A log analysis method, device, apparatus and storage medium

Abstract

The present disclosure provides a log analysis method, device and equipment and a storage medium, wherein the log analysis method comprises: obtaining log information of a target application APP currently running; determining a log matching record corresponding to the target APP based on a matching result of the log information and a pre-labeled log segment; wherein the pre-labeled log segment is labeled based on a log template corresponding to the target APP, and the log template comprises log information generated by the target APP in a preset running state; determining a log analysis result of the target APP based on the log matching record; wherein the log analysis result is used to reflect the running state of the target APP. It can be seen that the present disclosure improves the automation degree of log analysis, thereby improving the efficiency of log analysis.

Description

Technical Field

[0001] This disclosure relates to the field of computer technology, and in particular to a log analysis method, apparatus, device, and storage medium. Background Technology

[0002] Developers can determine whether the application is running normally by analyzing the logs generated during application runtime.

[0003] Currently, log analysis requires outputting the log to a file, searching for keywords within that file, and manually analyzing log segments containing those keywords. However, this log analysis process has a low degree of automation, resulting in low efficiency. Summary of the Invention

[0004] To solve the above-mentioned technical problems, or at least partially solve them, this disclosure provides a log analysis method, apparatus, device, and storage medium.

[0005] Firstly, this disclosure provides a log analysis method, the method comprising:

[0006] Obtain the log information of the currently running target application (APP);

[0007] Based on the matching results between the log information and the pre-marked log segments, the log matching record corresponding to the target APP is determined; wherein, the pre-marked log segments are obtained by marking based on the log template corresponding to the target APP, and the log template includes the log information generated by the target APP in a preset running state;

[0008] Based on the log matching records, the log analysis results of the target APP are determined; wherein, the log analysis results are used to reflect the running status of the target APP.

[0009] In one optional implementation, the pre-tagged log fragments include log fragments pre-tagged with labels; determining the log matching record corresponding to the target APP based on the matching result of the log information and the pre-tagged log fragments includes:

[0010] The log information is matched with the pre-tagged log segments;

[0011] If it is determined that the log information matches at least one log segment, then the matching record of the tag marked by the at least one log segment is updated; wherein, the matching record includes the number of successful matches of the log segment marked with the tag;

[0012] Based on the matching records of the tags, the log matching records corresponding to the target APP are determined.

[0013] In one optional implementation, the tag has a tag level, which characterizes the impact of log fragments tagged with the tag level on the operation of the target app; determining the log analysis result of the target app based on the log matching records includes:

[0014] Based on the matching records of tags in the log matching records and the tag level of the tags, the log analysis results of the target APP are determined.

[0015] In one optional implementation, determining the log matching record corresponding to the target APP based on the matching result of the log information and pre-tagged log fragments includes:

[0016] Based on the matching results of the log information with pre-tagged log segments and the matching results of the log information with the pre-configured log generation order, the log matching record corresponding to the target APP is determined; wherein, the log generation order includes log segments with sequential relationship.

[0017] In an optional implementation, the log information includes currently unmatched log information in the runtime log stream. Before determining the log matching record corresponding to the target APP based on the matching result of the log information with pre-tagged log fragments and the matching result of the log information with a pre-configured log generation order, the method further includes:

[0018] The current log information to be matched is matched with the log segment corresponding to the current state to be matched in the preset state machine; wherein, the preset state machine includes states corresponding to log segments in the pre-configured log generation order;

[0019] If it is determined that the current log information to be matched successfully matches the log fragment, then the current matching state in the preset state machine is updated;

[0020] Based on the matching results of each state in the preset state machine, the matching result of the log information and the log generation order is determined.

[0021] In one optional implementation, the log information includes currently unmatched log information in the runtime log stream, and log segments with sequential relationships in the log generation order are pre-tagged; before determining the log matching record corresponding to the target APP based on the matching result of the log information and the pre-tagged log segments, and the matching result of the log information and the pre-configured log generation order, the method further includes:

[0022] The current log information to be matched is matched with the current log segment to be matched in the log generation order;

[0023] If it is determined that the current log information to be matched successfully matches the current log segment to be matched in the log generation order, then the matching record of the tag marked by the current log segment to be matched is updated;

[0024] Based on the matching records of the tags, the matching result of the log information and the pre-configured log generation order is determined.

[0025] In one optional implementation, the tag has a tag level, which is used to characterize the impact of log fragments tagged with the tag level on the operation of the target APP; the log matching record corresponding to the target APP includes a tag matching record for characterizing the matching result of the log generation order and a tag matching record for characterizing the matching result of the log information with the pre-tagged log fragments.

[0026] The step of determining the log analysis result of the target APP based on the log matching records includes:

[0027] Based on the matching records of tags in the log matching records and the tag level of the tags, the log analysis results of the target APP are determined.

[0028] In one optional implementation, determining the log analysis result of the target APP based on the matching records of tags in the log matching records and the tag level of the tags includes:

[0029] According to the pre-set correspondence between tag levels and deduction scores, the total deduction score corresponding to the tag matching record in the log matching record is determined; wherein, the tag level is directly proportional to the degree of influence of the log fragment marked with the tag level on the operation of the target APP, and is also directly proportional to the deduction score;

[0030] The score obtained by deducting the total deduction from the preset full score is determined as the log analysis result of the target APP; wherein, the log analysis result is used to characterize the probability of the target APP's abnormal operation, and the probability of abnormal operation is inversely proportional to the score.

[0031] Secondly, this disclosure provides a log analysis apparatus, the apparatus comprising:

[0032] The acquisition module is used to acquire log information of the currently running target application (APP).

[0033] The matching module is used to determine the log matching record corresponding to the target APP based on the matching result between the log information and the pre-marked log fragments; wherein, the pre-marked log fragments are obtained by marking based on the log template corresponding to the target APP, and the log template includes the log information generated by the target APP in a preset running state;

[0034] The results module is used to determine the log analysis results of the target APP based on the log matching records; wherein the log analysis results are used to reflect the running status of the target APP.

[0035] Thirdly, this disclosure provides a computer-readable storage medium storing instructions that, when executed on a terminal device, cause the terminal device to implement the above-described method.

[0036] Fourthly, this disclosure provides an apparatus comprising: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor, when executing the computer program, implements the method described above.

[0037] Fifthly, this disclosure provides a computer program product comprising a computer program / instruction that, when executed by a processor, implements the method described above.

[0038] The technical solution provided in this disclosure has at least the following advantages compared with the prior art:

[0039] This disclosure provides a log analysis method. First, it acquires the log information of a currently running target application (APP). Then, based on the matching results between the log information and pre-tagged log fragments, it determines the log matching record corresponding to the target APP. Further, based on the log matching record, it determines the log analysis result of the target APP. Therefore, this disclosure improves the automation level of log analysis, thereby increasing its efficiency. Attached Figure Description

[0040] The accompanying drawings, which are incorporated in and form a part of this specification, illustrate embodiments consistent with this disclosure and, together with the description, serve to explain the principles of this disclosure.

[0041] To more clearly illustrate the technical solutions in the embodiments of this disclosure or the prior art, the accompanying drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, for those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0042] Figure 1 A flowchart of a log analysis method provided in this embodiment of the disclosure;

[0043] Figure 2 A flowchart illustrating a method for determining log matching records provided in this disclosure embodiment;

[0044] Figure 3 A schematic diagram illustrating the determination of a matching log record as provided in an embodiment of this disclosure;

[0045] Figure 4 A flowchart illustrating another method for determining log matching records provided in this disclosure embodiment;

[0046] Figure 5 A schematic diagram of a state machine provided for an embodiment of this disclosure;

[0047] Figure 6 A flowchart illustrating another method for determining log matching records provided in this disclosure embodiment;

[0048] Figure 7 A flowchart of a method for scoring log information provided in this embodiment of the present disclosure;

[0049] Figure 8 This is a schematic diagram of the structure of a log analysis device provided in an embodiment of the present disclosure;

[0050] Figure 9 This is a schematic diagram of the structure of a log analysis device provided in an embodiment of this disclosure. Detailed Implementation

[0051] To better understand the above-mentioned objectives, features, and advantages of this disclosure, the solutions disclosed herein will be further described below. It should be noted that, unless otherwise specified, the embodiments and features described herein can be combined with each other.

[0052] Numerous specific details are set forth in the following description in order to provide a full understanding of this disclosure, but this disclosure may also be implemented in other ways different from those described herein; obviously, the embodiments in the specification are only some, and not all, of the embodiments of this disclosure.

[0053] During application operation, logs are generated. Analyzing these logs can reflect the application's operational status. Currently, developers need to output the logs to a file and search for keywords within that file during log analysis. This process is labor-intensive, has low automation, and is inefficient.

[0054] To address this, this disclosure provides a log analysis method. First, it acquires the log information of a currently running target application (APP). Then, based on the matching results between the log information and pre-tagged log segments, it determines the corresponding log matching record for the target APP. Further, based on the log matching record, it determines the log analysis result for the target APP. Therefore, this disclosure improves the automation level of log analysis, thereby increasing its efficiency.

[0055] Based on this, the present disclosure provides a log analysis method, referring to... Figure 1 Here is a flowchart of a log analysis method provided in this disclosure, the method including:

[0056] S101, obtain the log information of the currently running target application (APP).

[0057] The target app generates log information during its operation to record runtime information. By analyzing this log information, the running status of the target app can be determined. Before performing log analysis, the log information of the currently running target app is first obtained. It is worth noting that the log information obtained in this embodiment is the runtime log information of the target app, that is, the log information generated by the target app is obtained in real time during its operation.

[0058] In one optional implementation, the log information of the running target app can be obtained by executing the `logcat` command; the specific method of obtaining this information will not be described in detail here. Alternatively, embodiments of this disclosure can also obtain the log information of the running target app through other methods. After obtaining the log information of the target app, to improve the efficiency of log analysis, the log information can be analyzed and processed in memory.

[0059] It should be noted that the log analysis method provided in this embodiment is applied to the client. The client can perform real-time log analysis on the log information generated by the target APP, thereby ensuring the timeliness of log analysis and enabling the client user to know the running status of the target APP in real time.

[0060] S102, Based on the matching results of log information and pre-marked log fragments, determine the log matching record corresponding to the target APP.

[0061] The pre-tagged log fragments are obtained by tagging based on the log template corresponding to the target APP, and the log template includes log information generated by the target APP in a preset running state.

[0062] In this embodiment, the pre-marked log fragments can be obtained by marking a log template. The log template can be a standard running log compiled from the historical running logs of the target app. Alternatively, the log template can be pre-acquired log information generated by the target app under a preset running state. This preset running state can characterize the analysis requirements for the target app's logs. For example, if it is necessary to analyze the target app's logs in a chat scenario, the preset running state could be a user using the target app to chat. By marking the log fragments in the log template, multiple pre-marked log fragments are obtained. The marking method for log fragments is not limited in this embodiment. For example, it can be marked using background color, font color, annotations, or tags to mark the log fragments in the log template, thus obtaining pre-marked log fragments.

[0063] In one optional implementation, if the log template includes a process ID (pid) and / or a thread ID (tid), the process ID and / or thread ID can be pre-marked, and the marked process ID and / or thread ID can be identified as a pre-marked log segment.

[0064] In one optional implementation, the pre-labeled log fragments can characterize the log analysis requirements. That is, log fragments in the log template are labeled based on the log analysis requirements to obtain pre-labeled log fragments. For example, if there is a need to analyze the log information generated by the target app during its startup process, the log fragments in the target app's log template that correspond to the target app during its startup process can be labeled to obtain pre-labeled log fragments for subsequent log analysis.

[0065] When performing log analysis, the log information of the currently running target APP is matched with pre-marked log fragments. Since the pre-marked log fragments come from log templates, the matching results obtained by matching them can reflect the running status of the currently running target APP.

[0066] In one optional implementation, the log information generated by the currently running target application (APP) can be matched sequentially with pre-marked log segments line by line to obtain the matching result corresponding to each line of log information. After all the log information generated by the currently running target application (APP) has been matched, a log matching record corresponding to the target application (APP) is generated based on the matching result corresponding to each line of log information generated by the target application (APP).

[0067] In another optional implementation, the log information generated by the currently running target application (APP) can be matched sequentially with pre-marked log segments according to the timestamp information, with each log information output at each time point as a unit, so as to obtain the matching result corresponding to the log information output at each time point. After all the log information generated by the currently running target application (APP) has been matched, the log matching result corresponding to the target application (APP) is generated based on the matching result corresponding to the log information output at each time point in the log information generated by the target application (APP).

[0068] In one optional implementation, the log matching record corresponding to the target APP can be generated by summing the number of successful matches for the same pre-marked log segment. Specifically, the total number of successful matches for each pre-marked log segment generated by the target APP is determined, and the log matching result corresponding to the target APP is generated based on the correspondence between each pre-marked log segment and the total number of successful matches.

[0069] S103, Based on log matching records, determine the log analysis results of the target APP.

[0070] Since the log matching record is generated based on the matching results between the log information of the currently running target application (APP) and pre-marked log segments, the log matching record contains the final result obtained by matching the log information generated by the target APP with the pre-marked log segments. Therefore, this embodiment of the disclosure can determine the log analysis result of the target APP based on the log matching record, wherein the log analysis result can reflect the running status of the target APP. The log analysis result can be presented in various forms, and this embodiment does not impose any limitations. For example, the log analysis result can be a score, such as 80 or 90 points. The higher the score, the better the running status of the target APP.

[0071] In the log analysis method provided in this disclosure, firstly, log information of the currently running target application (APP) is obtained; then, based on the matching results of the log information and pre-tagged log fragments, the corresponding log matching record for the target APP is determined; further, based on the log matching record, the log analysis result of the target APP is determined. It is evident that this disclosure improves the automation level of log analysis, thereby increasing its efficiency.

[0072] Furthermore, since the log analysis method is implemented by matching pre-tagged log fragments with the log information of the currently running target APP, it can be seen that the log analysis method provided by the present disclosure does not require the participation of professional personnel, which lowers the professional threshold for participants in the highly professional problem of log analysis.

[0073] Based on the above embodiments, this disclosure allows for the use of tags to label different log segments. (See also...) Figure 2 The above is a flowchart of a method for determining log matching records provided in an embodiment of this disclosure, as follows: Figure 2 As shown, in this method, based on the matching results between log information and pre-tagged log fragments, the log matching record corresponding to the target APP is determined, including:

[0074] S201: Match log information with pre-tagged log segments.

[0075] In this embodiment, tags can characterize log fragments from one or more dimensions, thus allowing different tags to be assigned to different log fragments within a log template when the template is tagged. These tags can be set according to the type of the target app, and this embodiment does not impose such limitations. For example, if the target app is a short video app, which requires displaying an advertising page before the homepage upon startup, the tags could include advertising tags for marking advertising log information and homepage tags for marking homepage log information.

[0076] When performing log analysis, the real-time log information generated by the currently running target APP is matched with pre-tagged log fragments to determine whether the log information includes the same part as the log fragment.

[0077] Furthermore, during the process of tagging log fragments, corresponding tag records can also be generated. For example, if Must01 is used to tag the first log fragment ActivityThread,attachApplication, Must02 is used to tag the second log fragment ActivityThread,callActivityOnCreate, and Must03 is used to tag the third log fragment ConversationList:action:android.intent.action.MAIN, where Must01, Must02, and Must03 are all tags, the generated tag records are as follows:

[0078]

[0079] S202: If it is determined that the log information matches at least one log segment, then update the matching record of the tag marked by the at least one log segment.

[0080] The matching records include the number of successful matches for log segments marked with tags.

[0081] If the obtained log information matches at least one tagged log segment, the match count for that tagged log segment in the matching record is updated. For example, suppose a first log segment is tagged with a first tag and a second log segment is tagged with a second tag. If the currently generated log information matches the first and second log segments once each, the match count for the first log segment in the matching record is incremented by 1 to obtain the updated match count for the first tag, and the match count for the second log segment is incremented by 1 to obtain the updated match count for the second tag.

[0082] S203: Based on tag-based matching records, determine the log matching records corresponding to the target APP.

[0083] In one optional implementation, the log matching record corresponding to the target APP can be determined by summing the number of successful matches for log segments tagged with the same label. Specifically, the total number of successful matches for each tagged log segment is determined, and based on the correspondence between each tagged log segment and the total number of successful matches, the log matching result corresponding to the target APP is generated.

[0084] For example, such as Figure 3 As shown, the logs use Must01 to mark the first log segment "ActivityThread, attachApplication", the required content "02Must02" to mark the second log segment "ActivityThread, callActivityOnCreate", and Must03 to mark the third log segment "ConversationList:action:android.intent.action.MAIN". If the log information generated by the current target APP is "Activity Thread:ActivityThread, attachApplication", this log information matches the first log segment corresponding to Must01. The matching success count of Must01 in the matching record is updated from 0 to 1, and the matching of real-time generated log information continues. Finally, the log matching record shows that the matching success count of Must01, Must02, and Must03 is all 1. Among them, Must01, Must02, and Must03 are all tags.

[0085] In the log analysis method provided in this embodiment, log fragments are classified by tags, which reduces the categories recorded in the log matching records, thereby further improving the efficiency of log analysis.

[0086] In an optional implementation, based on the above embodiments, the tag may further have a tag level, which is used to characterize the impact of log fragments tagged with the tag level on the operation of the target APP. For example, the tag level includes, but is not limited to, any combination of one or more of the following tag levels:

[0087] FATAL: Indicates that the target app has crashed;

[0088] Error level ERROR: Indicates that a logical error has occurred in the target app, and this logical error may cause the target app to crash;

[0089] NECESSARY: This indicates that the log fragment corresponding to this label level must match the log information at least once. If no match is found, there must be a logical error.

[0090] Secondary level: This indicates that the log fragment and log information corresponding to this level of label may not match successfully, but if a match is not found, there may be a logical error.

[0091] OPTIONAL: This indicates that the log fragment corresponding to the tag at this level needs to match successfully in some application scenarios, but not in others, and that the application scenario is related to user operations.

[0092] VERBOSE: This indicates that the log segment corresponding to this tag level is a normal information output. The matching of this log segment is related to the operation of the target APP, and the log segment does not affect the normal operation of the target APP.

[0093] Accordingly, if log information is annotated using tags with label levels, then the log analysis results for determining the target APP based on log matching records described in the above embodiments include:

[0094] Based on the matching records of tags in the log matching records and the tag level of the tags, the log analysis results of the target APP are determined.

[0095] The log matching record is generated based on the matching results between the log information of the currently running target application (APP) and the log segments marked with tags. Therefore, the log matching record records the final result obtained by matching the log information generated by the target APP with the log segments marked with tags. Furthermore, the log matching record also includes the tag level, which allows determination of the impact of the successfully matched log information on the operation of the target APP. Therefore, this embodiment of the disclosure can determine the log analysis results of the target APP based on the log matching record and the tag level.

[0096] For example, suppose the tags with the necessary level NECESSARY include the tags Must01, Must02, and Must03. The log matching records show that each of the tags Must01, Must02, and Must03 was successfully matched once. Therefore, all tags with the NECESSARY level have been successfully matched, and the log analysis result indicates that the target APP is running well.

[0097] It should be noted that there are multiple methods for describing tag levels in this embodiment, including but not limited to: describing using JSON format files, describing using XML format files, and describing using YML format files. In addition to the above formats, configuration tools can also be used to generate corresponding tag level-related description methods through graphical interface operations. The description of tag levels using JSON format files is shown below:

[0098]

[0099]

[0100] In the log analysis method provided in this embodiment, corresponding tag levels are defined for tags, thereby improving the accuracy of log analysis based on the tag levels.

[0101] During the operation of the target app, some logs are generated in a sequential order. For example, when launching the app by clicking an icon, an advertising page will open first, followed by the target app's homepage. Therefore, in the logs generated under normal operation, the advertising page log information will appear first, followed by the homepage log information. Specifically, the method described in the above embodiment for determining the log matching record corresponding to the target app based on the matching results of log information and pre-marked log fragments includes:

[0102] Based on the matching results of the log information with the pre-tagged log fragments, and the matching results of the log information with the pre-configured log generation order, the log matching record corresponding to the target APP is determined.

[0103] The pre-configured log generation order includes log segments with sequential relationships.

[0104] In this embodiment, the log information generated by the target app includes portions that do not require sequence verification. Pre-labeled log segments can represent the analysis needs for logs with no sequential relationship. Therefore, the log information is matched with the pre-labeled log segments to obtain a matching result. The log information also includes portions that require sequence verification. A pre-configured log generation order can represent the analysis needs for logs with a sequential relationship. Therefore, the log information is matched with the pre-configured log generation order to obtain a matching result.

[0105] Furthermore, the total number of successful matches between the log information generated by the target app and each pre-labeled log segment is determined, as well as the total number of successful matches between the log information generated by the target app and each log segment with a sequential relationship. Based on the total number of successful matches between each pre-labeled log segment and the total number of successful matches between log segments with a sequential relationship, the log matching result corresponding to the target app is generated.

[0106] For example, the pre-marked log segments are "zygote64:Do partial code cachecollection" and "zygote64:After code cache collection". The pre-configured log generation order has the following sequence: first, the log segment "ActivityThread,attachApplication" matches successfully; then, the log segment "ActivityThread,callActivityOnCreate" matches successfully; and finally, the log segment "ConversationList:action:android.intent.action.MAIN" matches successfully. Assuming the log information includes "Activity Thread:ActivityThread,attachApplication", matching this log information against the pre-marked log segments results in 0 successful matches. Matching this log information against the pre-configured log generation order results in 1 successful match. The target app continues running, and the generated log information includes: "ActivityThread:ActivityThread,callActivityOnCreate", "ConversationList:action:android.intent.action.MAIN", and "zygote64:Do partial code cache". The log information "collection, code=52KB, data=58KB" and "zygote64:After code cache collection, code=52KB, data=58KB" are matched sequentially with pre-marked log fragments and the pre-configured log generation order to generate corresponding log matching records. These records show that "zygote64:Do partial codecache collection" and "zygote64:After code cache collection" each matched successfully once, along with "ActivityThread,attachApplication", "ActivityThread,callActivityOnCreate", and "ConversationList:action:android.intent.action".Each "MAIN" match was successful once, and "ActivityThread,callActivityOnCreate" was previously "ActivityThread,attachApplication", and "ConversationList:action:android.intent.action.MAIN" was previously "ActivityThread,callActivityOnCreate".

[0107] In the log analysis method provided in this embodiment, by matching with the log generation order, the corresponding matching result is obtained, thereby determining whether the log information was generated in the correct order, further improving the accuracy of log analysis.

[0108] In one optional implementation, the log information includes the current log information to be matched in the runtime log stream, and the matching result of the log information with the log generation order can be determined by a state machine. The state machine can record the matching status of the current log information with the log generation order by recording its state. Figure 4 For a flowchart of another method for determining log matching records provided in this disclosure embodiment, see [link to flowchart]. Figure 4 The above method determines the log matching record corresponding to the target APP based on the matching results of log information and pre-tagged log fragments, including:

[0109] S401, Match the current log information to be matched with the log fragment corresponding to the current state to be matched in the preset state machine.

[0110] The preset state machine includes states corresponding to log segments in the pre-configured log generation order.

[0111] In this embodiment, a log stream is generated in real time during the operation of the target APP. The log information in the log stream is matched with the log fragments corresponding to the current state to be matched in the preset state machine in the order of generation time until a match is successful.

[0112] S402, if it is determined that the current log information to be matched successfully matches the log fragment, then update the current state to be matched in the preset state machine.

[0113] If the current log information to be matched successfully matches the log segment corresponding to the current state to be matched in the state machine, it means that the target APP has completed the state corresponding to that log segment. Therefore, the next state of the state corresponding to that log segment in the state machine can be set as the current state to be matched, thereby updating the current state to be matched in the preset state machine. Figure 5As shown, the first log segment in the state machine is the advertising page log segment, and the state corresponding to this advertising page log segment is the advertising page state; the second log segment in the state machine is the homepage log segment, and the state corresponding to this homepage log segment is the homepage state. The current state to be matched in the state machine is the advertising page state. If the current log information to be matched successfully matches the advertising log segment, the current state to be matched in the state machine is updated to the homepage state.

[0114] S403, based on the matching results of each state in the preset state machine, determine the matching result of log information and log generation order.

[0115] The current log information to be matched generated by the target APP is matched with the current log information to be matched in the preset state machine. If all the log information generated by the target APP is matched, and if each state in the state machine is matched successfully in sequence, then the matching result of the log information and the log generation order is determined to be a successful match. If one or more states fail to match, then the matching result of the log information and the log generation order is determined to be a failed match.

[0116] Continue with Figure 5 For example, when matching begins, the current state to be matched in the preset state machine is the ad page state, which corresponds to the ad page log fragment. If the current log information to be matched successfully matches the ad page log fragment, the preset state machine enters the ad page state and updates the current state to be matched to the home page state. Furthermore, if the current log information to be matched in the runtime log stream matches the home page log fragment, the state machine enters the home page state. If all states in the state machine match successfully, then the matching result of the log information and the order in which the logs were generated is considered a successful match.

[0117] S404. Based on the matching results of log information with pre-tagged log fragments and the matching results of log information with the pre-configured log generation order, determine the log matching record corresponding to the target APP.

[0118] The implementation of this step is similar to that in the above embodiments, and will not be repeated here. In the log analysis method provided in this disclosure, the sequential relationship of log information is determined by a state machine, which improves the accuracy of detecting log segments with sequential relationships, thereby further improving the accuracy of log analysis.

[0119] In one optional implementation, the log information includes currently matching log information in the runtime log stream, and log segments with sequential relationships in the log generation order are pre-tagged. Figure 6 For a flowchart of another method for determining log matching records provided in this disclosure embodiment, see [link to flowchart]. Figure 6The above method determines the log matching record corresponding to the target APP based on the matching results of log information and pre-tagged log fragments, including:

[0120] S601, Match the current log information to be matched with the current log segment to be matched in the log generation order.

[0121] In this embodiment, a log stream is generated in real time during the operation of the target APP. The log information in the log stream is matched with the current log segment to be matched in the log generation order according to the generation time order, until a match is successful.

[0122] S602, if it is determined that the current log information to be matched successfully matches the current log segment to be matched in the log generation order, then update the matching record of the tag marked by the current log segment to be matched.

[0123] The matching record includes tags and their corresponding number of successful matches. If the current log information to be matched successfully matches the current log segment to be matched, the matching record of the tag marked by the current log segment to be matched is updated.

[0124] For example, suppose the tag Must02 has not yet been matched successfully. The current log information to be matched in the log stream is Activity Thread:ActivityThread,callActivityOnCreate. In the log generation order, the current log fragment to be matched is ActivityThread,callActivityOnCreate (corresponding to the tag Must02). If the match is successful, the matching record for tag Must02 will be updated from 0 to 1 in the matching record.

[0125] S603, based on tag-based matching records, determines the matching result between log information and the pre-configured log generation order.

[0126] In one optional implementation, once all log information generated by the target app has been matched, the matching records of the tags can be summarized to determine the matching result between the log information and the pre-configured log generation order based on the tag matching records. Optionally, the matching result may include the number of successful matches of tags marking log segments in the log generation order and the matching order of the tags.

[0127] S604, based on the matching results of log information with pre-tagged log fragments, and the matching results of log information with the pre-configured log generation order, determines the log matching record corresponding to the target APP. To more clearly illustrate how the log matching record is determined, an example is provided below:

[0128] Assuming the pre-configured log generation order is tagged with Must01 first, then Must02, and then Must03, and the pre-tagged log fragment is labeled Verbose, in the matching results between log information and log generation order, Must01 matches once, Must02 matches once after Must01, and Must03 matches once after Must02. In the matching results between log information and log fragment, Verbose matches 20 times. Then the log matching records for this target app can be as follows:

[0129]

[0130]

[0131] In the log analysis method provided in this embodiment, log fragments with sequential relationships in the log generation order are classified using tags, which reduces the categories recorded in the log matching records and further improves the efficiency of log analysis.

[0132] In an optional implementation, based on the above embodiments, the tag may also have a tag level, which is used to characterize the impact of log fragments marked with the tag level on the operation of the target APP. The method of dividing the tag level can be similar to that in the above embodiments, and will not be repeated here.

[0133] Furthermore, in the above embodiments, determining the log analysis results of the target APP based on log matching records includes:

[0134] Based on the matching records of tags in the log matching records and the tag level of the tags, the log analysis results of the target APP are determined.

[0135] The log matching records include: matching records of tags used to characterize the matching results of log information and log generation order, and matching records of tags used to characterize the matching results of log information and pre-tagged log fragments.

[0136] The generation of log matching records is based on the matching results of the log information of the currently running target application (APP) with the following two pieces of information: first, the matching result with log segments; and second, the matching result with the log generation order. Therefore, the log matching record contains the final result obtained by matching the log information generated by the target APP with log segments and the log generation order. This final result is represented in the form of a tag matching record, where each tag has a corresponding tag level. The tag level represents the impact of the log information on the operation of the target APP. Therefore, this embodiment of the disclosure can determine the log analysis results of the target APP based on the log matching record and the tag levels.

[0137] For example, suppose the order of tags obtained according to the log generation order is as follows: Must01 is followed by Must02, Must02 is preceded by Must01, Must02 is followed by Must03, and Must03 is preceded by Must02. The tag levels for Must01, Must02, and Must03 are all NECESSARY, meaning that all three tags must successfully match in the log information. In a pre-labeled log segment, the tag is Verbose, and its tag level is VERBOSE, meaning that the success or failure of the Verbose tag match does not affect the correct operation of the program. The above tag levels and the order relationship between tags are represented as follows:

[0138]

[0139] Based on the above background, the following is an example of the log analysis results for the target APP:

[0140] Example 1: All log information analysis is complete, but the Must01 tag is not matched. Since the tag level corresponding to the Must01 tag is NECESSARY, the log analysis result of the target APP is that the target APP is running abnormally.

[0141] Example 2: The Must02 tag was matched, but after analyzing all log information, the Must03 tag was not matched. Since the tag level corresponding to the Must03 tag is NECESSARY, the log analysis result of the target APP is that the target APP is running abnormally.

[0142] Example 3: After Must02 matches successfully twice, Must03 matches successfully. Before the two successful matches of Must02, Must01 did not match successfully. The log matching record shows that Must02 matched successfully twice and Must03 matched successfully once. The preceding tag of Must03 is Must02, and Must01 is missing twice. The log analysis result corresponding to this log matching record is that the target APP is running abnormally. The log matching record can be as follows:

[0143]

[0144]

[0145] The log analysis method provided in this disclosure simplifies the process required for sequential verification of log information by matching log fragments in the order of log generation, thereby improving the efficiency of log information analysis. Furthermore, by marking log fragments with tags and classifying them, the number of categories recorded in the log matching records is reduced, which also improves the efficiency of log analysis. In addition, the setting of tag levels further improves the accuracy of log analysis.

[0146] Based on the above embodiments, the log information of the target APP can also be quantitatively scored. Figure 7 A flowchart of a method for scoring log information provided in this disclosure embodiment is shown below. Figure 7 As shown, in the above embodiments, the log analysis results of the target APP are determined based on the matching records of tags in the log matching records and the tag level of the tags, including:

[0147] S701: Determine the total deduction score corresponding to the matching record of the tag in the log matching record according to the pre-set correspondence between the tag level and the deduction score.

[0148] Specifically, the label level is directly proportional to the impact of log segments tagged with that label on the target app's operation, and also directly proportional to the points deducted. Understandably, a higher label level means a greater impact of the corresponding log segments on the target app's operation, and consequently, more points are deducted; conversely, a lower label level means a smaller impact of the corresponding log segments on the target app's operation, and fewer points are deducted.

[0149] In this embodiment, the pre-set correspondence between the tag level and the deduction score can be set according to the application scenario of the target APP, the experience of those skilled in the art, etc., and the total deduction score corresponding to the log information is determined according to the tag matching record in the log matching record.

[0150] For example, in one alternative implementation, if the maximum score is 100 points, the correspondence between the label level and the deduction points can be as follows:

[0151]

[0152] S702: The score obtained by deducting the total score from the preset full score will be determined as the log analysis result of the target APP.

[0153] The log analysis results are used to characterize the probability of the target app's operation being abnormal, and the probability of operation being abnormal is inversely proportional to the score. Understandably, the higher the score, the lower the probability of the target app operating abnormally; the lower the score, the higher the probability of the target app operating abnormally.

[0154] Continuing with the example of the relationship between the label level and the deduction score, suppose there is one instance of a missing SECONDARY in the log matching record, and there are 220 instances of VERBOSE with a threshold of 100. Therefore, the total deduction score is 32 points. If the full score is 100 points, the corresponding score is 68 points. The log analysis result of the target APP is 68 points.

[0155] In the log analysis method provided in this embodiment, the log analysis results are displayed intuitively through a score, thereby improving the efficiency of log analysis while lowering the threshold for log analysis. Even non-professionals can determine the current running status of the target APP through the score.

[0156] Based on the same inventive concept as the above embodiments, this disclosure also provides a log analysis device, referencing... Figure 8 This is a schematic diagram of a log analysis device provided in an embodiment of the present disclosure. The device includes:

[0157] The acquisition module 801 is used to acquire the log information of the currently running target application APP;

[0158] The matching module 802 is used to determine the log matching record corresponding to the target APP based on the matching result between the log information and the pre-marked log fragments; wherein, the pre-marked log fragments are obtained by marking based on the log template corresponding to the target APP, and the log template includes the log information generated by the target APP in a preset running state;

[0159] The result module 803 is used to determine the log analysis result of the target APP based on the log matching record; wherein the log analysis result is used to reflect the running status of the target APP.

[0160] In one optional implementation, the pre-tagged log fragments include log fragments pre-tagged with labels; the matching module 802 includes:

[0161] The first matching unit is used to match the log information with the pre-tagged log fragments;

[0162] The first update unit is configured to update the matching record of the tag marked by the at least one log segment if it is determined that the log information matches at least one log segment; wherein the matching record includes the number of times the log segment marked with the tag has been successfully matched;

[0163] The first determining unit is used to determine the log matching record corresponding to the target APP based on the matching record of the tag.

[0164] In one optional implementation, the tag has a tag level, which characterizes the impact of log fragments tagged with the tag level on the operation of the target APP; the first determining unit is configured to:

[0165] Based on the matching records of tags in the log matching records and the tag level of the tags, the log analysis results of the target APP are determined.

[0166] In one optional implementation, the matching module 802 includes:

[0167] The second determining unit is used to determine the log matching record corresponding to the target APP based on the matching result of the log information with the pre-tagged log fragments and the matching result of the log information with the pre-configured log generation order; wherein, the log generation order includes log fragments with sequential relationship.

[0168] In an optional implementation, the matching module 802 further includes:

[0169] The second matching unit is used to match the current log information to be matched with the log fragment corresponding to the current state to be matched in the preset state machine; wherein, the preset state machine includes states corresponding to log fragments in the pre-configured log generation order;

[0170] The second update unit is used to update the current matching state in the preset state machine if it is determined that the current log information to be matched successfully matches the log fragment.

[0171] The third determining unit is used to determine the matching result between the log information and the log generation order based on the matching result of each state in the preset state machine.

[0172] In an optional implementation, the log information includes currently unmatched log information in the runtime log stream, and log segments with sequential relationships in the log generation order are pre-labeled; the matching module 802 further includes:

[0173] The third matching unit is used to match the current log information to be matched with the current log segment to be matched in the log generation order;

[0174] The third update unit is used to update the matching record of the tag marked by the current log segment to be matched if it is determined that the current log information to be matched is successfully matched with the current log segment to be matched in the log generation order.

[0175] The fourth determining unit is used to determine the matching result between the log information and the pre-configured log generation order based on the matching records of the tags.

[0176] In one optional implementation, the tag has a tag level, which is used to characterize the impact of log fragments tagged with the tag level on the operation of the target APP; the log matching record corresponding to the target APP includes a tag matching record for characterizing the matching result of the log generation order and a tag matching record for characterizing the matching result of the log information with the pre-tagged log fragments.

[0177] The result module 803 includes:

[0178] The fifth determining unit is used to determine the log analysis result of the target APP based on the matching records of tags in the log matching records and the tag level of the tags.

[0179] In an optional implementation, the first determining unit or the fifth determining unit is configured to:

[0180] According to the pre-set correspondence between tag levels and deduction scores, the total deduction score corresponding to the tag matching record in the log matching record is determined; wherein, the tag level is directly proportional to the degree of influence of the log fragment marked with the tag level on the operation of the target APP, and is also directly proportional to the deduction score;

[0181] The score obtained by deducting the total deduction from the preset full score is determined as the log analysis result of the target APP; wherein, the log analysis result is used to characterize the probability of the target APP's abnormal operation, and the probability of abnormal operation is inversely proportional to the score.

[0182] In addition to the methods and apparatus described above, this disclosure also provides a computer-readable storage medium storing instructions that, when executed on a terminal device, cause the terminal device to implement the log analysis method described in this disclosure.

[0183] This disclosure also provides a computer program product, which includes a computer program / instruction that, when executed by a processor, implements the log analysis method described in this disclosure.

[0184] In addition, this disclosure also provides a log analysis device, see [link to relevant documentation]. Figure 9 As shown, it may include:

[0185] The log analysis device includes a processor 901, a memory 902, an input device 903, and an output device 904. The number of processors 901 in the log analysis device can be one or more. Figure 9 Taking a processor as an example. In some embodiments of this disclosure, the processor 901, memory 902, input device 903, and output device 904 can be connected via a bus or other means, wherein, Figure 9 Taking the example of a connection between China and Israel via a bus.

[0186] The memory 902 can be used to store software programs and modules. The processor 901 executes various functional applications and data processing of the log analysis device by running the software programs and modules stored in the memory 902. The memory 902 may mainly include a program storage area and a data storage area. The program storage area may store the operating system, at least one application program required for a function, etc. In addition, the memory 902 may include high-speed random access memory, and may also include non-volatile memory, such as at least one disk storage device, flash memory device, or other volatile solid-state storage device. The input device 903 can be used to receive input digital or character information, and to generate signal inputs related to user settings and function control of the log analysis device.

[0187] Specifically in this embodiment, the processor 901 will load the executable files corresponding to the processes of one or more applications into the memory 902 according to the following instructions, and the processor 901 will run the applications stored in the memory 902 to realize the various functions of the log analysis device described above.

[0188] It should be noted that, in this document, relational terms such as "first" and "second" are used merely to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes said element.

[0189] The above description is merely a specific embodiment of this disclosure, enabling those skilled in the art to understand or implement it. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this disclosure. Therefore, this disclosure is not to be limited to the embodiments described herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A log analysis method characterized by, The method comprises: obtaining log information of a target application APP currently running; wherein the log information comprises current to-be-matched log information in a runtime log stream; determining a log matching record corresponding to the target APP based on a matching result of the log information and a pre-labeled log segment; wherein the pre-labeled log segment is labeled based on a log template corresponding to the target APP, and the pre-labeled log segment comprises a log segment pre-labeled with a label, and the log template comprises log information generated by the target APP in a preset running state; determining a log analysis result of the target APP based on the log matching record; wherein the log analysis result is used to reflect a running state of the target APP; wherein the determining of the log matching record corresponding to the target APP based on the matching result of the log information and the pre-labeled log segment comprises: determining the log matching record corresponding to the target APP based on the matching result of the log information and the pre-labeled log segment and a matching result of the log information and a pre-configured log generation sequence; wherein the log generation sequence comprises log segments having a sequential relationship, and the log segments having the sequential relationship in the log generation sequence are pre-labeled with a label; before the determining of the log matching record corresponding to the target APP based on the matching result of the log information and the pre-labeled log segment and the matching result of the log information and the pre-configured log generation sequence, the method further comprises: matching the current to-be-matched log information with a current to-be-matched log segment in the log generation sequence; if it is determined that the current to-be-matched log information and the current to-be-matched log segment in the log generation sequence match successfully, updating a matching record of the label labeled by the current to-be-matched log segment; determining the matching result of the log information and the pre-configured log generation sequence based on the matching record of the label.

2. The method of claim 1, wherein, the determining of the log matching record corresponding to the target APP based on the matching result of the log information and the pre-labeled log segment comprises: matching the log information with the pre-labeled log segment; if it is determined that the log information and at least one log segment match successfully, updating a matching record of the label labeled by the at least one log segment; wherein the matching record comprises a matching success number of the log segment labeled with the label; determining the log matching record corresponding to the target APP based on the matching record of the label.

3. The method of claim 2, wherein, the label has a label level, and the label level is used to represent an influence of a log segment labeled with the label level on the running of the target APP; the determining of the log analysis result of the target APP based on the log matching record comprises: determining the log analysis result of the target APP based on the matching record of the label in the log matching record and the label level of the label.

4. The method of claim 1, wherein, The log information includes current to-be-matched log information in a runtime log stream, and the log matching record corresponding to the target APP is determined based on a matching result of the log information and a pre-labeled log segment and a matching result of the log information and a pre-configured log generation sequence. The current to-be-matched log information is matched with a log segment corresponding to a current to-be-matched state in the preset state machine, wherein the preset state machine includes states corresponding to log segments in the pre-configured log generation sequence respectively; If it is determined that the current to-be-matched log information matches the log segment successfully, the current to-be-matched state in the preset state machine is updated; The matching result of the log information and the pre-configured log generation sequence is determined based on matching results of the states in the preset state machine.

5. The method of claim 1, wherein, The label has a label level, the label level is used to represent the influence of the log segment labeled with the label level on the running of the target APP, and the log matching record corresponding to the target APP includes a matching record of a label used to represent the matching result of the log generation sequence and a matching record of a label used to represent the matching result of the log information and the pre-labeled log segment; The log analysis result of the target APP is determined based on the log matching record, including: The log analysis result of the target APP is determined based on the matching record of the label in the log matching record and the label level of the label.

6. The method according to claim 3 or 5, characterized in that, The log analysis result of the target APP is determined based on the matching record of the label in the log matching record and the label level of the label, including: According to a preset corresponding relationship between the label level and the deduction score, a total deduction score corresponding to the matching record of the label in the log matching record is determined, wherein the label level and the influence degree of the log segment labeled with the label level on the running of the target APP are in a positive proportional relationship, and the label level and the deduction score are in a positive proportional relationship; A score value obtained by deducting the total deduction score from a preset full score is determined as the log analysis result of the target APP, wherein the log analysis result is used to represent the running anomaly probability of the target APP, and the running anomaly probability and the score value are in an inverse proportional relationship.

7. A log analysis apparatus characterized by comprising: The device includes: An acquisition module is configured to acquire log information of a target application program (APP) currently running, wherein the log information includes current to-be-matched log information in a runtime log stream; A matching module is configured to determine a log matching record corresponding to the target APP based on a matching result of the log information and a pre-labeled log segment, wherein the pre-labeled log segment is labeled based on a log template corresponding to the target APP, the pre-labeled log segment includes a log segment labeled with a label in advance, and the log template includes log information generated by the target APP in a preset running state. A result module is configured to determine a log analysis result of the target APP based on the log matching record, wherein the log analysis result is used to reflect a running state of the target APP. The log matching record corresponding to the target APP is determined based on the matching result of the log information and the pre-labeled log segment, and the log matching record corresponding to the target APP is determined based on the matching result of the log information and the pre-configured log generation sequence. The log matching record corresponding to the target APP is determined based on the matching result of the log information and the pre-labeled log segment, and the matching result of the log information and the pre-configured log generation sequence, wherein the log generation sequence comprises log segments having a sequential relationship, and the log segments having a sequential relationship in the log generation sequence are pre-labeled with a label. Before the log matching record corresponding to the target APP is determined based on the matching result of the log information and the pre-labeled log segment, and the matching result of the log information and the pre-configured log generation sequence, the method further comprises: matching the current log information to be matched with a current log segment to be matched in the log generation sequence; if it is determined that the current log information to be matched matches the current log segment to be matched in the log generation sequence, updating the matching record of the label labeled by the current log segment to be matched; determining the matching result of the log information and the pre-configured log generation sequence based on the matching record of the label.

8. A computer-readable storage medium, characterized in that, The computer readable storage medium stores instructions, and when the instructions are run on a terminal device, the terminal device implements the method in any one of claims 1-6.

9. An electronic device, comprising: The computer readable storage medium stores instructions, and when the instructions are run on a terminal device, the terminal device implements the method in any one of claims 1-6. The computer readable storage medium stores instructions, and when the instructions are run on a terminal device, the terminal device implements the method in any one of claims 1-6.

10. A computer program product, characterised in that, The computer program product comprises computer programs / instructions, and when the computer programs / instructions are executed by a processor, the method in any one of claims 1-6 is implemented.

Images