Log recording processing method and device and computer device

Abstract

The application relates to a log record processing method and device and computer equipment, and relates to the technical field of file processing. The method comprises the following steps: acquiring a plurality of configuration items; analyzing the plurality of configuration items to obtain one or more target rules used for matching, a screening configuration item, and an event list used for data processing; screening log records to be processed according to the screening configuration item, loading the screened log records; traversing the loaded log records, matching the target rules with corresponding data in the traversed log records, obtaining non-compliant matching results of the traversed log records under the target rules; and processing the non-compliant matching results according to the processing action types of the event list. The method can reduce the possibility of missing log records, make the log record investigation more complete, improve the processing efficiency, and reduce the learning cost for users.

Description

Technical Field

[0001] This application relates to the field of document processing technology, and in particular to a log recording processing method, apparatus and computer equipment. Background Technology

[0002] Log files are files in computer systems that record system activities, events, and errors. They can be used to monitor and diagnose system performance problems. In the field of network security, log files are also widely used to detect and respond to security incidents. Currently, many business systems, especially some business systems running in semiconductor manufacturing plants and various smart factories, continuously record a large number of logs for later debugging and troubleshooting. Therefore, the analysis and processing of log files has become an indispensable part of network security and system management.

[0003] Typically, after a business system is deployed, it encounters relatively more problems during the initial operation or trial period, requiring prompt debugging and updates. Once the business system is officially running, troubleshooting is crucial in case of failures. This usually requires operations personnel or developers to access the relevant log files of the business system and then use log viewers to locate or troubleshoot the problem. However, while log viewers can filter out most log records that are not helpful in locating or troubleshooting problems, they are inefficient and the captured data is not always complete. Summary of the Invention

[0004] Therefore, it is necessary to provide a log recording and processing method, apparatus, and computer equipment to address the aforementioned technical problems.

[0005] Firstly, this application provides a log recording processing method. The method includes:

[0006] Retrieve several configuration items;

[0007] Parse several of the configuration items to obtain one or more target rules for matching, filter the configuration items, and obtain a list of events for data processing;

[0008] Based on the filtering configuration items, filter the log records to be processed and load the filtered log records;

[0009] The loaded log records are traversed, and the target rule is matched with the corresponding data in the traversed log records to obtain the non-compliant matching results of the traversed log records under the target rule;

[0010] The non-compliant matching results are processed according to the corresponding processing action type in the event list.

[0011] In one embodiment, the acquisition of target rules and target configuration items related to data processing includes:

[0012] Displays the processing configuration interface, which includes predefined rules and predefined configuration items;

[0013] In response to the configuration item selection operation and rule selection operation based on the processing configuration interface, the corresponding selected predefined rules and predefined configuration items are determined and used as target rules and target configuration items, respectively.

[0014] In one embodiment, before processing the non-compliant matching results, the method further includes:

[0015] According to preset processing rules, duplicate events are filtered out from the events in the event list.

[0016] In one embodiment, for different events of the same processing action type in the event list, the preset processing rule includes at least one of a first processing rule for determining duplicate events based on a first number of event information for each of the different events, or a second processing rule for determining duplicate events based on a second number of event information for each of the different events.

[0017] Secondly, this application also provides a log recording and processing apparatus, the apparatus comprising:

[0018] The acquisition module is used to acquire several configuration items related to data processing.

[0019] The parsing module is used to parse several configuration items to obtain one or more target rules for matching, filter configuration items, and an event list for data processing, the event list including a presentation event list and / or a capture event list;

[0020] The filtering module is used to filter out log records to be processed according to the filtering configuration items and load the filtered log records.

[0021] The log traversal module is used to traverse the loaded log records;

[0022] The matching module is used to match the target rule with the corresponding data in the traversed log records for the purpose of obtaining the non-compliant matching results of the traversed log records under the target rule.

[0023] The processing module is used to process the non-compliant matching results according to the corresponding processing action type of the event list.

[0024] Thirdly, this application also provides a computer device. The computer device includes a memory and a processor, the memory storing a computer program, and the processor executing the computer program to perform the following steps:

[0025] Retrieve several configuration items;

[0026] Parse several of the configuration items to obtain one or more target rules for matching, filter the configuration items, and obtain a list of events for data processing;

[0027] Based on the filtering configuration items, filter the log records to be processed and load the filtered log records;

[0028] The loaded log records are traversed, and the target rule is matched with the corresponding data in the traversed log records to obtain the non-compliant matching results of the traversed log records under the target rule;

[0029] The non-compliant matching results are processed according to the corresponding processing action type in the event list.

[0030] The aforementioned log processing methods, devices, and computer equipment, by setting target configuration items and target rules, can filter and selectively target log records that require troubleshooting. This reduces the possibility of missing log records, resulting in more complete log processing and improved efficiency by filtering out unnecessary log records. Furthermore, compared to the higher learning curve and fixed troubleshooting methods of log viewers, users can modify and recreate predefined configuration items and rules as needed, making log processing more flexible and efficient while reducing the learning curve. Attached Figure Description

[0031] Figure 1 This is an application environment diagram of a log recording processing method in one embodiment;

[0032] Figure 2 This is a flowchart illustrating a log recording processing method in one embodiment;

[0033] Figure 3 Example diagram of the configuration item viewing and modification interface in one embodiment;

[0034] Figure 4 This is a flowchart illustrating the log recording processing method in another embodiment;

[0035] Figure 5 This is a schematic diagram of the detail panel configuration file corresponding to the logger in one embodiment;

[0036] Figure 6 This is an example of how log entries are displayed in the details panel.

[0037] Figure 7 This is a structural block diagram of a log recording processing device in one embodiment;

[0038] Figure 8 This is an internal structural diagram of a computer device in one embodiment. Detailed Implementation

[0039] To make the objectives, technical solutions, and advantages of this application clearer, the following detailed description is provided in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are merely illustrative and not intended to limit the scope of this application.

[0040] This application relates to the field of data capture technology, and in particular to a log recording processing method and apparatus.

[0041] Currently, many business systems, especially those running in semiconductor manufacturing plants and various smart factories, continuously generate a large number of log records for debugging, troubleshooting, and auditing. A log record is a representation of a single recorded event. It is typically a structured text string and includes at least a timestamp, log level, logger name, and message. These parts are separated by separators such as "|". Generally, after a business system is deployed, more problems arise during the initial operation or trial period, requiring rapid debugging and possibly necessary updates. After the business system is officially launched, any failures require immediate troubleshooting. This usually requires on-site or field operations personnel or developers to retrieve the relevant log records of the business system and then use relevant log viewers or manual methods to locate or troubleshoot the problem. To ensure high efficiency in problem resolution, locating or troubleshooting issues requires relevant personnel to be familiar with business rules or have received relevant business training. The captured data should typically include relevant data from several time periods before and after the fault occurred (referred to as context data) to ensure it is sufficient for problem resolution (debugging, troubleshooting), or simply "complete." While most current log viewers can filter out a significant number, if not most, of log records that are unhelpful in locating or troubleshooting issues, they remain inefficient or capture incomplete or incomprehensible data, and require substantial training for operations personnel.

[0042] This application provides an embodiment of a log recording processing method. By configuring target rules and target configuration items, log records to be processed can be filtered and loaded. After attaching the target rules, matching conditions and a list of processing events are obtained based on the parsing results of the target rules, and the loaded log records are traversed. The loaded log records are matched against the matching conditions. When multiple target rules do not match the same data point of the same log record, duplicate rendering and capture actions will occur. Therefore, duplicate actions in the rendering event list and duplicate actions in the capture event list are filtered before rendering, so as to save computing resources while achieving the purpose of intuitive rendering and efficient capture of the required data.

[0043] Specifically as follows:

[0044] The log recording processing method provided in this application embodiment can be applied to, for example, Figure 1 In the application environment shown, terminal 102 communicates with server 104 via a network. A data storage system can store the data that server 104 needs to process. The data storage system can be integrated onto server 104 or placed on a cloud or other network server. Server 104 is used to acquire and parse several configuration items to obtain one or more target rules for matching, filter configuration items, and a list of events for data processing; filter log records to be processed, and load the filtered log records; iterate through the loaded log records, matching the target rules with the corresponding data in the traversed log records to obtain non-compliant matching results of the traversed log records under the target rules; and process the non-compliant matching results according to the corresponding processing action type in the event list. Terminal 102 is used to present the processed matching results.

[0045] The terminal 102 can be, but is not limited to, various personal computers, laptops, smartphones, tablets, IoT devices, and portable wearable devices. IoT devices can include smart speakers, smart TVs, smart air conditioners, and smart in-vehicle systems. Portable wearable devices can include smartwatches, smart bracelets, and head-mounted devices. The server 104 can be implemented using a standalone server or a server cluster consisting of multiple servers.

[0046] In one embodiment, such as Figure 2 As shown, a log recording processing method is provided, which is applied to... Figure 1 Taking the server in the example, the following steps are included:

[0047] Step S202: Obtain several configuration items.

[0048] Configuration items refer to the parameters and options used to configure and control the acquisition and processing of log records. For example, configuration items can be set to specify the storage path for log records, the method of log record processing, log record configuration, log record filtering rules, etc.

[0049] Retrieving configuration items refers to obtaining the rules and other configuration items used to define and configure logging processing. (See also...) Figure 3 When users open the configuration interface of the business system, they need to navigate to the target rules and target configuration item settings section, which is usually a specific area or tab. In the target rule settings area, users can fill in or select the corresponding rules one by one according to their needs. In the other configuration item settings area, users can fill in or select the corresponding configuration items one by one according to their needs, such as storage path, log recording processing method, logger configuration, data filtering rules, etc. After completing the input of several configuration items, users can verify the configuration items to ensure that the input configuration items meet the requirements. If the configuration verification passes, users can save the configuration and make it effective. After saving the configuration, users can perform data processing operations. The business system performs subsequent operations such as presentation, capture, storage, and packaging based on the target rules and target configuration items entered by the user.

[0050] For example, in the "Logger Configuration" group, one can determine the logger to be selected, the category of the panel component provided by the logger presentation module to be used for the logger corresponding to each logger, and the related configuration file; in the "Rule Set" group, one can determine the rule to be selected, view the rule name, keyword list and description of each rule, and browse the complete content of the currently selected rule.

[0051] Step S204: Parse several configuration items to obtain one or more target rules for matching, filter configuration items, and a list of events for data processing.

[0052] The specific method for parsing several configuration items can be as follows: The system examines the HTML structure of the webpage to locate the element containing the configuration item. Based on the attribute or class name of the configuration item element, it obtains information that uniquely identifies the configuration item. Then, based on the identifier, JavaScript or other front-end scripting technologies are used to retrieve the value of the configuration item. DOM manipulation methods, such as getElementById, getElementsByClassName, and getAttribute, can be used to obtain the value of the configuration item. The retrieved value is then parsed and processed according to the data type and format of the configuration item. For example, if the configuration item is a dropdown menu, the value of the selected option can be retrieved.

[0053] In this context, the target rule refers to a specific rule or condition, similar to a business rule in a rule engine. It includes an ID, name, version number, description, data points involved, a list of keywords, one or more conditions, and an action to be performed when the conditions are met. Each condition corresponds to a Boolean expression. Actions include identifying the level of non-compliance in log data, presenting a list of related events, and capturing a list of related events. Filter configuration items refer to the parameters and options used to configure and control the acquisition and processing of log records. For example, filter configuration items can be set to specify a time range, log level, and logger name.

[0054] By acquiring and configuring target rules and filtering configuration items, and customizing the log records to be acquired, flexible control and visual operation of the log acquisition and processing process can be achieved, reducing the need for operation and maintenance personnel to be familiar with business rules or receive relevant business training.

[0055] In the log recording process, the event list used for data processing refers to a series of operations or processing steps performed on the filtered log records after the log record filtering is completed, such as processing operations such as presenting and capturing log data.

[0056] Step S206: Based on the filtering configuration items, filter the log records to be processed and load the filtered log records. Specifically, based on the log record processing parameters and options set by the user in the filtering configuration items, such as which time period to load only, which loggers to load only, and which levels of log records to load only, load the log records from the relevant log files that meet these configuration items; filter the log records from the original log records that meet the requirements of the filtering configuration items, and load these filtered log records into memory for subsequent data processing operations. By filtering and loading log records, users can perform data processing on specific log records, such as log analysis, log presentation, and log capture. This can improve the efficiency and accuracy of subsequent log record capture and processing, while reducing the amount of data processed, making subsequent log record processing operations more efficient and accurate.

[0057] The following is an example of a log record:

[0058] 2023-02-04 10:04:30.6053|DEBUG|OHTIOLOG|[V01C002]=>{"PLCStationId":"1","MSTCAddrStart":1475,"MSTCAddrLen":445,"AddrStart":10100,"AddrLen" ; ,95,104,2505,15,0,0,0,0,0,0,0,0,1,3,21085,0,6,32004,0,16390,320 33,0,32720,0,0,0,…0,0],"OHTIO":[20,0,4,0,0,0,0,0,0,0,0,0,0,0,0, 0,0,0,0,4493,32033,0,12388,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1053,0,0,0,32,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0]}.

[0059] The log entry is separated by "|"; the timestamp is "2023-02-04 10:04:30.6053"; the log level is "DEBUG"; the logger name is "OHTIOLOG"; the message is a string starting with "[V01C002]" and ending with "]},"; this log entry describes the status information of the object "V01C002" at the time corresponding to that timestamp. The logger name and message are usually related to specific business logic.

[0060] The example log entry contains timestamp, log level, logger name, "PLCStationId", "MSTCAddrStart", "MSTCAddrLen", "AddrStart", "AddrLen", "Msg", "MSTCOHTIO", and "OHTIO". "MSTCOHTIO" is an array of 445 unsigned short integers, and "OHTIO" is an array of 70 unsigned short integers. These data, along with each short integer in these two arrays and each bit of these short integers, constitute the complete data points of this log entry. The data point corresponding to the 0th bit of the first unsigned short integer of "OHTIO" can be described as "{"name":"OHTIO_0_0","dataType":"uint1","valueRange":{"enum":[0,1]},"alias":"InService","description":"Entering job (controlled online by command)"}".

[0061] Step S208: Iterate through the loaded log records, match the target rule with the corresponding data in the iterated log records, and obtain the non-compliant matching results of the iterated log records under the target rule.

[0062] Before iterating through log records, target rules need to be mounted. Mounting target rules typically means applying them to the corresponding business system to make them effective. Once the target rules are mounted, various traversal operations can be performed on the loaded log records, such as filtering, selection, aggregation, and calculation. These operations can be executed based on the conditions and operations defined in the target rules. Based on the mounted target rules, an action category set is obtained, and certain data capture functions that need to be enabled before starting log record traversal, such as screenshots and screen recordings, are determined and enabled. Then, each log record in each log file that needs to be accessed is traversed sequentially, and each non-compliant log record under the target rules is matched and processed, and the matching results are output.

[0063] The levels of the target rules for data non-compliance, such as "none," "trace," "warning," "error," and "fatal," are used to roughly describe the degree of non-compliance in log data.

[0064] By iterating through the loaded log records, each log record can be processed one by one, and further operations can be performed as needed. Specifically, if the user selects "Automatically start log traversal after loading log records" in the configuration settings, log traversal will automatically start after loading log records.

[0065] Step S210: Process non-compliant matching results according to the corresponding processing action type in the event list.

[0066] Specifically, in this solution, for example, the processing action types include presentation actions and capture actions. After obtaining the matched log records, the log records are presented as needed, allowing relevant personnel to intuitively locate unqualified data points. Then, the unqualified data points are captured accordingly. It's important to note that before this, duplicate event filtering can be performed on the event list. That is, if a log record is subjected to duplicate presentation and capture actions, it is considered a duplicate operation and needs to be filtered, thereby reducing subsequent computational load and improving computational efficiency. In the above log processing method, by setting filtering configuration items and target rules, log records requiring investigation can be filtered and selected selectively. For log records requiring investigation, the possibility of missing these log records can be reduced, making the investigation log records more complete and filtering out log records that do not require investigation to improve processing efficiency. In addition, compared to the high learning cost and rigid troubleshooting methods of log viewers, users can modify and recreate predefined configuration items and rules as needed, which makes log processing more flexible and efficient and reduces the learning cost.

[0067] In one embodiment, duplicate events are filtered out from events in the event list according to preset processing rules.

[0068] First, define the preset processing rules for determining whether events in the event list are duplicates. Then, iterate through the event list one by one using these rules, comparing each event. If multiple events satisfy the preset rules, it means that multiple events in the event list are duplicates, such as repeatedly highlighting the same point in a log record; these are then marked as duplicate events. Depending on the requirements, you can choose to retain the first occurrence of the event, or retain a few events based on a certain strategy, and delete the remaining duplicate events from the event list or mark them as invalid. As needed, you can update the event list, save the retained duplicate events, or perform other operations.

[0069] Based on the above embodiments, the purpose of duplicate event filtering is to reduce duplication. By pre-setting processing rules, duplicate events can be flexibly filtered according to specific business needs and data characteristics to meet the needs of data processing and analysis.

[0070] The preset processing rules include at least one of the following: a first processing rule for determining duplicate events based on a first number of event information for each of the different events, or a second processing rule for determining duplicate events based on a second number of event information for each of the different events.

[0071] Specifically, the first processing rule determines duplicate events based on a first number of event information for each different event, and the second processing rule determines duplicate events based on a second number of event information for each different event.

[0072] For example, the first quantity information can be all the information about the event. Using a first processing rule, all the information of each event, including its attributes and content, can be compared to determine if they are duplicate events. If the first quantity information of two events is exactly the same, they are determined to be duplicate events and require appropriate processing. The second quantity information can be partial information about the event. This means that only the second quantity information of each event in the event list is compared to determine if they are duplicate events. For example, according to the second processing rule, some key event attributes or content can be selected for comparison. If this key information is the same, they are determined to be duplicate events and require appropriate processing.

[0073] These two processing rules are designed to determine if duplicate events exist in the event list and to take appropriate action based on the determination. The first processing rule makes this determination by comparing a first number of event entries, while the second processing rule makes it by comparing a second number of event entries. At least one of these two rules must be satisfied to determine whether an event is considered a duplicate.

[0074] In one embodiment, the event list includes at least one of a presentation event list or a capture event list; the event information of the presentation events in the presentation event list includes the presentation event category, presentation event parameters, and the level of data non-compliance, and the event information of the capture events in the capture event list includes the capture event category and capture event parameters;

[0075] The first processing rule includes rendering events with the same event category, rendering event parameters, and data non-compliance level as duplicate rendering events, and capturing events with the same capture event category and capturing event parameters as duplicate capturing events;

[0076] The second processing rule includes duplicate presentation events that are presented with the same event category and parameters but different levels of non-compliant data.

[0077] The first processing rule requires more identical event information to determine if a duplicate event is present than the second processing rule.

[0078] Specifically, the first processing rule is used to determine duplicate rendered events and duplicate captured events. For rendered events, if the event category, parameters, and data non-compliance level are all the same, then it is considered a duplicate rendered event. For captured events, if the event category and parameters are all the same, then it is considered a duplicate captured event. The second processing rule is used to determine duplicate rendered events. If the rendered events have the same category and parameters, but different data non-compliance levels, then it is considered a duplicate rendered event.

[0079] In one embodiment, the preset processing rules include a second processing rule, and the event list includes a presentation event list; according to the preset processing rules, duplicate event filtering processing is performed on the events in the event list, including:

[0080] For duplicate presentation events in the presentation event list determined by the second processing rule, retain the presentation event with the highest level of data non-compliance among the duplicate presentation events in the presentation event list; or, retain all duplicate presentation events in the presentation event list, and when processing non-compliant matching results, select the presentation event with the highest level of data non-compliance from the duplicate presentation events retained in the presentation event list.

[0081] Specifically, according to the second processing rule, if the categories and parameters of the presented events are the same, but the levels of data non-compliance are different, then it is considered a duplicate event presentation. There are two possible handling methods for this situation:

[0082] 1. Retain events with the highest data non-compliance level among repeated render events: In the render event list, only retain the event with the highest data non-compliance level among repeated render events, while deleting other events of the same category and parameters. This ensures that the retained events have the highest data non-compliance level.

[0083] 2. Retain all duplicate render events and process only those with the highest data non-compliance level: Retain all duplicate render events in the render event list, without deleting any events with the same category and parameters. Then, when processing non-compliant matching results, select the event with the highest data non-compliance level from the duplicate render events for processing. This preserves all duplicate render events while ensuring that the event with the highest data non-compliance level is used during processing.

[0084] The specific processing method chosen depends on the actual needs and scenario. The first method can reduce the number of duplicate events; the second method can retain all duplicate events and select events with higher data non-compliance levels for processing.

[0085] In one embodiment, the log record includes at least one data point with at least one level, and the target rule includes at least one condition, which is set based on the location of the data point and the content at the corresponding location; wherein, the location of the two-level data point includes the location of the data point at the first level and the binary bits in the corresponding binary value of the data point at the first level.

[0086] For example, a sample target rule for archiving a JSON file is as follows:

[0087]

[0088]

[0089] Among them, the number is "01GWJYZFVEPWD5ZZ7TNCE2KGAA";

[0090] The name is "mstc.ohtiolog.oht2mstc.0_2__or__0_0_and_other";

[0091] The version number is "1.0.2023.021308";

[0092] The description is "mstc.ohtiolog.oht2mstc", which represents the correspondence between OHTIOLOG, OHTIO_0_2 (Fault), or OHTIO_0_0 (InService) and other data points. When OHTIO_0_2 is 1, or OHTIO_0_0 is 0 and (OHTIO_0_1 is 1 or OHTIO_0_5 is 1), the non-compliance level is marked as fatal.

[0093] Relevant events will be highlighted with a red background;

[0094] Capture relevant events: Take a screenshot of the OHTIO panel area and save it to a file with a filename in the format 'timestamp_log level_logger name_object.png'; the data points involved include "loggerName", "dataSource" (its value is the first unsigned short integer of OHTIO), OHTIO_0_0 (its value is the 0th bit of dataSource), OHTIO_0_1 (its value is the 1st bit of dataSource), OHTIO_0_2 (its value is the 2nd bit of dataSource), and OHTIO_0_5 (its value is the 5th bit of dataSource);

[0095] The keyword list is as follows:

[0096] ""OHTIOLOG","OHTIO","InService","Available","Fault","Active"";

[0097] The condition is "the logger name is "OHTIOLOG", and (OHTIO_0_2 is 1, or OHTIO_0_0 is 0 and (OHTIO_0_1 is 1 or OHTIO_0_5 is 1))";

[0098] When this condition is met, the presentation-related events to be executed are: "Action type: highlight relevant data points, parameters: region type: panel, region name: bitwise.OHTIO, scope: cellsCorrespondingToDataPointsMeetsTheConditions, background color: red (0xFF0000)". The capture-related events to be executed are: "Action type: captureScreenshotAndSaveToFile, parameters: region type: panel, region name: bitwise.OHTIO, filename format: 'timestamp_logger level_logger name_object.png' (ts_level_logger_obj.png)".

[0099] Specifically, the location of a two-level data point consists of two parts: the location of the data point in the first level and the binary bits in the corresponding binary value of the data point in the first level. In other words, each data point has a location, while a two-level data point has an additional level, namely binary bits.

[0100] In one embodiment, the method further includes: listening for a termination data processing event, and stopping the processing of log records upon detecting a termination data processing event; the termination data processing event includes at least one of a manual log traversal event, a rule set modification event, or a configuration item modification event.

[0101] Specifically, before parsing the mounted target rules, the system first listens for termination data processing events. This allows for timely halting of log processing upon detecting a termination data processing event, avoiding unnecessary computation and resource waste. Termination data processing events include at least one of the following: manual log traversal events, rule set modification events, or configuration item modification events. By listening to these events, the data processing flow can be effectively controlled, improving system stability and efficiency. The manual log traversal event, in particular, allows users to manually traverse log records within the business system during the system's automatic filtering and traversal process, thereby intervening in the system's automatic log traversal rhythm.

[0102] Rule sets and configuration items may be created or modified by business rule makers, business system developers, or business system operators using rule engines or other tools, and stored in the data management module. Business rule makers or business system developers typically predefine common rules for use and configure rules related to common faults by default. When existing rules are insufficient, new rules can be created or modified based on existing rules. When modifying rules, their version numbers should be updated. Common business rule engines such as Drools and Urule, or domain-specific languages ​​such as Groovy, implement rule editing modules. Related configuration files and rules can be created or modified as needed, which significantly reduces the number of log records that need to be investigated while ensuring the completeness and intuitiveness of the captured log data.

[0103] In one embodiment, obtaining several configuration items includes: displaying a processing configuration interface containing configuration items, the configuration items including predefined target rules and predefined filtering configuration items; in response to a configuration item obtaining operation based on the processing configuration interface, determining the corresponding selected predefined target rules and predefined filtering configuration items, and using them as several configuration items, the configuration item obtaining operation including a direct selection operation or a selection operation after searching.

[0104] Specifically, in the configuration interface, users can select configuration items and rules to determine target rules and configuration items. Predefined common rules are provided for use, and default configurations are used for common fault-related rules, significantly reducing the familiarity required of maintenance personnel with the business system, thereby reducing related development and training time.

[0105] Example of selecting filter configuration items: Users can select filter configuration items by checking checkboxes, selecting corresponding options from drop-down menus, or searching for keywords. The selected filter configuration items will be used in relevant settings and parameters during data processing.

[0106] Example of selecting a target rule: Users can select target rules by checking checkboxes, selecting options from dropdown menus, or searching for keywords. The selected target rule will be used for rule matching and processing logic during data processing.

[0107] After selecting configuration items and rules according to their actual needs, users can click the "Confirm" or "Save" button to save the selected target rules and configuration items and apply them to the data processing process. Based on the configuration interface and operation example above, users can easily select and configure predefined target rules and predefined filter configuration items to meet their specific data processing needs.

[0108] In one embodiment, the event list includes a list of events to be presented.

[0109] Specifically, in the event processing list, the event presentation list is used to display or present the processing results, which may include generating reports, displaying them on the interface, etc., so that users can view and use the processing results. The attributes of the elements in the event presentation list include the event category, event parameters, the level of data non-compliance, and a list of rule numbers. Based on the parsing results, each part of the rule is extracted, and corresponding Boolean expressions are generated based on the conditions in the rule and the values ​​of relevant points in the log record. It is then determined whether the log record matches the target rule, including whether the log record contains all the data points in the rule; if true, the value of the Boolean expression corresponding to the rule's condition is also determined. If both of these determinations are true, the log record is said to match the rule; otherwise, the log record is said not to match the rule.

[0110] Specifically, presenting the processed matching results means displaying them in a certain format or manner so that users can view and analyze them. Presenting log records involves showing some or all of their data points; depending on business needs, several presentation formats can be configured to easily represent some or all of the data points. Specific presentation methods can vary depending on requirements and scenarios. Below are some common presentation methods:

[0111] List format: The matching results are presented in a list format, with each result displaying key information such as the time, source, and content of the log entry. Users can scroll or flip through pages to view all matching results.

[0112] Tabular format: The matching results are presented in a table format, with each column displaying different attributes, such as time, source, and content, and each row representing one matching result. Users can sort and filter the table for easy searching and analysis.

[0113] Chart format: The matching results are presented in the form of charts, such as bar charts or line charts. Charts can display statistical information about the matching results, such as the number of matches and the time distribution, helping users to understand the characteristics and trends of the matching results more intuitively.

[0114] Association View: This view associates matching results with other relevant information and presents the results graphically. For example, it associates matching results with IP addresses to show the geographical distribution of the results; or it visualizes the association between matching results and other events to help users discover potential associations and patterns.

[0115] In this application, the presentation-related events are preferably highlighted or audio played. Repeated actions are filtered from the presentation event list; then presented accordingly, ultimately achieving an intuitive presentation and capturing the data to be analyzed. This allows users to more easily browse and analyze matching results, extracting useful information and insights to support decision-making and further operations. For example, when this condition is met, the presentation-related event list to be executed is: "Action category: highlight relevant data points; Region name: bitwise.OHTIO; Scope: cells CorrespondingToDataPointsMeetsTheConditions".

[0116] To handle non-compliant matching results, refer to... Figure 4 ,include:

[0117] Step S402: Obtain panel configuration information, which includes customizable panel name, customizable panel type, and a list of panel configuration file contents.

[0118] Specifically, customizable panel components determine the specific presentation format of relevant data points based on the logger and configuration files of the relevant log records. Customizable panel types include: detailed panel, bitwise panel, object status list panel, error panel, and map panel. The detailed panel, by default, provides a general presentation of various parts of each logger's log records; the bitwise panel can visually present the description and value of each binary bit of several short integers; the object status list panel can present the names of several objects generated from log records of the same "class" and other data points of interest, one object per line, where the "class" is often related to the logger; the error panel contains a sub-component such as an "error log record table," where each row corresponds to a log record with a level of "ERROR" or "FATAL," or a log record whose data non-compliance level is "error" or "fatal" according to rules; the map panel can visually present the status of the corresponding objects in the corresponding snapshot information files, etc.

[0119] The configuration file for the detail panel corresponding to the logger "OHTIOLOG" is shown below:

[0120] #panel.detailed.OHTIOLOG.layout.ini

[0121] #name

[0122] name = detailed.OHTIOLOG

[0123] #title

[0124] title = Details

[0125] #Data Source

[0126] dataSource=OHTIOLOG

[0127] #Column Names

[0128] columnsNames = Items | Contents

[0129] #Column Width

[0130] columnsWidths = 100 | width - 100

[0131] # Presentation format and data for each column

[0132] cell_rowIndex_00 = "timestamp & level"

[0133] cell_rowIndex_01="%s[%s]",timestamp,level

[0134] cell_rowIndex_10 = "Recorder"

[0135] cell_rowIndex_11="%s",logger

[0136] cell_rowIndex_20 = "vehicle name"

[0137] cell_rowIndex_21="%s",ohtId

[0138] cell_rowIndex_30 = "PLC station number"

[0139] cell_rowIndex_31="%s",message.PLCStationId

[0140] cell_rowIndex_40 = "Key Information"

[0141] cell_rowIndex_41="%s",message.Msg

[0142] cell_rowIndex_50 = "Message Details"

[0143] cell_rowIndex_51="MSTCAddrStart:%d\nMSTCAddrLen:%d\nMSTCOHTIO:%s\nAddrStart:%d\nAddrLen:%d\nOHTIO:%s",me ssage.MSTCAddrStart,message.MSTCAddrLen,message.MSTCOHTIO,message.AddrStart,message.AddrLen,message.OHTIO

[0144] #Background and foreground colors of the header row

[0145] titleRowBgColor=0xDFDFDF

[0146] titleRowFgColor=0x0000FF

[0147] #Column 0

[0148] cell_rowIndex_00BgColor=0xDFDFDF

[0149] cell_rowIndex_00FgColor=0x000000

[0150] #Column 1

[0151] cell_rowIndex_01BgColor=0xFFFFFF

[0152] cell_rowIndex_01FgColor=0x000000

[0153] The configuration file for the bitmap corresponding to the logger "OHTIOLOG" is shown below:

[0154] #panel.bitwise.OHTIOLOG.OHTIO.layout.ini

[0155] #name

[0156] name = bitwise.OHTIO

[0157] #title

[0158] title=OHTIO

[0159] #Data Source

[0160] dataSource=OHTIOLOG.PLCOHTIO

[0161] #Column Names

[0162] columnsNames = Offset | Value | 15 | 14 | 13 | 12 | 11 | 10 | 9 | 8 | 7 | 6 | 5 | 4 | 3 | 2 | 1 | 0

[0163] #Column Width

[0164] columnsWidths=100|100|100|100|100|100|100|100|100|100|100|100|100|100|100|100|100|100

[0165] # Presentation format and data for each column

[0166] cell_rowIndex_00="D%d",PLCAddrStart+rowIndex

[0167] cell_rowIndex_01="%04xH",rowIndex

[0168] cell_rowIndex_02="%s",getDescriptor(PLCOHTIO,rowIndex,15)

[0169] cell_rowIndex_03="%s",getDescriptor(PLCOHTIO,rowIndex,14)

[0170] cell_rowIndex_04="%s",getDescriptor(PLCOHTIO,rowIndex,13)

[0171] cell_rowIndex_05="%s",getDescriptor(PLCOHTIO,rowIndex,12)

[0172] cell_rowIndex_06="%s",getDescriptor(PLCOHTIO,rowIndex,11)

[0173] cell_rowIndex_07="%s",getDescriptor(PLCOHTIO,rowIndex,10)cell_rowIndex_08="%s",getDescriptor(PLCOHTIO,rowIndex,09)cell_rowIndex_09="%s",getDescriptor(PLCOHTIO, rowIndex,08)cell_rowIndex_10="%s",getDescriptor(PLCOHTIO,rowIndex,07)cell_rowIndex_11="%s",getDescriptor(PLCOHTIO,rowIndex,06)cell_rowIndex_12="%s",getDescripto r(PLCOHTIO,rowIndex,05)cell_rowIndex_13="%s",getDescriptor(PLCOHTIO,rowIndex,04)cell_rowIndex_14="%s",getDescriptor(PLCOHTIO,rowIndex,03)cell_rowIndex_15="%s",g etDescriptor(PLCOHTIO,rowIndex,02)cell_rowIndex_16="%s",getDescriptor(PLCOHTIO,rowIndex,01)cell_rowIndex_17="%s",getDescriptor(PLCOHTIO,rowIndex,00)#Background and foreground colors of the title row

[0174] titleRowBgColor=0xDFDFDF

[0175] titleRowFgColor=0x0000FF

[0176] #Row-by-row, background and foreground colors for cells with a value of 1

[0177] cellWithBitValue1BgColor=0x62C267cellWithBitValue1FgColor=0x000000

[0178] #Row-by-row, background and foreground colors for cells with a value of 0

[0179] cellWithBitValue0BgColor=0xBFBFBFcellWithBitValue0FgColor=0x000000

[0180] #Row-by-row, background and foreground colors of odd-numbered row cells

[0181] cellBlockWithRowIndexOddBgColor=0xDFDFDF

[0182] cellBlockWithRowIndexOddFgColor=0x000000

[0183] #Row-by-row, background and foreground colors of odd-numbered row cells

[0184] cellBlockWithRowIndexEvenBgColor=0xFFFFFF

[0185] cellBlockWithRowIndexEvenFgColor=0x000000

[0186] #panel.bitwise.OHTIOLOG.OHTIO.descriptor.ini

[0187] OHTIO_0_0 = InService | Entering a job (controlled online by commands)

[0188] OHTIO_0_1 = Available | Executable state (off when manually activated)

[0189] OHTIO_0_2 = Fault | Error

[0190] OHTIO_0_3 = Presence | Holding Object

[0191] OHTIO_0_4 = Idle | Idle

[0192] OHTIO_0_5=str0_05|

[0193] OHTIO_0_6=str0_06|

[0194] OHTIO_0_7=str0_07|

[0195] OHTIO_0_8=str0_08|OHTIO_0_9=str0_09|OHTIO_0_10=str0_10|OHTIO_0_11=str0_11|OHTIO_0_12=str0_12|OHTIO_0_13=str0_13|OHTIO_0_14=str0_14|OHTIO_0_15=str0_15|OHTIO_1_0=str1_00|OHTIO_1_1=str1_01|OHTIO_1_2=str1_02|OHTIO_1_3=str1_03|OHTIO_1_4=str1_04|OHTIO_1_5=str1_05|OHTIO_1_6=str1_06|OHTIO_1_7=str1_07|OHTIO_1_8=str1_08|OHTIO_1_9=str1_09|OHTIO_1_10=str1_10|OHTIO_1_11=str1_11|OHTIO_1_12=str1_12|OHTIO_1_13=str1_13|OHTIO_1_14=str1_14|OHTIO_1_15=str1_15|OHTIO_2_0=str2_00|OHTIO_2_1=str2_01|OHTIO_2_2=str2_02|OHTIO_2_3=str2_03|OHTIO_2_4=str2_04|OHTIO_2_5=str2_05|OHTIO_2_6=str2_06|OHTIO_2_7=str2_07|OHTIO_2_8=str2_08|OHTIO_2_9=str2_09|OHTIO_2_10=str2_10|OHTIO_2_11=str2_11|OHTIO_2_12=str2_12|

[0196] OHTIO_2_13=str2_13|

[0197] OHTIO_2_14=str2_14|

[0198] OHTIO_2_15=str2_15|。

[0199] A panel configuration file contents list refers to a list or summary containing information about the customizable panel configuration. This list typically includes detailed descriptions of the panel's various configuration options, parameters, settings, and properties. It may include, but is not limited to, the following: the position, size, and style of various components in the panel (such as buttons, text boxes, dropdown lists, etc.); and the configuration of events and behaviors for each component in the panel, such as the actions triggered by clicking a button or the response after text box input.

[0200] Based on the list of events presented, customizable panels can be used to display content from the target log records that meets the matching criteria. Specifically, non-compliant log records are filtered out based on the matching criteria and displayed using customizable panels for user viewing and analysis. Customizable panels offer interactive features such as search, filtering, and pagination to facilitate data browsing and analysis according to user needs. Specifically, the detailed panel configuration file for the logger "OHTIOLOG" is as follows... Figure 5 As shown, it illustrates the layout of the details panel and the presentation of each data point in the log record with the logger named "OHTIOLOG". The log record example is presented in the details panel as follows: Figure 6 As shown.

[0201] Step S404: Locate panel instances that match the customizable panel name and customizable panel type respectively. If no match is found, create a panel instance.

[0202] Specifically, the process first searches the existing panel instances based on the given customizable panel name and panel type to see if a matching panel instance exists. If a matching panel instance is found, the subsequent operations can proceed. If no matching panel instance is found, the next step is required. If no matching panel instance is found, the next step is to create a panel instance. When no panel instance matching the customizable panel name and type is found, a new panel instance needs to be created based on the given information.

[0203] Step S406: For each presentation event in the presentation event list, according to the panel configuration file content list, populate the panel instance with the content that matches the target rule from the non-compliant log records, and display it according to the corresponding presentation method of the presentation event.

[0204] For each event in the event list, it is processed according to the rules in the panel configuration file's content list. Specifically, the content matching the target rule from non-compliant log records is populated into the panel instance, and then displayed according to the corresponding presentation method for the event. In other words, based on the rules defined in the panel configuration file, for log records that do not conform to the rules, the content matching the target rule is extracted and populated into the panel instance for subsequent presentation and display operations.

[0205] Based on the presented events, a customizable panel is used to display the content of the target log records that meet the matching criteria. Specifically, this can be based on fields displayed in the event, such as region category, log content, and region name. Then, log records that meet the matching criteria are filtered out and sorted according to the sorting method. Finally, the log records that meet the criteria are displayed using a customizable panel for users to view and analyze. The customizable panel can provide interactive functions such as search, filtering, and pagination to facilitate users' browsing and analysis of data according to their needs.

[0206] By following the steps above, the content matching the conditions in the target log records can be displayed in a customizable way based on the event list, and a wealth of functions can be provided to meet the user's needs.

[0207] In one embodiment, the method further includes: modifying the corresponding predefined target rule or creating a new predefined target rule based on at least one of the following: the selection of items in the predefined target rule, the operation status of the business system that generates log records, the inspection results of the predefined target rule, data processing requirements, the processing status of data processing according to the predefined target rule, or the processing adaptability of data processing using the predefined target rule.

[0208] Specifically, based on the keyword list, description, and selection of existing rules, combined with the operational status of business systems that may generate relevant logs, or by examining the data points, conditions, presentation, or capture-related events involved in the relevant rules, it is determined whether to create new rules or modify existing rules. If a new rule needs to be created, the rule to be used as the basis for creating the new rule is determined. When this method is run and a situation arises where data cannot be captured according to existing rules, or where data can be captured but the capture conditions need to be modified to match the fault, it is also necessary to create new rules or modify existing rules.

[0209] In this embodiment, modifying or creating new predefined rules based on data processing needs and conditions can better adapt the rules to actual data processing scenarios, improving processing efficiency and quality. At the same time, it can increase the adaptability of the rules to accommodate more data processing needs and scenarios.

[0210] The configuration items include at least one of the following: pre-filtering items for filtering log records before processing, appending items for appending data to log records after processing, or the location for storing processed data. Pre-filtering items include at least one of the following: target filtering period, target logger type, or target log level. Appending items include at least one of the following: number of forward processing items or number of backward processing items. The number of forward processing items represents the number of processing items attempted to process log records whose timestamps are before a reference timestamp, and the number of backward processing items represents the number of processing items attempted to process log records whose timestamps are after the reference timestamp. The reference timestamp is determined based on the timestamp of the target log record matching the target rule. The appending items also include at least one of the following: log records acquired within a specified time period before the reference timestamp and log records acquired within a specified time period after the reference timestamp.

[0211] For example, refer to Figure 3The target filtering time period includes the start time (2023-02-04, 10:00:00) and the end time (2023-02-04, 11:00:00). Target logger types include OHTIOLOG, DBUPDATE-LOG, and MCSLOG. Specifically, the OHTIOLOG logger's panel categories include detailed, bitwise, objectStatusList, error, and map panels; the DBUPDATE-LOG logger's panel categories include detailed, bitwise, objectStatusList, error, and map panels; and the MCSLOG logger's panel categories include detailed, bitwise, objectStatusList, and error panels. The target log level types include "TRACE", "DEBUG", "INFO", "WARN", "ERROR", and "FATAL". When the data recorded in the log is non-compliant at the "ERROR" or "FATAL" level, it will be added to the "Error Log Table" in the error panel. The processed data can be stored in the computer's memory for subsequent calculations and operations.

[0212] The number of items processed forward or backward refers to the number of log records preceding or following the current item during data processing. For example, the number of items processed forward is 1, and the number of items processed backward is 1.

[0213] Retrieve log records within a specified time period preceding the reference timestamp, such as 1000ms before the reference timestamp; retrieve log records within a specified time period following the reference timestamp, such as 1000ms after the reference timestamp.

[0214] By acquiring log records before and after a reference timestamp, more contextual information can be obtained, making the processing more comprehensive and accurate. This helps in understanding and interpreting log records within the target time period and allows for further analysis of the correlation between log records within the target time period and preceding and following time periods. This helps in discovering potential causal relationships, anomalies, etc., improving the depth and breadth of data processing. While significantly reducing the number of log records that need to be investigated, the completeness and intuitiveness of the captured log data are ensured as much as possible, greatly improving the efficiency of debugging and troubleshooting based on logs, thereby maintaining or improving customer satisfaction with related business systems.

[0215] In one embodiment, the configuration item further includes sending configuration information for sending processed data externally. The sending configuration information includes at least one of the following: a packaging control item indicating whether to package the processed data, an outgoing control item indicating whether to send the processed data externally, or a target identifier indicating the outgoing target. The event list includes a capture event list. Correspondingly, processing non-compliant matching results includes:

[0216] Obtain the list of captured events, and based on the list of captured events, capture the presentation results to obtain the captured results; if the captured results are to be packaged according to the packaging control item in the sending configuration information, and the packaged results are to be sent out according to the outgoing control item, package the captured results, and send out the corresponding packaged results according to the target identifier.

[0217] Specifically, based on the capture event list, the aforementioned rendering results are captured to obtain the captured results. This involves filtering and matching the rendered results. The attributes of the elements in the capture event list include the capture event category, capture event parameters, and a list of rule numbers.

[0218] Capturing relevant events includes screenshots, screen recordings, sending emails, and exporting non-compliant log sets. Highlighting involves highlighting relevant data points with at least one of the following: a highlighted border, background color, foreground color, or blinking. For example, if the background color is set to red (0xFF0000), the relevant data points in the log record will be highlighted with a red background.

[0219] The data that may be captured includes log records, static screenshots, dynamic screenshots, recorded audio, and recorded screen videos. The filenames of static screenshots, dynamic screenshots, recorded audio, and recorded screen videos shall at least include the timestamp of the corresponding log record, and optionally, also include the logger name, log level, and the name of the fault-related object.

[0220] For example, the file name of a static screenshot is:

[0221] "202302041004306053_DEBUG_OHTIOLOG_V01C002.jpg";

[0222] Or “202302041004306053#DEBUG#OHTIOLOG#V01C002.png”;

[0223] The timestamp, log level, logger name, and fault-related object name in the log are separated by the characters "_" or "#" for data capture presentation. Each captured data function includes a category and parameters. For example, the "Screenshot" function has a category (type) of "captureScreenshotAndSaveToFile," and its parameters include "Region Type" (regionType), "Region Name" (regionName), and "File Name Pattern" (fileNamePattern). The possible values ​​for the "Region Type" parameter are "panel," "appWindow," or "desktop." When the "Region Type" value is "panel," multiple panels are separated by "|" (e.g., "detailed.OHTIOLOG|bitwise.OHTIO"). The possible values ​​for the "File Name Pattern" parameter are "ts_level_logger_obj.png," "ts_level_logger_obj.jpg," "ts#level#logger#obj.png," or "ts#level#logger#obj.jpg."

[0224] The interface for presenting the captured data includes at least two list components and two display components. The first list component displays the filenames of the captured visual data files; the second list component displays the timestamp, log level, and logger name of each captured log record; the first display component presents the content of the visual data file selected in the first list component; the second display component presents the content of the log record selected in the second list component. When the user selects a row in the first list component, the corresponding visual data filename is parsed, and the log records matching the timestamp, log level, and logger name in the second list component are scrolled to the visible position, the first matching log record is selected, and its content is displayed in the second display component. Presenting the captured data facilitates its presentation and can hopefully shorten the time required to locate the problem. If necessary, such as when the expected data is not captured, the steps of the aforementioned data capture method based on rule-based log record matching can be run again.

[0225] Edit the captured files, such as performing necessary processing on the captured log records, such as sorting them in ascending order by reference timestamp, and then exporting the resulting "captured log record set file", static screenshots, dynamic screenshots, recorded audio, and recorded screen video.

[0226] Based on the packaging control settings in the transmission configuration information, the system determines whether to package the captured results. Packaging control settings, for example, may package several captured files into a single compressed file. Then, based on the outbound control settings, the system determines whether to send the packaged results outbound, i.e., to the recipient specified by the target identifier (e.g., a specified email address). The archive format may include JSON files, XML files, and database records.

[0227] For example, take a screenshot of the OHTIO panel area and save it to a file with a filename in the format 'timestamp_log level_logger name_object.png'; the data points involved include "loggerName", "dataSource" (whose value is the first unsigned short integer of OHTIO), OHTIO_0_0 (whose value is the 0th bit of dataSource), OHTIO_0_1 (whose value is the 1st bit of dataSource), OHTIO_0_2 (whose value is the 2nd bit of dataSource), and OHTIO_0_5 (whose value is the 5th bit of dataSource);

[0228] The keyword list is as follows:

[0229] ""OHTIOLOG","OHTIO","InService","Available","Fault","Active"";

[0230] The conditions are:

[0231] "The logger is named "OHTIOLOG", and (OHTIO_0_2 is 1, or OHTIO_0_0 is 0 and (OHTIO_0_1 is 1 or OHTIO_0_5 is 1))";

[0232] The list of capture-related events to be executed is as follows:

[0233] The action category is "captureScreenshotAndSaveToFile";

[0234] The "regionType" is: panel;

[0235] The region name is: bitwise.OHTIO;

[0236] The filename format (fileNamePattern) is: 'timestamp_log level_logger name_object.png' (ts_level_logger_obj.png) .

[0237] Specifically, based on the above configuration, after the traversal is completed, the functions of packaging files and sending files are invoked.

[0238] In a specific embodiment, such as a Smart Transport Controller (STC) in a wafer fabrication plant (Fab) that needs to control multiple Overhead Hoist Transports (OHTs) to continuously run on overhead tracks, when an OHT malfunctions, such as an equipment alarm or other accident, maintenance personnel or engineers need to retrieve the abnormal communication logs between the STC and the OHT from the STC server in the control area of ​​the equipment, based on the equipment alarm prompts or the accident scene, and analyze the cause of the abnormality to resolve the problem.

[0239] Depending on the specific on-site procedures, an operable configuration interface can be built for the control system to obtain and filter relevant configuration items.

[0240] The configuration interface may display the following information:

[0241] Select a time range, such as 2023-02-04 10:00:00 to 2023-02-04 11:00:00;

[0242] Select the log level, such as "TRACE", "DEBUG", "WARN", "ERROR", or "FATAL". Select the log record corresponding to the logger name, such as the log record corresponding to "OHTIOLOG", which includes the STC issuing task instructions to the OHT and the OHT reporting status feedback to the STC. Among them, the log records included by "TRACE" are such as the OHT waybill completion status, the ID (Identity) of the transported wafer box, and human operation; the log records included by "DEBUG" are such as OHT operation information and OHT location information; the log records included by "WARN" are such as OHT signal timeout when interacting with other devices; the log records included by "ERROR" are such as OHT positioning abnormality, OHT belt excessive extension or retraction, and OHT gripper malfunction; and the log records included by "FATAL" are such as OHT collision with other OHTs.

[0243] Obtain rule configuration items: Select the corresponding rule in the rule set according to the rule name. Of course, you can create names that are appropriate for different monitored devices, which can intuitively show the corresponding devices; for example, the name is "stc.ohtiolog.oht2stc.0_2__or__0_0_and_other", which is a rule that matches the log records of OHT No. 2. For example, the running status of OHT No. 2 on a certain track can be determined by the data points of the log data. For example, if the OHT fails to retrieve the specified goods due to positioning abnormality, or if the OHT fails to retrieve the specified goods due to its own sensor detection error, or if the OHT fails to retrieve the specified goods due to collision with other trolleys, etc.

[0244] Configure presentation, capture, and other configuration items, such as highlighting the corresponding data points recorded in the exception log on the panel with a background color, showing the panel with exception points in the screenshot, and automatically starting log traversal after loading the logs.

[0245] Parse the above configuration items to obtain the specified log record dataset, the rules for matching the specified log record dataset, the event list, the captured event list, etc.

[0246] Table 1

[0247]

[0248]

[0249]

[0250] Table 2

[0251]

[0252]

[0253] The event list and the event capture list are shown in Table 1 and Table 2. Table 1 includes the events related to presentation or capture corresponding to each rule. Table 2 includes the events related to presentation or capture corresponding to each rule after filtering using preset processing rules. The event list after filtering duplicate actions when executing abnormal information in the presentation or capture log records is shown in Table 2. The preset processing rules include the first processing rule and the second processing rule.

[0254] The first processing rule is used to filter duplicate events in the presentation event list shown in Table 1. Presentation-related event 1 in rule 1 and presentation-related event 1 in rule 2 are the same in category, parameters, and data non-compliance level. It is determined that presentation-related event 1 in rule 1 and presentation-related event 1 in rule 2 are two identical events. Therefore, the two identical events are merged into presentation-related event 1 in the filtered event list shown in Table 2.

[0255] The first processing rule is used to filter duplicate events in the list of captured events shown in Table 1. The capture-related event 1 in rule 1 and the capture-related event 1 in rule 2 are the same in category, parameters, and data non-compliance level. It is determined that the capture-related event 1 in rule 1 and the capture-related event 1 in rule 2 are two identical events. Then, the two identical events are merged into the capture-related event 1 in the filtered event list shown in Table 2.

[0256] The presentation-related event 2 in rule 1 and the presentation-related event 1 in rule 3 are listed sequentially as presentation-related events 2 and 3 in the filtered event list shown in Table 2;

[0257] The second processing rule is used to filter duplicate events in the list of captured events shown in Table 1. The capture-related events 1 in rules 1 and 2 are the same as the capture-related events 1 in rule 3 in terms of category and parameters, but the data non-compliance level is different. It is determined that the capture-related events 1 in rules 1 and 2 are the same as the capture-related events 1 in rule 3. Therefore, the three identical events are merged into the capture-related events 1 in the filtered event list shown in Table 2.

[0258] The filtered list of presentation events and the list of capture times are obtained, as shown in Table 2;

[0259] Load the specified log records and iterate through them;

[0260] When a log record is encountered, it is matched against rule 1, rule 2, and rule 3 in sequence to obtain the matching results:

[0261] If the log record only matches rule 1, then execute the presentation-related event 2 from the filtered event list shown in Table 2 and present it.

[0262] If the log record only matches rule 2, then execute the presentation-related event 1 from the filtered event list shown in Table 2 and present it.

[0263] If the log record only matches rule 3, then execute the presentation-related event 3 from the filtered event list shown in Table 2 and present it.

[0264] If the log record matches both rule 1 and rule 2, then execute the presentation-related event 1 from the filtered event list shown in Table 2 and present it.

[0265] If the log record matches both rule 1 and rule 3, according to the filtered event list shown in Table 2, it is necessary to execute presentation-related event 2, and also presentation-related event 3. In this case:

[0266] The second processing rule is used to filter duplicate events. Presentation-related event 2 and presentation-related event 3 are the same in category and parameters, but have different levels of data non-compliance. It is determined that presentation-related event 2 and presentation-related event 3 are two identical events. Then, based on the principle of prioritizing presentation-related events with higher levels of data non-compliance, presentation-related event 2 is selected for execution.

[0267] Then, based on the panel configuration information, such as the customizable panel name (biwise.OHTIO), the customizable panel type (panel), and the list of panel configuration file contents;

[0268] For each presentation event in the presentation event list, according to the content list of the panel configuration file, populate the panel instance with the content of non-compliant log records that match the target rules, and display it according to the presentation method described in the presentation event description;

[0269] like Figure 6 As shown, an abnormal log record is presented, which has 16 data points. Among them, data point 2 has a highlighted background color. Maintenance personnel can quickly locate the abnormal log record and the abnormal points of the abnormal log record, and quickly link to related data by clicking to facilitate investigation of the cause of the abnormality or export of data to be analyzed.

[0270] During capture, intercept Figure 6 The interface shown allows you to obtain static screenshots or recorded video files of the screen, which can be used by maintenance personnel for analysis or provided to business personnel for analysis.

[0271] Based on the same inventive concept, this application also provides a log recording processing apparatus for implementing the log recording processing method described above. The solution provided by this apparatus is similar to the implementation scheme described in the above method; therefore, the specific limitations in one or more log recording processing apparatus embodiments provided below can be found in the limitations of the log recording processing method described above, and will not be repeated here.

[0272] In one embodiment, such as Figure 7 As shown, a log recording processing device is provided, comprising:

[0273] Module 702 is used to acquire several configuration items related to data processing.

[0274] Parsing module 704 is used to parse several configuration items to obtain one or more target rules for matching, filter configuration items, and an event list for data processing, including a presentation event list and / or a capture event list;

[0275] The filtering module 706 is used to filter out log records to be processed based on the filtering configuration items and load the filtered log records.

[0276] The log traversal module 708 is used to traverse the loaded log records;

[0277] The matching module 710 is used to match the target rule with the corresponding data in the traversed log records for the traversal, and obtain the matching results of the traversed log records that do not comply with the target rule.

[0278] Processing module 712 is used to process non-compliant matching results according to the corresponding processing action type in the event list.

[0279] The preset processing rules include at least one of the following: a first processing rule for determining duplicate events based on a first number of event information for each different event, or a second processing rule for determining duplicate events based on a second number of event information for each different event.

[0280] The preset processing rules include at least one of the following: a first processing rule for determining duplicate events based on a first number of event information for each different event, or a second processing rule for determining duplicate events based on a second number of event information for each different event.

[0281] In one embodiment, the event list includes at least one of a presentation event list or a capture event list; the event information of the presentation events in the presentation event list includes the presentation event category, presentation event parameters, and the level of data non-compliance, and the event information of the capture events in the capture event list includes the capture event category and capture event parameters;

[0282] The first processing rule includes rendering events with the same event category, rendering event parameters, and data non-compliance level as duplicate rendering events, and capturing events with the same capture event category and capturing event parameters as duplicate capturing events;

[0283] The second processing rule includes duplicate presentation events that are presented with the same event category and parameters but different levels of non-compliant data.

[0284] The first processing rule requires more identical event information than the second processing rule to determine that a duplicate event is present.

[0285] In one embodiment, the preset processing rules include a second processing rule, and the event list includes a presentation event list; the processing module 712 is further configured to:

[0286] For duplicate presentation events in the presentation event list determined by the second processing rule, retain the presentation event with the highest level of data non-compliance among the duplicate presentation events in the presentation event list; or, retain all duplicate presentation events in the presentation event list, and when processing non-compliant matching results, select the presentation event with the highest level of data non-compliance from the duplicate presentation events retained in the presentation event list.

[0287] In one embodiment, the log record includes at least one data point with at least one level, and the target rule includes at least one condition, which is set based on the location of the data point and the content at the corresponding location; wherein, the location of the two-level data point includes the location of the data point at the first level and the binary bits in the corresponding binary value of the data point at the first level.

[0288] In one embodiment, the processing module 712 is further configured to:

[0289] Listen for termination data processing events and stop processing log entries when a termination data processing event is detected; termination data processing events include at least one of manual log traversal events, rule set modification events, or configuration item modification events.

[0290] In one embodiment, the device further includes a display module;

[0291] The display module is used to display the processing configuration interface containing configuration items, including predefined target rules and predefined filtering configuration items.

[0292] The processing module 712 is also used to respond to the configuration item acquisition operation based on the processing configuration interface, determine the corresponding selected predefined target rules and predefined filtering configuration items, and treat them as several configuration items. The configuration item acquisition operation includes a direct selection operation or a selection operation after searching.

[0293] Accordingly, the event list includes presenting the event list and handling non-compliant matching results, including:

[0294] The acquisition module 702 is also used to acquire panel configuration information, which includes the customizable panel name, the customizable panel type, and a list of panel configuration file contents.

[0295] The processing module 712 is also used to find panel instances that match the customizable panel name and the customizable panel type respectively, and to create panel instances if no match is found.

[0296] The processing module 712 is also used to, for each presentation event in the presentation event list, fill the panel instance with the content of non-compliant log records that match the target rules according to the content list of the panel configuration file, and display it through the display module according to the corresponding presentation method of the presentation event.

[0297] In one embodiment, the method further includes:

[0298] The processing module 712 is also used to modify the corresponding predefined target rule or create a new predefined target rule based on at least one of the following: the selection of various contents in the predefined target rule, the operation status of the business system that generates log records, the inspection results of the predefined target rule, data processing requirements, the processing status of data processing according to the predefined target rule, or the processing adaptability of data processing using the predefined target rule.

[0299] The configuration items include at least one of the following: pre-filtering items for filtering log records before processing, appending items for appending log records after processing, or the location for storing processed data.

[0300] The pre-filtering items include at least one of the target filtering period, the target logger type, or the target log level; the append processing items include at least one of the forward processing items or the backward processing items. The forward processing items represent the number of processing items attempted to process log records whose timestamps are before the reference timestamp, and the backward processing items represent the number of processing items attempted to process log records whose timestamps are after the reference timestamp. The reference timestamp is determined based on the timestamp of the target log record that matches the target rule.

[0301] In one embodiment, the configuration item further includes sending configuration information for sending processed data externally. The sending configuration information includes at least one of the following: a packaging control item indicating whether to package the processed data, an outgoing control item indicating whether to send the processed data externally, or a target identifier indicating the outgoing target. The event list includes a capture event list. Correspondingly, processing non-compliant matching results includes:

[0302] The acquisition module 702 is also used to acquire a list of captured events, and based on the list of captured events, to capture the presentation results and obtain the captured results.

[0303] The device also includes a packaging module, which is used to package the capture result according to the packaging control item in the sending configuration information and to send the packaged result out according to the outgoing control item, and to send the corresponding packaged result out according to the target identifier.

[0304] Each module in the aforementioned log recording and processing device can be implemented entirely or partially through software, hardware, or a combination thereof. These modules can be embedded in or independent of the processor in a computer device, or stored in the memory of a computer device as software, so that the processor can call and execute the operations corresponding to each module.

[0305] In one embodiment, a computer device is provided, which may be a terminal, and its internal structure diagram may be as follows: Figure 8 As shown, the computer device includes a processor, memory, input / output interfaces, a communication interface, a display unit, and an input device. The processor, memory, and input / output interfaces are connected via a system bus, and the communication interface, display unit, and input device are connected to the system bus via the input / output interfaces.

[0306] Those skilled in the art will understand that Figure 8 The structure shown is merely a block diagram of a portion of the structure related to the present application and does not constitute a limitation on the computer device to which the present application is applied. Specific computer devices may include more or fewer components than those shown in the figure, or combine certain components, or have different component arrangements.

[0307] In one embodiment, a computer device is provided, including a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to perform the following steps:

[0308] Step S202: Obtain several configuration items. Step S204: Parse the configuration items to obtain one or more target rules for matching, filter the configuration items, and obtain a list of events for data processing. Step S206: Filter the log records to be processed according to the filtering configuration items, and load the filtered log records. Step S208: Iterate through the loaded log records, match the target rules with the corresponding data in the iterated log records, and obtain the non-compliant matching results of the iterated log records under the target rules. Step S210: Process the non-compliant matching results according to the corresponding processing action type in the event list.

[0309] In one embodiment, a computer-readable storage medium is provided having a computer program stored thereon, the computer program being executed by a processor of steps S202 to S210 in the aforementioned computer device:

[0310] In one embodiment, a computer program product is provided, including a computer program that is executed by a processor to perform the operation steps of the computer device described above, which will not be described in detail here.

[0311] It should be noted that the user information (including but not limited to user device information, user personal information, etc.) and data (including but not limited to data used for analysis, data stored, data displayed, etc.) involved in this application are all information and data authorized by the user or fully authorized by all parties, and the collection, use and processing of the relevant data shall comply with the relevant laws, regulations and standards of the relevant countries and regions.

[0312] Those skilled in the art will understand that all or part of the processes in the above embodiments can be implemented by a computer program instructing related hardware. The computer program can be stored in a non-volatile computer-readable storage medium. When the computer program is executed, it can include the processes of the embodiments of the above methods.

[0313] The technical features of the above embodiments can be combined in any way. For the sake of brevity, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0314] The embodiments described above are merely illustrative of several implementation methods of this application, and while the descriptions are specific and detailed, they should not be construed as limiting the scope of this patent application. It should be noted that those skilled in the art can make various modifications and improvements without departing from the concept of this application, and these all fall within the protection scope of this application. Therefore, the protection scope of this application should be determined by the appended claims.

Claims

1. A log recording processing method, characterized in that, The method includes: Obtain several configuration items; wherein, the configuration items include pre-filtering items for filtering log records before processing, and appending processing items for appending log records after data processing; the appending processing items include at least one of the number of forward processing items or the number of backward processing items; Parse several of the configuration items to obtain one or more target rules for matching, filter the configuration items, and obtain a list of events for data processing; Based on the filtering configuration items, filter the log records to be processed and load the filtered log records; The loaded log records are traversed, and the target rule is matched with the corresponding data in the traversed log records to obtain the non-compliant matching results of the traversed log records under the target rule; Load the log records corresponding to the number of forward-processed items before the reference timestamp, and / or the log records corresponding to the number of backward-processed items after the reference timestamp; wherein the reference timestamp is determined based on the timestamp of the target log record that matches the target rule; The non-compliant matching results are processed according to the corresponding processing action type in the event list.

2. The method according to claim 1, characterized in that, Before processing the non-compliant matching results, the process also includes: According to preset processing rules, duplicate events are filtered out from the events in the event list.

3. The method according to claim 2, characterized in that, For different events of the same processing action type in the event list, the preset processing rules include at least one of the following: a first processing rule for determining duplicate events based on a first number of event information for each of the different events, or a second processing rule for determining duplicate events based on a second number of event information for each of the different events.

4. The method according to claim 3, characterized in that, The event list includes at least one of the presentation event list or the capture event list; the event information of the presentation events in the presentation event list includes the presentation event category, presentation event parameters, and the level of data non-compliance; the event information of the capture events in the capture event list includes the capture event category and capture event parameters. The first processing rule includes that presentation events with the same presentation event category, presentation event parameters, and data non-compliance level are considered duplicate presentation events, and capture events with the same capture event category and capture event parameters are considered duplicate capture events. The second processing rule includes duplicate presentation events that have the same presentation event category and presentation event parameters, but different levels of data non-compliance. The first processing rule requires more identical event information than the second processing rule to determine that a duplicate event is present.

5. The method according to claim 4, characterized in that, The preset processing rules include a second processing rule, and the event list includes a presentation event list; the step of performing duplicate event filtering processing on the events in the event list according to the preset processing rules includes: For duplicate presentation events in the presentation event list obtained by the second processing rule, the presentation event with the highest level of data non-compliance among the duplicate presentation events is retained in the presentation event list; or, all duplicate presentation events are retained in the presentation event list, and when processing the non-compliant matching results, for the duplicate presentation events retained in the presentation event list, the presentation event with the highest level of data non-compliance is selected from the duplicate presentation events.

6. The method according to any one of claims 1 to 3, characterized in that, The log records include at least one data point with at least one level. The target rule includes at least one condition, which is set based on the location of the data point and the content at the corresponding location. The location of the two-level data point includes the location of the data point at the first level and the binary bits in the corresponding binary value of the data point at the first level.

7. The method according to any one of claims 1 to 3, characterized in that, The method further includes: Listen for termination data processing events, and stop the processing of log records when a termination data processing event is detected; the termination data processing event includes at least one of manual log traversal event, rule set modification event, or configuration item modification event.

8. The method according to any one of claims 1 to 3, characterized in that, The acquisition of several configuration items includes: The interface displays a processing configuration interface containing configuration items, including predefined target rules and predefined filtering configuration items. In response to the configuration item acquisition operation based on the processing configuration interface, the corresponding selected predefined target rules and predefined filtering configuration items are determined and used as the plurality of configuration items. The configuration item acquisition operation includes a direct selection operation or a selection operation after searching. Accordingly, the event list includes a list of presented events, and the processing of the non-compliant matching results includes: Obtain panel configuration information, which includes customizable panel name, customizable panel type, and a list of panel configuration file contents; Find panel instances that match the customizable panel name and the customizable panel type respectively; if no match is found, create a panel instance. For each presentation event in the presentation event list, according to the panel configuration file content list, the content in the non-compliant log records that matches the target rule is filled into the panel instance, and displayed according to the corresponding presentation method of the presentation event.

9. The method according to any one of claims 1 to 3, characterized in that, The method further includes: Based on at least one of the following: the selection of each item in the predefined target rule, the operation of the business system that generates log records, the inspection results of the predefined target rule, data processing requirements, the processing status of data processing according to the predefined target rule, or the processing adaptability of data processing using the predefined target rule, the corresponding predefined target rule is modified or a new predefined target rule is created based on the corresponding predefined target rule. The configuration item also includes the location for processing data storage; The pre-filtering items include at least one of the target filtering period, target logger type, or target log level; the forward processing number is used to characterize the number of processing items that attempt to process log records whose timestamps are before the reference timestamp, and the backward processing number is used to characterize the number of processing items that attempt to process log records whose timestamps are after the reference timestamp, wherein the reference timestamp is determined based on the timestamp of the target log record that matches the target rule.

10. The method according to any one of claims 1 to 3, characterized in that, The configuration items also include sending configuration information for sending processed data to the outside. The sending configuration information includes at least one of the following: a packaging control item for indicating whether to package the processed data, an outward control item for indicating whether to send the processed data to the outside, or a target identifier for indicating the outward target. The event list includes a capture event list. Accordingly, processing the non-compliant matching results includes: Obtain a list of captured events, and based on the list of captured events, capture the presentation results to obtain the captured results; If the capture result is determined to be packaged according to the packaging control item in the sending configuration information, and the packaged result is determined to be sent out according to the outgoing control item, the capture result is packaged, and the corresponding packaged result is sent out according to the target identifier.

11. A log recording and processing device, characterized in that, The device includes: The acquisition module is used to acquire several configuration items related to data processing; wherein, the configuration items include pre-filtering items for filtering log records before processing, and appending processing items for appending log records after data processing; the appending processing items include at least one of the number of forward processing items or the number of backward processing items; The parsing module is used to parse several configuration items to obtain one or more target rules for matching, filter configuration items, and an event list for data processing, the event list including a presentation event list and / or a capture event list; The filtering module is used to filter out log records to be processed according to the filtering configuration items and load the filtered log records. The log traversal module is used to traverse the loaded log records; The matching module is used to match the target rule with the corresponding data in the traversed log records for the purpose of obtaining non-compliant matching results of the traversed log records under the target rule; and to load the log records corresponding to the number of forward-processed items before the reference timestamp and / or the number of backward-processed items after the reference timestamp; wherein the reference timestamp is determined based on the timestamp of the target log record that matches the target rule; The processing module is used to process the non-compliant matching results according to the corresponding processing action type of the event list.

12. A computer device comprising a memory and a processor, wherein the memory stores a computer program, characterized in that, When the processor executes the computer program, it implements the steps of the method according to any one of claims 1 to 10.

Images