Log classification method and apparatus

Abstract

The application provides a log classification method and device, the method comprising: performing word segmentation on a plurality of logs to be processed, and dividing each log into at least two character strings; determining a feature evaluation value of each character string in the log based on a character string feature of each character string in the log and a position feature of each character string in the log; classifying the plurality of logs into at least one log group based on the number of character strings in the log, each log group comprising at least two logs; for each log group, determining a target character string in the log based on the feature evaluation value of each character string in the log group; and for each log group, classifying the logs in the log group into at least one sub-log group based on the target character string in each log and a target position of the target character string in the log.

Description

Technical Field

[0001] This application relates to the field of log processing technology, and in particular to a log classification method and apparatus. Background Technology

[0002] To determine whether there are any anomalies in the code of an application or software, it is often necessary to perform anomaly investigation based on the logs generated during the operation of the application or software.

[0003] In log-based anomaly investigation, it's necessary to identify all log entries belonging to the same line of code and group them together so engineers can analyze that line of code based on the log entries associated with it. However, current log categorization accuracy is low, making it difficult to accurately classify logs belonging to the same line of code. Summary of the Invention

[0004] On the one hand, this application provides a log classification method, including:

[0005] The multiple log entries to be processed are segmented into words, and each log entry is divided into at least two strings.

[0006] Based on the string features of each string in the log and the position features of each string in the log, determine the feature evaluation value of each string in the log;

[0007] Based on the number of strings in each log entry, the multiple log entries are grouped into at least one log group, and each log group includes at least two log entries.

[0008] For each log group, the target string in each log is determined based on the feature evaluation value of each string in each log of the log group;

[0009] For each log group, the logs in the log group are classified into at least one sub-log group based on the target string in each log and the target position of the target string in the log.

[0010] In one possible implementation, determining the feature evaluation value of each string in the log based on the string features and the position features of each string in the log includes:

[0011] Determine the central string in the log that can characterize the log topic;

[0012] Based on the position of each string in the log and the position of the central string in the log, determine the positional features of each string in the log;

[0013] Based on the string features and positional features of each string in the log, the feature evaluation value of each string in the log is determined.

[0014] In another possible implementation, determining the positional features of each string in the log based on the position of each string in the log and the position of the center string in the log includes:

[0015] Based on the first position of the central string in the log and the second position of each string in the log, a relative position encoding algorithm is used to determine the positional characteristics of each string in the log relative to the central string;

[0016] The process of determining the feature evaluation value of each string in the log based on its string features and positional features includes:

[0017] Based on the string features and positional features of each string in the log, a pre-trained character evaluation model is used to determine the feature evaluation value of each string in the log. The feature evaluation value of the string is used to characterize the importance of the string in the log.

[0018] In another possible implementation, classifying the logs in the log group into at least one sub-log group based on the target string in each of the logs and the target position of the target string in the log includes:

[0019] Determine at least one reference log from the log group, and make each reference log a sub-log group;

[0020] For any log in the log group other than the reference log, based on the target string in the log and the target position of the target string in the log, a target reference log matching the log is determined from the at least one reference log, and the log is classified into the sub-log group where the target reference log is located, wherein the target string of the log is the same as the string in the target reference log at the target position.

[0021] In another possible implementation, determining the target reference log matching the log from the at least one reference log based on the target string in the log and the target position of the target string in the log includes:

[0022] Based on the target position of the target string in the log, if there is a candidate reference log where the string at the target position is the same as and unique to the target string in the log, the candidate reference log is determined as the target reference log that matches the log.

[0023] If there are multiple candidate reference logs where the string at the target position is the same as the target string in the log, the strings at other positions in the log are compared with the strings at the corresponding positions in each candidate reference log according to the feature evaluation value of each string in the log, until a target reference log is determined from multiple candidate reference logs where at least two positions of the string are the same as the string at the corresponding positions in the log and are unique.

[0024] The step of classifying the logs in the log group into at least one sub-log group based on the target string in each of the logs and the target position of the target string in the logs also includes:

[0025] If no target reference log matches the log, the log is identified as a new reference log and a sub-log group.

[0026] Another possible implementation includes:

[0027] For each log group, at least two logs in the log group whose log similarity exceeds a set threshold are identified as a sub-log group, thus obtaining at least one sub-log group classified in the log group and undetermined logs in the log group that have not yet been classified into a sub-log group.

[0028] The determination of the target string in each log based on the feature evaluation value of each string in each log of the log group includes:

[0029] For any pending log in the log group, the target string in the pending log is determined based on the feature evaluation value of each string in the pending log;

[0030] The step of classifying the logs in the log group into at least one sub-log group based on the target string in each of the logs and the target position of the target string in the log includes:

[0031] Based on the target string in each pending log, the target position of the target string in the pending log, and the logs contained in each classified sub-log group, the sub-log group to which the pending log should be classified is determined.

[0032] In another possible implementation, determining the target string in each log based on the feature evaluation value of each string in each log of the log group includes:

[0033] Based on the feature evaluation value of each string in the logs of the log group, the string with the highest feature evaluation value is determined as the target string in the logs;

[0034] or,

[0035] Based on the feature evaluation values ​​of each string in the logs of the log group, select the target string that does not belong to the punctuation marks or identifiers that meet the set conditions and has the highest feature evaluation value from the strings in the logs.

[0036] Another possible implementation includes:

[0037] For each sub-log group, if the strings at the reference position are the same in all logs of the sub-log group, it is determined that the strings at the reference position in each log of the sub-log group are constants, where the reference position is the position of any string in the log of the sub-log group.

[0038] If the strings of the logs in the sub-log group at the reference position are not completely identical, the strings of each log at the reference position are determined as variables;

[0039] Based on the constants and variables in the logs of the sub-log group, the distribution characteristics of constant variables corresponding to the logs of the sub-log group are determined.

[0040] Another possible implementation includes:

[0041] If the proportion of strings belonging to variables in the sub-log group exceeds a set proportion, determine the baseline position in the logs of the sub-log group, and divide the sub-log group into at least two secondary sub-log groups according to the strings of each log in the sub-log group at the baseline position;

[0042] The reference position is the position of the variable in the logs of the sub-log group, and each log contains the fewest types of strings at the reference position. The strings at the reference position are the same for all logs in the second-level sub-log group.

[0043] In another aspect, this application also provides a log classification device, comprising:

[0044] The log segmentation unit is used to segment multiple logs to be processed into at least two strings.

[0045] The feature evaluation unit is used to determine the feature evaluation value of each string in the log based on the string features of each string in the log and the position features of each string in the log.

[0046] The log grouping unit is used to group the multiple logs into at least one log group based on the number of strings in each log, and each log group includes at least two logs.

[0047] A string determination unit is used to determine the target string in each log for each log group based on the feature evaluation value of each string in each log of the log group;

[0048] A log classification unit is used to classify logs in a log group into at least one sub-log group for each log group based on the target string in each log and the target position of the target string in the log. Attached Figure Description

[0049] To more clearly illustrate the technical solutions in the embodiments of this application, the accompanying drawings used in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only embodiments of this application. For those skilled in the art, other drawings can be obtained based on the provided drawings without creative effort.

[0050] Figure 1 This paper illustrates a flowchart of a log classification method provided in an embodiment of this application.

[0051] Figure 2 This illustration shows another flowchart of the log classification method provided in an embodiment of this application;

[0052] Figure 3 This illustration shows another flowchart of the log classification method provided in an embodiment of this application;

[0053] Figure 4 This illustration shows a schematic diagram of one implementation principle for determining the feature evaluation value of a string in an embodiment of this application;

[0054] Figure 5 This illustration shows a flowchart of a method for determining the constant variable distribution characteristics of logs in a sub-log group according to an embodiment of this application;

[0055] Figure 6 An example diagram is shown illustrating an application scenario to which the solution of this application is applicable;

[0056] Figure 7 This illustration shows a schematic diagram of the composition structure of a log classification device provided in an embodiment of this application;

[0057] Figure 8 A schematic diagram of the composition structure of an electronic device provided in an embodiment of this application is shown. Detailed Implementation

[0058] The technical solutions of the embodiments of this application will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this application, and not all embodiments. Based on the embodiments of this application, all other embodiments obtained by those of ordinary skill in the art without creative effort are within the scope of protection of this application.

[0059] like Figure 1 The diagram illustrates a flowchart of a log classification method provided in an embodiment of this application. The method of this embodiment can be applied to electronic devices, such as personal computer devices or servers, or nodes in distributed systems or cluster systems, without limitation.

[0060] The method in this embodiment may include:

[0061] S101, segment the multiple logs to be processed into words, dividing each log into at least two strings.

[0062] Understandably, logs belonging to the same line of code are similar in length and the types of strings they contain. Therefore, the strings contained in the logs are the key basis for determining log classification. In order to classify the logs in the future, the logs need to be segmented into words.

[0063] In this application, the specific implementation of log segmentation can adopt any existing log segmentation method without restriction. For example, log segmentation rules can be set by combining the combination features of strings in the logs generated by the code, or a log segmentation model can be trained, and the log segmentation rules or the log segmentation model can be used to determine whether the log is segmented into multiple strings.

[0064] S102, For each log entry, based on the string characteristics of each string in the log entry and the position characteristics of each string in the log entry, determine the feature evaluation value of each string in the log entry.

[0065] Here, the string features can be features that represent the string itself. In this application, string features are the features that allow the string to be used as the basis for log classification.

[0066] Understandably, strings in logs can be divided into two types: constants and variables. Constants refer to parameters that remain unchanged. Therefore, for different logs generated from the same line of code, the strings corresponding to constants at the same position in each log are the same. Conversely, for variables in different logs generated from the same line of code, the strings corresponding to the variable positions in different logs will not be exactly the same. Based on this, constants at the same position in different logs generated from the same line of code are the same. Therefore, strings that are constants in logs can be used as a basis for log classification.

[0067] Based on this, the string features of the string in this application can be the relevant features that characterize whether the string belongs to a constant or a variable. Through these string features, the possibility that the string belongs to a constant or a variable can be reflected to a certain extent.

[0068] In one possible implementation, this application can combine a pre-constructed mapping relationship between strings and feature vectors to determine the feature vector corresponding to a string as the string feature of that string.

[0069] Specifically, for any string in the log, the positional feature of the string in the log is used to characterize the position of the string in the log and the positional relationship between the string and other strings in the log.

[0070] In the application, the positional characteristics of a string in the log can characterize the importance of the string in the log, that is, the likelihood that the string can be used as a basis for log classification.

[0071] In this application, there are multiple possible implementations for determining the positional characteristics of the string, and no limitation is imposed on them. For example, the positional characteristics of the string can be determined by combining one or more of the following: the string's positional order in the log and the positional relationship between the string and the string located in the center of the log.

[0072] In one possible implementation, this application can determine a central string in the log that can represent the topic of the log. For example, by performing semantic analysis on the log, the string that best expresses the topic of the log can be determined, and this string can be designated as the central string. Of course, there are other possible ways to determine the central string, and there are no restrictions on this.

[0073] Accordingly, this application can determine the positional characteristics of each string in the log based on the position of each string in the log and the position of the central string in the log.

[0074] For example, for each string in the log, the positional characteristics of the string are determined by combining its positional relationship with other strings and its positional relationship with the central string.

[0075] In one alternative approach, a relative positional encoding algorithm is used to determine the positional characteristics of each string relative to the central string in the log, based on the first position of the central string and the second position of each string in the log. This application does not restrict the process of encoding the positional characteristics of each string using a relative positional encoding algorithm.

[0076] Combining the positional features and string features of a string, we can see that the feature evaluation value of a string is used to characterize the importance of that string in the log. The higher the importance of a string, the more suitable it is as a basis for classifying the log. Therefore, the feature evaluation value of a string represents its likelihood of being used as a basis for log classification.

[0077] In particular, considering that logs can be classified based on constants in the logs, the feature evaluation value of the string can characterize the probability that the string belongs to a constant in the log and the importance of the string as a constant in the log.

[0078] Understandably, if a string is a constant in the log and the greater the importance of that constant in the log, the higher the feature evaluation value of that string. For example, if a string is a constant and does not contain punctuation marks without code semantics, then that string is more suitable as a basis for determining whether a log belongs to the same group as other logs; therefore, the feature evaluation value of that string will be relatively high.

[0079] In this application, there may be a variety of specific implementations for determining the feature evaluation value of a string based on its string features and positional features, and this application does not impose any restrictions on this.

[0080] For example, in one possible implementation, a pre-trained character evaluation model can be used to determine the feature evaluation value of each string in the log based on the string features and position features of each string in the log.

[0081] The character evaluation model can also be a pre-trained neural network model, such as a neural network model trained using the positional features and string features of each string in the log sample, based on the feature evaluation values ​​of each string labeled in the log sample.

[0082] The character evaluation model can also be a pre-trained Bidirectional Encoder Representations from Transformers (BERT) model and an attention model.

[0083] S103, based on the number of strings in each log, group the multiple logs into at least one log group.

[0084] The number of strings in a log refers to the number of strings contained in the log. The number of strings in a log can also be called the log length.

[0085] Each log group contains at least two logs.

[0086] Step S103 is the initial grouping of multiple logs. The logs can be grouped using conventional log classification methods, and there are no restrictions on the specific grouping method.

[0087] For example, log entries with the same number of strings can be grouped into one log group, resulting in at least one log group from multiple log entries. Correspondingly, all log entries within the same log group have the same number of strings.

[0088] S104. For each log in a log group, determine the target string in that log based on the feature evaluation value of each string in the log.

[0089] The target string refers to the string that can be used to determine the log category.

[0090] In this application, there are several possible ways to determine the target string.

[0091] For example, based on the feature evaluation values ​​of each string in the log, the string with the highest feature evaluation value can be identified as the target string in the log.

[0092] For example, some types of punctuation marks or identifiers in the log may have high feature evaluation values ​​due to their proximity to the center string or other reasons, but these types of punctuation marks and identifiers are not representative or important constants in the log. Based on this, this application can also select the target string with the highest feature evaluation value from the strings in the log that does not meet the set conditions for punctuation marks or identifiers.

[0093] Of course, in practical applications, there are other ways to determine the target string, such as selecting any one of the strings with higher feature evaluation values ​​(e.g., the first 3) as the target string, without any restrictions.

[0094] S105, for each log group, based on the target string in each log and the target position of the target string in the log, classify the logs in the log group into at least one sub-log group.

[0095] Logs belonging to the same sub-log group are logs belonging to the same line of code, that is, logs generated when the same line of code is executed.

[0096] Specifically, for each target string in a log, the target position refers to its location within that log entry. The target position of a target string within a log entry can represent its order within the log. For example, if the target string is the third string in a log entry, then its target position is the third position of the third string in the log entry.

[0097] It is understandable that, for each log in each log group, based on the target string of each log and the target position of the target string in the log, at least one other log whose target position string is the same as the target string of that log can be classified into a sub-log group with that log.

[0098] For example, for a log entry in a log group, the target string in that log entry is likely to be a constant and is representative of the string. Based on this, and considering the target position of the target string in that log entry, if another log entry in the log group has the same target string at that position, then it can be concluded that both log entries are constants at that position. Furthermore, two log entries within the same log group with identical constant strings at the same position can only be log entries generated by the same line of code.

[0099] In this application, the feature evaluation value of a string in the log is determined based on the string's string characteristics and its position in the log. This allows the string's feature evaluation value to reflect the likelihood of the string being used as a basis for log classification. Therefore, by combining the feature evaluation value of a string in the log, the target string as a basis for classification can be determined more reasonably and reliably. Based on the target string of each log in the log group and the target position of the target string in the log, similar logs can be more accurately classified into a sub-log group, thereby more accurately classifying logs generated by the same line of code into a sub-log group.

[0100] To facilitate understanding of the process of classifying logs in a log group into at least one sub-log group, the following explanation uses one implementation method as an example.

[0101] like Figure 2 The diagram illustrates a flowchart of a log classification method provided in an embodiment of this application. The method in this embodiment may include:

[0102] S201, segment the multiple logs to be processed into words, dividing each log into at least two strings.

[0103] S202, Based on the string characteristics of each string in the log and the position characteristics of each string in the log, determine the feature evaluation value of each string in the log.

[0104] S203, based on the number of strings in each log, group multiple logs into at least one log group.

[0105] Each log group contains at least two logs.

[0106] For example, logs containing the same number of strings can be grouped into a log group, resulting in at least one log group from which multiple logs are grouped.

[0107] S204, For each log group, determine the target string in each log based on the feature evaluation value of each string in each log of the log group.

[0108] The above steps can be found in the relevant descriptions of the previous embodiments, and will not be repeated here.

[0109] S205, determine at least one reference log from the log group, and make each reference log a sub-log group.

[0110] Among them, the log similarity between different reference logs is lower than a set threshold, or for any reference log, the string at the target position corresponding to the reference log in other reference logs is different from the target string in the reference log.

[0111] The similarity between any two log entries can be determined based on the number of identical strings in the same position in both log entries. For example, if all log entries in a log group have the same length, then for any two log entries in the log group, the total number of identical strings in the same position can be determined, and the ratio of this total number to the length of the corresponding log entry in the log group can be used to determine the log similarity.

[0112] In this embodiment, there are several ways to determine the reference log:

[0113] For example, a log entry can be randomly selected as a reference log entry. Then, as the process of determining the sub-log groups to which each log entry in the log group can be divided is carried out, new reference log entries are gradually identified, and finally the classification of each log entry in the log group into sub-log groups is completed.

[0114] For example, at least one pair of logs with a similarity of less than a set threshold can be selected from the log group, and each pair of logs can be used as a reference log to obtain at least two reference logs.

[0115] For example, for each log group, at least two logs in the log group whose log similarity exceeds a set threshold are identified as a sub-log group, and one log is randomly selected from the sub-log group as a reference log. In this case, for each log belonging to the same sub-log group as the reference log, step S206 does not need to be executed again. Of course, it is also possible to re-determine the sub-log group for any log other than the reference log according to S206, without any restrictions.

[0116] Of course, there are other ways to determine the reference log, and this application does not limit this.

[0117] S206. For any log in the log group other than the reference log, based on the target string in the log and the target position of the target string in the log, determine the target reference log that matches the log from at least one reference log, and classify the log into the sub-log group where the target reference log is located.

[0118] Specifically, for any log and its corresponding target reference log, the target string of the log is the same as the string at the target position in the target reference log. Here, the target position is the target position of the target string in the log.

[0119] As introduced above, for logs in a log group, the target string in the log is a string that can represent the line of code to which the log belongs. For example, if the target string is a constant, and different logs generated by the same line of code have the same constant at the same position, then based on the target position of the target character in the log, if a reference log is found where the string at that target position is the same as the target string in the log, then it can be concluded that the reference log is likely to belong to the same line of code as the log. Therefore, the log can be classified into the sub-log group where the reference log is located.

[0120] It is understandable that, considering the possibility that logs generated from different lines of code may contain the same constants at the same location, this application can further improve the accuracy of log classification by handling the following two cases:

[0121] In one scenario, for each log entry in the log group other than the target log entry, based on the target position of the target string in that log entry, if there exists a unique candidate reference log entry where the string at that target position is identical to the target string in that log entry, that candidate reference log entry is determined as the target reference log entry matching the log entry. This candidate reference log entry belongs to at least one determined reference log entry.

[0122] In another scenario, based on the target string in the log and its target position in the log, if there are multiple candidate reference logs where the string at the target position is the same as the target string in the log, the strings at other positions in the log are compared with the strings at the corresponding positions in each candidate reference log according to the feature evaluation value of each string in the log, until a target reference log is determined from multiple candidate reference logs where at least two positions of the string are the same as the string at the corresponding positions in the log and are unique.

[0123] Understandably, if only one reference log has the same string as the log at the target location, then the log can only be generated by the code line corresponding to the reference log, and there is no possibility that other code lines will generate the log. Therefore, the log and the reference log can be directly grouped into a sub-log group.

[0124] If multiple candidate reference logs exist, it means that this log may belong to the same line of code as one of the candidate reference logs, but it is not yet possible to determine which candidate reference log it belongs to. Therefore, it is necessary to compare the strings in other positions of this log with the corresponding strings in each candidate reference log.

[0125] To improve matching accuracy, this application will compare the strings in other positions of the log with the corresponding strings in each candidate reference log according to the feature evaluation value of each string in the log.

[0126] Specifically: Based on the feature evaluation values ​​of each string in the log, the string with the highest feature evaluation value that is not currently a target string is identified as the new target string. Then, based on the target position of the most recently identified target string in the log, candidate reference logs whose strings at that position are different from the most recently identified target string are eliminated. If only one candidate reference log remains after elimination, that candidate reference log is identified as the target reference log; if multiple candidate reference logs remain after deletion, the process of identifying the string with the highest feature evaluation value that is not currently a target string is repeated until only one candidate reference log is identified, which is then identified as the target reference log.

[0127] Understandably, in practical applications, there may be situations where no target reference log matches a given log entry. In such cases, if no target reference log matches the log entry, it means that the log entry does not belong to the same line of code as any other reference logs. Therefore, the log entry belongs to a new sub-log group, and this log entry is designated as the new reference log. This reference log entry is then compared with other log entries in the log group whose sub-log groups have not yet been determined, in order to ultimately identify all log entries belonging to the same sub-log group as the given log entry.

[0128] It is understood that, in any of the above embodiments of this application, in order to improve the efficiency of classifying logs in a log group and reduce the complexity of comparing logs with strings at different positions in each reference log one by one, for each log group, this application may first determine at least two logs in the log group whose log similarity exceeds a set threshold as a sub-log group, thereby obtaining at least one sub-log group classified in the log group and undetermined logs in the log group that have not yet been classified into a sub-log group.

[0129] Based on this, this application only needs to determine the target string in each pending log in the log group, based on the feature evaluation value of each string in the pending log. Accordingly, it only needs to determine the sub-log group to which the pending log should be classified, based on the target string in each pending log, the target position of the target string in the pending log in the pending log, and the logs contained in each classified sub-log group.

[0130] The process of determining the sub-log group to which the pending logs should be classified can be found in the previous embodiments. For example, each pending log in the log group can be classified according to the previous... Figure 2 The operations in S205 and S206 of the embodiment determine the log group to which each pending log belongs, which will not be described in detail here.

[0131] To gain a more comprehensive understanding of the log classification method of this application, the following description will be based on a specific implementation of the log classification method of this application.

[0132] like Figure 3 As shown, it illustrates another flowchart of the log classification method provided in this application embodiment. The method of this embodiment may include:

[0133] S301, segment the multiple logs to be processed into words, dividing each log into at least two strings.

[0134] S302, For each log entry, determine the central string in the log that can represent the topic of the log. Based on the first position of the central string in the log and the second position of each string in the log, use a relative position encoding algorithm to determine the positional features of each string in the log relative to the central string.

[0135] S303. For each log entry, based on the string features and positional features of each string in the log, a pre-trained character evaluation model is used to determine the feature evaluation value of each string in the log.

[0136] For example, if the pre-trained character evaluation model includes a BERT model and an attention model, then the string features and position features of each string in the log can be processed by the BERT model and the attention model in turn to obtain the feature evaluation value corresponding to each string in the log.

[0137] The string's feature evaluation value is used to characterize the string's importance in the log.

[0138] In this embodiment, the higher the feature evaluation value of a string, the greater the likelihood that the string belongs to a constant, and the higher the reliability of the string in determining log classification.

[0139] like Figure 4 As shown, it illustrates a schematic diagram of a principle for determining the feature evaluation value of each string in the log in this application.

[0140] Depend on Figure 4 As can be seen, after obtaining the log, the log can be segmented to obtain a list of strings included in the log. For the list of strings in the log, the string vector (string feature) and position feature of each string in the list can be determined. Then, the position features and string vectors of each string in the log are input into the character evaluation model to obtain the string evaluation value of each string in the log.

[0141] S304. Divide each log into at least one log group according to the log length of each log.

[0142] In each log group, all logs have the same length. Log length refers to the number of strings contained in the log.

[0143] S305, for each log group, at least two logs in the log group whose log similarity exceeds a set threshold are identified as a sub-log group, thus obtaining at least one sub-log group classified in the log group and undetermined logs in the log group that have not yet been classified into a sub-log group.

[0144] In this application, for ease of distinction, logs in a log group that have not yet been classified into a sub-log group are referred to as pending logs.

[0145] It is understandable that for the same line of code, the logs generated by that line of code must have the same length. Therefore, dividing logs into different log groups based on log length can effectively remove some logs that do not belong to the same line of code.

[0146] Based on this, and considering the similarity of logs generated from the same line of code, this application categorizes logs in a log group whose similarity exceeds a set threshold into the same sub-log group. This allows logs belonging to the same line of code within the same log group to be grouped into the same sub-log group first. By classifying logs with similarity exceeding the set threshold into a sub-log group first, the number of pending logs that need to be compared with reference logs can be reduced, which helps improve the efficiency of classifying all logs in the log group.

[0147] S306, Select one log from each sub-log group of the log group as the reference log for that sub-log group.

[0148] In this step, a log can be randomly selected from each sub-log group as a reference log. Of course, reference logs can also be selected from sub-log groups in other ways, without any restrictions.

[0149] S307, determine the target pending log to be classified from the pending logs of the log group, determine the target string with the highest feature evaluation value in the target pending log and the target position of the target string in the target pending log.

[0150] S308, check if there is a candidate reference log in the log group whose string at the target position is the same as the target string of the target pending log. If yes, proceed to step S309; ​​if no, proceed to step S314.

[0151] S309, determine whether the number of candidate reference logs is one. If yes, proceed to step S310; otherwise, proceed to step S312.

[0152] S310, determine the candidate reference log as the target reference log that matches the target pending log, and classify the target pending log into the sub-log group where the target reference log is located;

[0153] S311, check if there are any unclassified logs in the log group. If yes, return to step S307; otherwise, determine that the classification of each log in the target log group has been completed, and obtain at least one log group classified from the log group, and end the operation.

[0154] S312, Based on the feature evaluation values ​​of each string in the target pending log, determine the candidate string with the highest feature evaluation value that has not yet been used as a target string in the target pending log, and use the candidate string as the latest target string in the target pending log;

[0155] S313, based on the most recently determined target string and the target position of the target string among the target undetermined characters, remove the candidate reference logs whose strings at the target positions are different from the most recently determined target string, and return to step S309 based on the remaining candidate reference logs after removal.

[0156] S314, the target pending log is identified as a new reference log, the target pending log is identified as a sub-log group, and the process returns to step S311.

[0157] Understandably, considering that some punctuation marks or identifiers with high feature evaluation values, but which may not be constants, could interfere with log classification, in step S314, if no candidate reference log matches the target pending log, the target string with the highest feature evaluation value can be selected from the strings of the target pending log that does not meet the set conditions for punctuation marks or identifiers. Then, based on the determined target string, step S309 is executed again. If no candidate reference log matches the target pending log again, the target pending log is determined as a newly added reference log.

[0158] Of course, if step S309 is re-executed and a candidate reference log matching the target pending log is found, then step S310 and subsequent operations can be followed to determine the sub-log group to which the target pending log should be classified, as described above, and will not be repeated here.

[0159] As shown in this embodiment, logs with the same length are first grouped into a log group, so that logs that may originate from the same line of code are in the same log group. Based on this, considering that logs from the same line of code not only have the same length but also similar strings, for each log group, at least two logs with a similarity exceeding a set threshold are classified into sub-log groups according to the log similarity between logs in the group. This further determines which logs in the log group can be classified into sub-log groups, reducing the number of unclassifiable logs.

[0160] Based on this, for pending logs in the log group, since the feature evaluation value of the string in the pending log can characterize the probability that the string belongs to a constant and the importance of the string to the pending log, combined with the reference logs in the already classified sub-log groups, and the feature evaluation values ​​of each string on the pending log in the log group, the strings in the pending log that are likely to be constants and have high importance are compared with the strings at the corresponding positions in the reference logs. This allows for a more reliable identification of the unique reference log that is similar to the pending log, and naturally determines the sub-log group to which the log actually belongs. This allows for a more accurate identification of the sub-log groups to which each log in the log group belongs, and also identifies the sub-log groups corresponding to the same line of code. This provides a reliable basis for engineers to conduct anomaly investigation or other log analysis by combining the logs of each line of code, and can reduce the time engineers need to spend analyzing logs during the log analysis process.

[0161] It is understood that, in any of the above embodiments of this application, after determining each sub-log group, in order to further reduce the complexity of engineers analyzing the logs corresponding to the code, this application may also determine the constants and variables in each log in the sub-log group corresponding to each line of code.

[0162] like Figure 5 The diagram illustrates a flowchart of a log classification method provided in this application for determining the constant variable distribution characteristics of logs. The method of this embodiment may include:

[0163] S501, for any reference position in each log of each sub-log group, if the strings at the reference position in each log of the sub-log group are the same, it is determined that the strings at the reference position in each log of the sub-log group are constants.

[0164] The reference position refers to the location of any string in the logs of the sub-log group.

[0165] For example, if the logs in a sub-log group have the same length, then each log in the sub-log group contains the same number of strings. The position of each string in any log needs to be used as a reference position to determine whether the string at that reference position in all logs in the sub-log group is a constant or a variable.

[0166] S502, if the strings of each log in the sub-log group are not completely identical at the reference position, determine the string of each log at the reference position as a variable.

[0167] Understandably, since constants are fixed parameters, and all logs in a sub-log group originate from the same line of code, if the string at a certain position in a log within a sub-log group is constant, then the strings at that position in other logs within that sub-log group are also constant, and the strings at that position should be identical across all logs. Therefore, if the strings at the same reference position are identical across all logs in a sub-log group, then the strings at that reference position are determined to be constant.

[0168] Conversely, if the strings of the logs in a sub-log group are not completely identical at the same reference position, it can be said that the strings of the logs in that sub-log group at that reference position are variables.

[0169] S503. Based on the constants and the positions of variables in the logs of the sub-log group, determine the distribution characteristics of constant variables corresponding to the logs of that sub-log group.

[0170] Through the preceding steps S501 and S502, it can be determined whether the strings in each position of each log in the sub-log group are constants or variables. Moreover, the distribution of constants and variables in any log in the sub-log group is the same. Accordingly, the distribution characteristics of constant variables in the logs of the sub-log group can be obtained.

[0171] Among them, the constant variable distribution feature can characterize the parameter type of any log in the sub-log group at each position, which can be a constant or a variable.

[0172] Furthermore, considering that the proportion of variables in the logs generated by code lines generally does not exceed a set proportion, this application can also determine whether the sub-log group can be further classified based on whether the proportion of variables in any log in the sub-log group exceeds a set proportion, that is, whether the sub-log group contains logs belonging to at least two different code lines.

[0173] Specifically, for each sub-log group, if the proportion of strings belonging to variables in the sub-log group exceeds a set threshold, the baseline position in the logs of the sub-log group is determined, and the sub-log group is divided into at least two secondary sub-log groups according to the strings of each log in the sub-log group at the baseline position.

[0174] The baseline position is the position of the variable in the logs of the sub-log group, and each log contains the fewest types of strings at the baseline position.

[0175] In this second-level sub-log group, all logs have the same string at this baseline position.

[0176] For example, suppose a sub-log group contains 10 logs, each log has a length of 8, and the ratio is set to 1 / 2.

[0177] If any log entry in a sub-log group contains strings belonging to variables in at least five positions, then the proportion of variables in that log group exceeds half. In this case, we can determine which position in the sub-log group contains the fewest different types of strings belonging to variables. For example, if the second position in a sub-log group contains a variable string, and the 10 log entries in the sub-log group have two different strings in that second position, then log entries containing the same string in the second position can be classified into a second-level sub-log group, thus allowing the sub-log group to be further divided into two second-level sub-log groups.

[0178] It is understandable that the second-level sub-log groups categorized from the sub-log groups can also be regarded as independent sub-log groups. The sub-log groups are further divided into second-level sub-log groups only for the purpose of easy differentiation.

[0179] Understandably, the same applies to each secondary sub-log group. Figure 4 The implementation method further determines the distribution of variables and constants in the secondary sub-log groups.

[0180] Of course, after determining the second-level sub-log groups, it is possible to further check whether the proportion of variables in the second-level sub-log groups exceeds the set proportion. If so, the second-level sub-log groups can be further divided in the same way as the sub-log groups are divided into second-level sub-log groups, until the proportion of variables in each second-level sub-log group does not exceed the set proportion.

[0181] It is understood that there may be many possible application scenarios for log classification in the embodiments of this application, and no restrictions are imposed on them.

[0182] In a more typical scenario, the code line to which a sub-log group belongs can be determined based on the constant variable distribution characteristics of the logs in each sub-log group, and code line fault detection can be performed based on each log in that sub-log group.

[0183] Let's illustrate this with an example of an application scenario.

[0184] like Figure 6 As shown, it illustrates an example of an application scenario to which the solution of this application applies.

[0185] Depend on Figure 6As can be seen, the First Failure Data Capture (FFDC) mechanism automatically captures information related to the code execution failure when the web browser experiences such a failure. In this application, the FFDC mechanism can capture log files related to the code execution failure.

[0186] Additionally, log data from web browsers can be obtained by maintenance personnel or other users.

[0187] Log files captured using FFDC or log data obtained from the front end through other means will be decompressed and extracted to extract at least one required log entry.

[0188] Based on this, since the timestamp formats in the extracted logs are not uniform, this application will also standardize the format of the log stamps in the logs.

[0189] Unlike the current practice of directly storing extracted logs into a database, in this application, in order to facilitate engineers to perform more efficient fault detection and analysis based on logs, the log pattern of each extracted log is determined. The log pattern can be considered as the distribution pattern of constants and variables in the log.

[0190] Before determining the log pattern, based on the scheme of this application, multiple sub-log groups can be identified by classifying a large number of existing logs, and the constant variable distribution pattern of each log in the sub-log group can be determined.

[0191] Based on this, this application can use each log in each sub-log group as a log sample and the constant variable distribution pattern of the log as the label of the log, so that the pattern recognition model can be trained using the logs in each log group.

[0192] Correspondingly, for each log entry extracted using FFDC or other methods, the log entry can be input into the pattern recognition model to determine the distribution of constants and variables in the log entry, thus obtaining the constant variable distribution pattern of the log entry.

[0193] After determining the constant variable distribution pattern of the logs, the logs and their corresponding constant variable distribution patterns can be stored in the database or directly output to the engineer's analysis page to provide a basis for the engineer to analyze code faults.

[0194] Corresponding to the log classification method provided in this application, this application also provides a log classification device. For example... Figure 7 The diagram illustrates a structural composition of a log classification device provided in an embodiment of this application. The device in this embodiment may include:

[0195] Log segmentation unit 701 is used to segment multiple logs to be processed into words, dividing each log into at least two strings;

[0196] The feature evaluation unit 702 is used to determine the feature evaluation value of each string in the log based on the string features of each string in the log and the position features of each string in the log.

[0197] Log grouping unit 703 is used to group the multiple logs into at least one log group based on the number of strings in each log, and each log group includes at least two logs;

[0198] The string determination unit 704 is used to determine the target string in each log for each log group based on the feature evaluation value of each string in each log of the log group;

[0199] The log classification unit 705 is used to classify the logs in the log group into at least one sub-log group for each log group based on the target string in each log and the target position of the target string in the log.

[0200] In one possible implementation, the feature evaluation unit includes:

[0201] A center determination unit is used to determine a center string in the log that can characterize the log topic;

[0202] A location feature determination unit is used to determine the location features of each string in the log based on the position of each string in the log and the position of the center string in the log.

[0203] The evaluation value determination unit is used to determine the feature evaluation value of each string in the log based on the string features and position features of each string in the log.

[0204] In another possible implementation, the position feature determination unit is specifically used to determine the position feature of each string in the log relative to the central string based on the first position of the central string in the log and the second position of each string in the log, using a relative position encoding algorithm.

[0205] Specifically, the evaluation value determination unit is used to determine the feature evaluation value of each string in the log based on the string features and position features of each string in the log, using a pre-trained character evaluation model. The feature evaluation value of the string is used to characterize the importance of the string in the log.

[0206] In yet another possible implementation, the log classification unit includes:

[0207] A reference determination unit is used to determine at least one reference log from the log group, with each reference log forming a sub-log group;

[0208] The classification processing unit is used to, for any log other than the reference log in the log group, determine a target reference log matching the log from the at least one reference log based on the target string in the log and the target position of the target string in the log, and classify the log into the sub-log group where the target reference log is located, wherein the target string of the log is the same as the string at the target position in the target reference log.

[0209] In yet another possible implementation, the classification processing unit includes:

[0210] The first classification processing unit is used to, for any log in the log group other than the reference log, determine the candidate reference log as the target reference log that matches the log based on the target position of the target string in the log in the target position of the log.

[0211] The second classification processing unit is used to, if there are multiple candidate reference logs where the string at the target position is the same as the target string in the log, compare the strings at other positions in the log with the strings at corresponding positions in each candidate reference log according to the feature evaluation value of each string in the log, until a target reference log is determined from the multiple candidate reference logs where the strings at at least two positions are the same as the strings at corresponding positions in the log and are unique.

[0212] This log category also includes:

[0213] The third classification processing unit is used to identify the log as a newly added reference log and to identify the log as a sub-log group if there is no target reference log that matches the log.

[0214] In yet another possible implementation, the device further includes:

[0215] The preliminary classification unit is used to identify at least two logs in the log group whose log similarity exceeds a set threshold as a sub-log group for each log group, thereby obtaining at least one sub-log group classified in the log group and undetermined logs in the log group that have not yet been classified into a sub-log group.

[0216] Specifically, the string determination unit is used to determine the target string in any pending log in the log group based on the feature evaluation value of each string in the pending log;

[0217] Specifically, the log classification unit is used to determine the sub-log group to which the pending log should be classified based on the target string in each pending log, the target position of the target string in the pending log, and the logs contained in each classified sub-log group.

[0218] In yet another possible implementation, the string determination unit includes:

[0219] The first string determination unit is used to determine the string with the highest feature evaluation value as the target string in the log based on the feature evaluation value of each string in the log of the log group.

[0220] or,

[0221] The second string determination unit is used to select, based on the feature evaluation value of each string in the logs of the log group, the target string that does not belong to the punctuation marks or identifiers that meet the set conditions and has the highest feature evaluation value.

[0222] In yet another possible implementation, the device further includes:

[0223] A constant determination unit is used to determine that, for each sub-log group, if the strings at the reference position in each log of the sub-log group are the same, the strings at the reference position in each log of the sub-log group are constants, where the reference position is the position of any string in the log of the sub-log group.

[0224] A variable determination unit is used to determine the string of each log at the reference position as a variable if the strings of each log in the sub-log group are not completely identical at the reference position;

[0225] The distribution feature determination unit is used to determine the constant variable distribution features corresponding to the logs of the sub-log group based on the constants and the positions of variables in the logs of the sub-log group.

[0226] In yet another possible implementation, the device further includes:

[0227] The secondary classification unit is used to determine the baseline position in the logs of the sub-log group if the proportion of strings belonging to variables in the sub-log group exceeds a set proportion, and to divide the sub-log group into at least two secondary sub-log groups according to the strings in each log of the sub-log group at the baseline position.

[0228] The reference position is the position of the variable in the logs of the sub-log group, and each log contains the fewest types of strings at the reference position. The strings at the reference position are the same for all logs in the second-level sub-log group.

[0229] Furthermore, this application also provides an electronic device, such as Figure 8 As shown, it illustrates a schematic diagram of the composition structure of the electronic device. The electronic device can be any type of electronic device, and the electronic device includes at least a processor 801 and a memory 802.

[0230] The processor 801 is used to execute the log classification method in any of the above embodiments.

[0231] The memory 802 is used to store programs required by the processor to perform operations.

[0232] It is understood that the electronic device may also include a display unit 803 and an input unit 804.

[0233] Of course, the electronic device can also have more than Figure 8 There are no restrictions on the number of components, whether more or fewer.

[0234] On the other hand, this application also provides a computer-readable storage medium storing at least one instruction, at least one program, code set, or instruction set, wherein the at least one instruction, the at least one program, the code set, or the instruction set is loaded and executed by a processor to implement the log classification method as described in any of the above embodiments.

[0235] This application also proposes a computer program comprising computer instructions stored in a computer-readable storage medium. When run on an electronic device, the computer program performs the log classification method as described in any of the above embodiments.

[0236] It is understood that in this application, the terms "first," "second," "third," "fourth," etc. (if present) in the specification, claims, and accompanying drawings are used to distinguish similar parts and are not necessarily used to describe a specific order or sequence. It should be understood that such data can be interchanged where appropriate so that the embodiments of this application described herein can be implemented in a sequence other than that illustrated herein.

[0237] It should be noted that the various embodiments in this specification are described in a progressive manner, with each embodiment focusing on its differences from other embodiments. Similar or identical parts between embodiments can be referred to interchangeably. Furthermore, the features described in the various embodiments of this specification can be substituted or combined with each other, enabling those skilled in the art to implement or use this application. For apparatus embodiments, since they are basically similar to method embodiments, the description is relatively simple; relevant parts can be referred to the descriptions of the method embodiments.

[0238] Finally, it should be noted that in this document, relational terms such as "first" and "second" are used only to distinguish one entity or operation from another, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Furthermore, the terms "comprising," "including," or any other variations thereof are intended to cover non-exclusive inclusion, such that a process, method, article, or apparatus that comprises a list of elements includes not only those elements but also other elements not expressly listed, or elements inherent to such a process, method, article, or apparatus. Without further limitations, an element defined by the phrase "comprising one..." does not exclude the presence of other identical elements in the process, method, article, or apparatus that includes the element.

[0239] The above description of the disclosed embodiments enables those skilled in the art to make or use this application. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of this application. Therefore, this application is not to be limited to the embodiments shown herein, but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

[0240] The above are merely preferred embodiments of this application. It should be noted that those skilled in the art can make various improvements and modifications without departing from the principles of this application, and these improvements and modifications should also be considered within the scope of protection of this application.

Claims

1. A log classification method, comprising: The multiple log entries to be processed are segmented into words, and each log entry is divided into at least two strings. Based on the string features of each string in the log and the position features of each string in the log, determine the feature evaluation value of each string in the log; Based on the number of strings in each log entry, the multiple log entries are grouped into at least one log group, and each log group includes at least two log entries. For each log group, the target string in each log is determined based on the feature evaluation value of each string in each log of the log group; For each log group, the logs in the log group are classified into at least one sub-log group based on the target string in each log and the target position of the target string in the log.

2. The log classification method according to claim 1, wherein determining the feature evaluation value of each string in the log based on the string features of each string in the log and the position features of each string in the log includes: Determine the central string in the log that can characterize the log topic; Based on the position of each string in the log and the position of the central string in the log, determine the positional features of each string in the log; Based on the string features and positional features of each string in the log, the feature evaluation value of each string in the log is determined.

3. The log classification method according to claim 2, wherein determining the positional features of each string in the log based on the position of each string in the log and the position of the central string in the log includes: Based on the first position of the central string in the log and the second position of each string in the log, a relative position encoding algorithm is used to determine the positional characteristics of each string in the log relative to the central string; The process of determining the feature evaluation value of each string in the log based on its string features and positional features includes: Based on the string features and positional features of each string in the log, a pre-trained character evaluation model is used to determine the feature evaluation value of each string in the log. The feature evaluation value of the string is used to characterize the importance of the string in the log.

4. The log classification method according to claim 1, wherein classifying the logs in the log group into at least one sub-log group based on the target string in each log and the target position of the target string in the log, comprises: Determine at least one reference log from the log group, and make each reference log a sub-log group; For any log in the log group other than the reference log, based on the target string in the log and the target position of the target string in the log, a target reference log matching the log is determined from the at least one reference log, and the log is classified into the sub-log group where the target reference log is located, wherein the target string of the log is the same as the string in the target reference log at the target position.

5. The log classification method according to claim 4, wherein determining a target reference log matching the log from the at least one reference log based on the target string in the log and the target position of the target string in the log includes: Based on the target position of the target string in the log, if there is a candidate reference log that is identical and unique to the target string at the target position, the candidate reference log is determined as the target reference log that matches the log. If there are multiple candidate reference logs where the string at the target position is the same as the target string in the log, the strings at other positions in the log are compared with the strings at the corresponding positions in each candidate reference log according to the feature evaluation value of each string in the log, until a target reference log is determined from multiple candidate reference logs where at least two positions of the string are the same as the string at the corresponding positions in the log and are unique. The step of classifying the logs in the log group into at least one sub-log group based on the target string in each of the logs and the target position of the target string in the logs also includes: If no target reference log matches the log, the log is identified as a new reference log and a sub-log group.

6. The log classification method according to claim 1 further includes: For each log group, at least two logs in the log group whose log similarity exceeds a set threshold are identified as a sub-log group, thus obtaining at least one sub-log group classified in the log group and undetermined logs in the log group that have not yet been classified into a sub-log group. The determination of the target string in each log based on the feature evaluation value of each string in each log of the log group includes: For any pending log in the log group, the target string in the pending log is determined based on the feature evaluation value of each string in the pending log; The step of classifying the logs in the log group into at least one sub-log group based on the target string in each of the logs and the target position of the target string in the log includes: Based on the target string in each pending log, the target position of the target string in the pending log, and the logs contained in each classified sub-log group, the sub-log group to which the pending log should be classified is determined.

7. The log classification method according to claim 1, wherein determining the target string in each log based on the feature evaluation value of each string in each log of the log group includes: Based on the feature evaluation value of each string in the logs of the log group, the string with the highest feature evaluation value is determined as the target string in the logs; or, Based on the feature evaluation values ​​of each string in the logs of the log group, select the target string that does not belong to the punctuation marks or identifiers that meet the set conditions and has the highest feature evaluation value from the strings in the logs.

8. The log classification method according to claim 1 further includes: For each sub-log group, if the strings at the reference position are the same in all logs of the sub-log group, it is determined that the strings at the reference position in each log of the sub-log group are constants, where the reference position is the position of any string in the log of the sub-log group. If the strings of the logs in the sub-log group at the reference position are not completely identical, the strings of each log at the reference position are determined as variables; Based on the constants and variables in the logs of the sub-log group, the distribution characteristics of constant variables corresponding to the logs of the sub-log group are determined.

9. The log classification method according to claim 8 further includes: If the proportion of strings belonging to variables in the sub-log group exceeds a set proportion, determine the baseline position in the logs of the sub-log group, and divide the sub-log group into at least two secondary sub-log groups according to the strings of each log in the sub-log group at the baseline position; The reference position is the position of the variable in the logs of the sub-log group, and each log contains the fewest types of strings at the reference position. The strings at the reference position are the same for all logs in the second-level sub-log group.

10. A log classification device, comprising: The log segmentation unit is used to segment multiple logs to be processed into at least two strings. The feature evaluation unit is used to determine the feature evaluation value of each string in the log based on the string features of each string in the log and the position features of each string in the log. The log grouping unit is used to group the multiple logs into at least one log group based on the number of strings in each log, and each log group includes at least two logs. A string determination unit is used to determine the target string in each log for each log group based on the feature evaluation value of each string in each log of the log group; A log classification unit is used to classify logs in a log group into at least one sub-log group for each log group based on the target string in each log and the target position of the target string in the log.

Images