relationship to the target log based on a pre-constructed relational model, and the generation of a second reference log with a second association relationship to the target log based on the correlation between multiple logs. This enables the acquisition of log analysis results for the target log based on the first and second reference logs, improving the accuracy of the log analysis results. Furthermore, in this embodiment, multiple log data can be processed based on a pre-set constant template to obtain multiple processed logs. The category information of these processed logs is then obtained based on file format matching rules and file content matching rules. This allows the generation of a first parse tree and a second parse tree for different categories of logs, enabling the acquisition of correlations between multiple logs based on the first and second parse trees, thereby improving the accuracy of the log analysis results. Moreover, clustering and grouping multiple logs using the first and second parse trees reduces the scope and frequency of log retrieval, increases the efficiency of obtaining the second reference log, and thus improves the efficiency of log analysis.

[0101] Please see Figure 12 This application provides a log analysis method, the method comprising:

[0102] S310: Construct a meta-model based on the common characteristics of the multiple electronic control units.

[0103] The common features of multiple electronic control units may include: production time, delivery time, etc. A meta-model can refer to a model that includes the common features of objects belonging to the same major category. In this embodiment, the meta-model can be a model that includes the common features of multiple electronic control units.

[0104] In the embodiments of this application, there can be multiple meta-models, such as... Figure 13 As shown, one meta-model can be obtained based on the common characteristics between electronic control units controlling specific areas of a vehicle, and another meta-model can be obtained based on the common characteristics of electronic control units with central control functions in the vehicle.

[0105] S320: Construct a relational model based on the functions corresponding to the multiple electronic control units and the meta-model.

[0106] As a way, such as Figure 13 As shown, a new model can be generated based on the function of the electronic control unit, on the basis of the inherited meta-model. The new model can inherit all the features in the meta-model and include features for describing the function of the corresponding electronic control unit. Each instance in the model can correspond to an electronic control unit in the vehicle, so a relational model can be constructed based on the relationship between multiple new models.

[0107] Optionally, new models can be generated based on the implementation method, location of action, and scope of action of a function. For example, EMS can generate new models based on the implementation method (i.e., the way power is provided), where the power provision method can refer to the corresponding power type, such as gasoline, diesel, or hybrid. As another example, BCM can generate new models based on the location of action, such as lights, door locks, windshield wipers, rearview mirrors, and windows.

[0108] S330: Obtain multiple logs, which represent the operating status of their respective electronic control units.

[0109] S340: Based on the multiple logs, obtain the target log.

[0110] S350: Based on the pre-built relational model, the multiple logs, and the target log, a first reference log is obtained. The pre-built relational model represents the relationship between multiple electronic control units in the vehicle, and the first reference log is the log among the multiple logs that has a first association relationship with the target log.

[0111] S360: Obtain the correlation between the multiple logs.

[0112] S370: Based on the correlation between the plurality of logs, obtain a second reference log, wherein the second reference log is a log among the plurality of logs that has a second association relationship with the target log.

[0113] S380: Based on the first reference log and the second reference log, obtain the log analysis results of the target log.

[0114] This embodiment provides a log analysis method that, through the aforementioned approach, allows for the generation of a first reference log with a first association relationship to the target log based on a pre-constructed relational model, and the generation of a second reference log with a second association relationship to the target log based on the correlation between multiple logs. This enables the generation of log analysis results for the target log based on the first and second reference logs, improving the accuracy of the log analysis results. Furthermore, in this embodiment, a relational pattern can be constructed using the shared characteristics and corresponding functions of multiple electronic control units in the vehicle, thereby allowing the generation of the first reference log corresponding to the target log based on the constructed relational model.

[0115] Please see Figure 14 This application provides a log analysis device 600, the device 600 comprising:

[0116] The log acquisition unit 610 is used to acquire multiple logs, which represent the operating status of their respective electronic control units.

[0117] Target log acquisition 620 is used to obtain the target log based on the multiple logs.

[0118] The first reference log acquisition unit 630 is used to obtain a first reference log based on a pre-built relational model, the multiple logs, and the target log. The pre-built relational model represents the relationship between multiple electronic control units in the vehicle, and the first reference log is the log among the multiple logs that has a first association relationship with the target log.

[0119] The second reference log acquisition unit 640 is used to acquire the correlation between the plurality of logs; based on the correlation between the plurality of logs, acquire a second reference log, wherein the second reference log is a log among the plurality of logs that has a second association relationship with the target log.

[0120] The log analysis result acquisition unit 650 is used to obtain the log analysis result of the target log based on the first reference log and the second reference log.

[0121] In one approach, the second reference log acquisition unit 640 is specifically used to parse the multiple logs based on pre-set rules to obtain parsing results for the multiple logs, wherein the parsing results characterize the correlation between the multiple logs; the parsing of the multiple logs based on pre-set rules to obtain parsing results for the multiple logs includes: obtaining category information of the multiple logs based on the pre-set rules, wherein the category information includes structured logs, semi-structured logs, or unstructured logs; determining the target parsing method corresponding to each of the multiple logs based on the category information; and parsing the multiple logs based on the target parsing method to obtain parsing results for the multiple logs.

[0122] Optionally, the second reference log acquisition unit 640 is specifically used to process the non-critical fields in the multiple logs based on a pre-set constant template to obtain multiple processed logs, wherein the multiple processed logs are logs containing only critical fields; and to obtain the category information of the multiple processed logs based on file format matching rules and file content matching rules, wherein the file format matching rules represent the correspondence between the file format of the log and the category of the log; and the file content matching rules represent the correspondence between the content of the log and the category of the log.

[0123] Optionally, the second reference log acquisition unit 640 is specifically used to determine that the target parsing method for the first log to be parsed is to generate a first parse tree based on the number of key fields in the first log to be parsed, wherein the first log to be parsed is a log whose category information is unstructured log among the multiple processed logs, and the first parse tree represents the correlation between the first logs to be parsed; and to determine that the target parsing method for the second log to be parsed is to generate a second parse tree based on the content of the key fields in the second log to be parsed, wherein the second log to be parsed is a log whose category information is structured log and semi-structured log among the multiple processed logs, and the second parse tree represents the correlation between the second logs to be parsed.

[0124] Optionally, there are multiple first logs to be parsed and multiple second logs to be parsed. The second reference log acquisition unit 640 is specifically used to generate the first parsing tree based on the number of key fields of the first log to be parsed and the drain algorithm; generate the second parsing tree based on the content of the key fields of the second log to be parsed and the pre-set business rules; and obtain the parsing results corresponding to the multiple logs based on the first parsing tree and the second parsing tree.

[0125] Optionally, the content of the key field includes multiple levels of content, and each level of content includes log attributes. The second reference log acquisition unit 640 is specifically used to obtain target attribute groups of multiple levels based on the content of the multiple levels, the log attributes, and the pre-set business rules; and to generate the second parse tree based on the second log to be parsed and the target attribute groups of the multiple levels.

[0126] The device 600 further includes:

[0127] The relational model construction unit 660 is used to obtain target attribute groups of multiple levels based on the content of the multiple levels, the log attributes and the pre-set business rules; and to generate the second parse tree based on the second log to be parsed and the target attribute groups of the multiple levels.

[0128] The following will combine Figure 15 This application describes an electronic device.

[0129] Please see Figure 15 Based on the above-described log analysis method and apparatus, this application embodiment also provides another electronic device 100 capable of executing the aforementioned log analysis method. The electronic device 100 includes one or more (only one shown in the figure) processors 102, a memory 104, and a network module 106 coupled together. The memory 104 stores programs capable of executing the contents of the aforementioned embodiments, and the processors 102 can execute the programs stored in the memory 104.

[0130] The processor 102 may include one or more processing cores. The processor 102 connects to various parts within the electronic device 100 using various interfaces and lines, and performs various functions and processes data by running or executing instructions, programs, code sets, or instruction sets stored in the memory 104, and by calling data stored in the memory 104. Optionally, the processor 102 may be implemented using at least one hardware form of Digital Signal Processing (DSP), Field-Programmable Gate Array (FPGA), or Programmable Logic Array (PLA). The processor 102 may integrate one or a combination of several of the following: Central Processing Unit (CPU), Graphics Processing Unit (GPU), and modem. The CPU primarily handles the operating system, user interface, and applications; the GPU is responsible for rendering and drawing the displayed content; and the modem handles wireless communication. It is understood that the modem may also not be integrated into the processor 102 and may be implemented separately using a communication chip.

[0131] The memory 104 may include random access memory (RAM) or read-only memory (ROM). The memory 104 can be used to store instructions, programs, code, code sets, or instruction sets. The memory 104 may include a program storage area and a data storage area. The program storage area may store instructions for implementing an operating system, instructions for implementing at least one function (such as touch functionality, sound playback functionality, image playback functionality, etc.), and instructions for implementing the various method embodiments described below. The data storage area may also store data created by the terminal 200 during use (such as phonebook data, audio and video data, chat log data, etc.).

[0132] The network module 106 can be used to enable information interaction between the electronic device 100 and other devices or vehicles, such as transmitting device control commands, manipulation request commands, and status information acquisition commands. However, the network module 106 may differ depending on the specific device that the electronic device 100 is used for.

[0133] Please refer to Figure 16This diagram illustrates a structural block diagram of a computer-readable storage medium provided in an embodiment of this application. The computer-readable storage medium 800 stores program code that can be called by a processor to execute the methods described in the above method embodiments.

[0134] The computer-readable storage medium 800 may be an electronic memory such as flash memory, EEPROM (Electrically Erasable Programmable Read-Only Memory), EPROM, hard disk, or ROM. Optionally, the computer-readable storage medium 800 includes a non-transitory computer-readable storage medium. The computer-readable storage medium 800 has storage space for program code 810 that performs any of the method steps described above. This program code can be read from or written to one or more computer program products. The program code 810 may, for example, be compressed in a suitable form.

[0135] In summary, the log analysis method, apparatus, and electronic device provided in this application, after acquiring multiple logs representing the operating status of their respective electronic control units, obtains a target log based on these logs. Then, based on a pre-constructed relational model representing the relationships between multiple electronic control units in a vehicle, the multiple logs, and the target log, a first reference log with a first correlation relationship to the target log is obtained, and the correlation between the multiple logs is acquired. Based on the correlation between the multiple logs, a second reference log with a second correlation relationship to the target log is obtained. Finally, based on the first and second reference logs, the log analysis result of the target log is obtained. This approach allows for the acquisition of a first reference log with a first correlation relationship to the target log based on a pre-constructed relational model, and a second reference log with a second correlation relationship to the target log based on the correlation between multiple logs. This enables the acquisition of the log analysis result of the target log based on the first and second reference logs, improving the accuracy of the log analysis result.

[0136] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of this application, and are not intended to limit them. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features. Such modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of this application.

Claims

1. A log analysis method characterized by, The method comprises: obtaining a plurality of logs, the plurality of logs representing the running states of respective electronic control units; obtaining a target log based on the plurality of logs; obtaining a first reference log based on a pre-constructed relationship model, the plurality of logs and the target log, the pre-constructed relationship model representing the relationships between a plurality of electronic control units in a vehicle, the first reference log being a log in the plurality of logs that has a first association relationship with the target log; the first association relationship is an association relationship generated based on the relationships between the electronic control units; obtaining category information of the plurality of logs based on a pre-set rule, the category information including structured logs, semi-structured logs or unstructured logs; generating a first parsing tree based on the number of key fields of a first log to be parsed and a drain algorithm; the first log to be parsed is a log whose category information is unstructured; the first parsing tree represents the correlations between a plurality of the first log to be parsed; generating a second parsing tree based on the content of the key fields of a second log to be parsed and a pre-set business rule; the second log to be parsed is a log whose category information is structured or semi-structured; the second parsing tree represents the correlations between a plurality of the second log to be parsed; obtaining parsing results corresponding to the plurality of logs based on the first parsing tree and the second parsing tree; the parsing results of the plurality of logs include grouping conditions of the plurality of logs based on log content, and the parsing results represent the correlations between the plurality of logs; obtaining a second reference log based on the correlations between the plurality of logs; the second reference log is a log in the plurality of logs that has a second association relationship with the target log; the second reference log and the target log are in the same group; obtaining log analysis results of the target log based on the first reference log and the second reference log.

2. The method of claim 1, wherein, The method comprises: obtaining category information of the plurality of logs based on a pre-set rule, the category information including structured logs, semi-structured logs or unstructured logs; processing non-key fields in the plurality of logs based on a pre-set constant template to obtain a plurality of processed logs, the plurality of processed logs being logs containing only key fields; 3. The method of claim 1, wherein, obtaining category information of the plurality of processed logs based on a file format matching rule and a file content matching rule, wherein the file format matching rule represents the corresponding relationship between the file format of a log and the category of the log; and the file content matching rule represents the corresponding relationship between the content of a log and the category of the log. The content of the key fields includes a plurality of hierarchical contents, and each hierarchical content includes a log attribute; the method comprises: obtaining a plurality of hierarchical target attribute groups based on the plurality of hierarchical contents, the log attribute and the pre-set business rule; 4. The method of claim 1, wherein, generating the second parsing tree based on the second log to be parsed, the plurality of hierarchical target attribute groups. Before the method comprises: constructing a meta-model based on the same features of the plurality of electronic control units; constructing a relationship model based on the functions of the plurality of electronic control units respectively and the meta-model.

5. A log analysis apparatus characterized by comprising: The apparatus comprises: a log obtaining unit configured to obtain a plurality of logs, the plurality of logs representing running states of respective electronic control units; a target log obtaining unit configured to obtain a target log based on the plurality of logs; a first reference log obtaining unit configured to obtain a first reference log based on a pre-constructed relationship model representing relationships between the plurality of electronic control units in the vehicle, the plurality of logs, and the target log, the first reference log being a log in the plurality of logs having a first association relationship with the target log; the first association relationship being an association relationship generated based on the relationships between the electronic control units; a second reference log obtaining unit configured to obtain category information of the plurality of logs based on a pre-set rule, the category information including structured logs, semi-structured logs, or unstructured logs; generate a first parsing tree based on a number of key fields of a first log to be parsed and a drain algorithm; the first log to be parsed being a log whose category information is unstructured; the first parsing tree representing correlations between a plurality of the first log to be parsed; generate a second parsing tree based on contents of key fields of a second log to be parsed and a pre-set business rule; the second log to be parsed being a log whose category information is structured or semi-structured; the second parsing tree representing correlations between a plurality of the second log to be parsed; obtain a parsing result corresponding to the plurality of logs based on the first parsing tree and the second parsing tree; the parsing result of the plurality of logs including grouping conditions of the plurality of logs based on log contents, the parsing result representing correlations between the plurality of logs; obtain a second reference log based on the correlations between the plurality of logs, the second reference log being a log in the plurality of logs having a second association relationship with the target log; the second reference log and the target log being in a same group; a log analysis result obtaining unit configured to obtain a log analysis result of the target log based on the first reference log and the second reference log.

6. An electronic device, comprising: comprise a processor and a memory; one or more programs are stored in the memory and configured to be executed by the processor, the one or more programs being configured to perform the method of any one of claims 1-4.

7. A computer readable storage medium characterized in that, The computer-readable storage medium stores program code, wherein the program code performs the method of any one of claims 1-4 when executed. The computer-readable storage medium stores program code, wherein the program code performs the method of any one of claims 1-4 when executed.

Images