Warning method and device for log abnormity of application container, equipment and medium

Abstract

The invention discloses an application container log abnormity warning method and device, equipment and a medium. The method is characterized by comprising the following steps: performing log classification and updating on obtained application container log information, and determining log classification information; the log matching rule performs anomaly detection on the log classification information according to a regular monitoring frequency and a time search range corresponding to a preset log matching rule, and an anomaly alarm message is determined; and sending the abnormal alarm message to a message pushing system, and pushing the abnormal alarm message to a message pushing target through the message pushing system. According to the technical scheme, the working efficiency of a development team can be improved, the troubleshooting and problem solving speed can be increased, the stability and reliability of the system can be improved, the alarm message can be pushed to avoid information overload and repeated alarm by reasonably setting the alarm rule and processing the alarm message, and therefore developers can be better helped to effectively handle abnormal problems.

Description

Technical Field

[0001] The present invention relates to the technical field of log service of application containers, and in particular to a warning method, device, equipment and medium for abnormal application container logs. Background Art

[0002] An application container is a lightweight, portable, self-contained software runtime environment that ensures that applications can run consistently in any environment. When an application is running, the application container can monitor the status, problems, and abnormal failures of the application within the application container through the application container's log management. By collecting log information from the application container, it can monitor abnormal problems in the application and issue abnormal alarms. The existing technology usually collects, stores, searches, visualizes, and alarms application container logs through a distributed log system. However, the alarm function of the distributed log system cannot perform abnormal filtering and automatic alarm notification on log information, making it difficult to issue timely reminders for abnormal logs. Summary of the invention

[0003] The present invention provides a warning method, device, equipment and medium for abnormal application container logs, so as to solve the technical problem in the prior art that abnormal application container logs cannot be monitored and notified.

[0004] According to one aspect of the present invention, a method for warning of abnormal application container logs is provided, comprising:

[0005] Classify and update the obtained application container log information to determine the log classification information;

[0006] Perform anomaly detection on the log classification information according to the frequency and time search range of the scheduled monitoring corresponding to the preset log matching rule, and determine the abnormal alarm message;

[0007] The abnormal warning message is sent to a message push system, and the abnormal warning message is pushed to a message push target through the message push system.

[0008] According to another aspect of the present invention, a warning device for abnormal application container logs is provided, comprising:

[0009] A log classification module, used to classify and update the obtained application container log information and determine the log classification information;

[0010] An anomaly detection module, used to perform anomaly detection on the log classification information according to the frequency and time search range of the scheduled monitoring corresponding to the preset log matching rule, and determine the abnormal alarm message;

[0011] The message push module is used to send the abnormal warning message to the message push system, and push the abnormal warning message to the message push target through the message push system.

[0012] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0013] at least one processor; and

[0014] a memory communicatively connected to the at least one processor; wherein,

[0015] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for warning of application container log abnormality described in any embodiment of the present invention.

[0016] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for warning of application container log abnormality described in any embodiment of the present invention when executed.

[0017] The technical solution of the embodiment of the present invention classifies and updates the obtained application container log information, determines the log classification information, and classifies the application container log information, which can improve the efficiency of log monitoring; performs anomaly detection on the log classification information according to the frequency and time search range of the scheduled monitoring corresponding to the preset log matching rule, determines the abnormal alarm message, and can simultaneously perform anomaly monitoring based on the log classification information through multiple log matching rules, determine the abnormal alarm message that meets the log matching rules, and can identify abnormal log information, improve the accuracy of the alarm, and prevent the omission of abnormal log information; send the abnormal alarm message to the message push system, push the abnormal alarm message to the message push target through the message push system, and push the abnormal log information through the message push system, which can effectively solve the problem of pushing the log classification identifier and improve the timeliness of notifying the abnormal log. It solves the technical problem of the inability to monitor and notify exceptions in the logs of application containers in the existing technology. It classifies error logs according to exception types, and can display the container log content clearly and orderly, which can improve the work efficiency of the development team, speed up the troubleshooting and problem solving, and improve the stability and reliability of the system. By reasonably setting alarm rules and processing alarm messages, it can ensure that the push of alarm messages avoids information overload and repeated alarms, thereby better helping developers to effectively handle exceptions.

[0018] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0019] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0020] Figure 1 A flowchart of a warning method for abnormal application container logs is provided for an embodiment of the present invention;

[0021] Figure 2 A flowchart of another method for warning of abnormal application container logs provided by an embodiment of the present invention;

[0022] Figure 3 A flowchart of another method for warning of abnormal application container logs provided by an embodiment of the present invention;

[0023] Figure 4 A schematic diagram of the structure of a warning device for abnormal application container logs provided by an embodiment of the present invention;

[0024] Figure 5 A schematic structural diagram of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. DETAILED DESCRIPTION

[0025] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0026] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0027] Figure 1 A flowchart of a warning method for abnormal application container logs is provided for an embodiment of the present invention. This embodiment is applicable to log monitoring of application containers and the situation where an abnormal log is monitored and an alarm is issued. The method can be executed by a warning device for abnormal application container logs. The warning device for abnormal application container logs can be implemented in the form of hardware and / or software. The warning device for abnormal application container logs can be configured in an electronic device. Figure 1 As shown, the method includes:

[0028] S110: Classify and update the obtained application container log information to determine log classification information.

[0029] The application container can be a lightweight and portable container, and developers can package the application and its dependencies into the application container, thereby ensuring that the application runs normally in any environment. For example, the application container can use a Docker container.

[0030] The application container log information may be log information generated by the application in the application container during operation. Exemplarily, the application container log information may be error information, warning information, debugging information, operation information, and business logic log information. It should be noted that in the application container, the application container log information is usually set as a standardized and structured log with the same log format, and the application container generates the application container log information based on the log format.

[0031] Optionally, the log service of the application container supports multiple log drivers, which can output the application container log information in the application container to a preset target location. In an embodiment of the present invention, the application container log information is collected to a local specified directory of the server by using a fluent plug-in, and the application container log information is stored as a file in log format. In an embodiment of the present invention, when storing the application container log information, it can be saved as a log file in units of days, and the log file in the local specified directory is used as a backup record file and is persistently stored in the server.

[0032] Optionally, the embodiment of the present invention can be configured in a log management system, by collecting application container log information of the application container in the log management system, in the process of obtaining the application container log information, by using a log collection tool to read the application container log information of the application container, and sending the application container log information to the log management system, the log management system configures the corresponding input type of the log collection tool according to the data type of the application container log information, and then obtains the application container log information, so as to facilitate the processing of the application container log information. Exemplarily, the log collection tool can be a filebeat plug-in; the log management system can be a Graylog system.

[0033] Optionally, in the process of acquiring the application container log information, the log management system designs a configuration extractor, and the configuration extractor can extract the log information from the input stream transmitted by the log collection tool to obtain the application container log information.

[0034] Optionally, when the application container log information is obtained, the application container log information is classified, the abnormal labels and abnormal types in the application container log information are filtered, a log classification identifier is obtained based on the abnormal type of the application container log information, and the application container log information is classified into log classification information. The log classification information may be application container log information composed of the same log classification identifier. Since the log classification identifiers are multiple different abnormal types, the log classification information has different data sets.

[0035] S120: Perform anomaly detection on the log classification information according to the frequency and time search range of the scheduled monitoring corresponding to the preset log matching rule, and determine an abnormal alarm message.

[0036] Among them, the number of preset log matching rules is at least one. The preset log matching rule can be a pre-set rule for searching the log classification identifier in the log classification information; it should be noted that the preset log matching rule is usually set in the log management system, and the preset log matching rule is specified in the alarm function of the log management system, and the preset log matching rule is applied to the input stream of the log classification information, and the corresponding timed monitoring frequency and time search range are set for each preset log matching rule. Among them, the timed monitoring can be used to periodically execute the preset log matching rules, and the execution results are output in a specified manner; the time search range can determine the actual segment covered by each execution of the log matching rule, and the time search range can be set to a fixed time period or a dynamic time range.

[0037] Exemplarily, when the log management system is the Graylog system, by entering the Graylog We b interface, selecting the function of creating an input stream, configuring the input stream of log classification information, adding a preset log matching rule to the input stream: matching log messages; field is http.response.status_code; operation is equal to; value is set to 500; urgency is high, and adding a scheduled monitoring frequency of 8 a.m. every day and a time search range of the past 24 hours, thereby completing the preset log matching rule for monitoring HTTP 500 errors.

[0038] The abnormal alarm information may be an alarm message generated based on log classification information that satisfies at least one log matching rule. Exemplarily, the abnormal alarm message may be a message template for pre-configured alarm messages, which sets the message template for log timestamp, alarm timestamp, application container name, abnormal type, urgency, and log message content, and after the preset log matching rule detects an abnormal log classification information, calls the message template to generate an abnormal alarm message corresponding to the abnormal log classification information.

[0039] Specifically, after the log management system obtains the log classification information, it pre-sets at least one preset log matching rule, and sets the frequency and time search range of the corresponding scheduled monitoring corresponding to each preset log matching rule. The log classification information is detected for anomalies based on the frequency and time search range of the scheduled monitoring corresponding to each log matching rule, and then the log classification information that meets the log matching rule is determined as an abnormal alarm message.

[0040] S130: Send the abnormal warning message to a message push system, and push the abnormal warning message to a message push target through the message push system.

[0041] Among them, the message push system can be pre-set for pushing messages. The message push target can be the target to which the abnormal alarm message needs to be pushed. Exemplarily, the message push system can be a pre-configured Webhook system, and the message push target can be a DingTalk group and / or an enterprise WeChat group. Through the service of the Webhook system, the Webhook URL of the enterprise WeChat group or DingTalk group is obtained, and a POST request is sent through the Webhook URL to send an abnormal alarm message to the enterprise WeChat group or DingTalk group.

[0042] Specifically, the log management system sends the abnormal warning message to the message push system, and the message push system pushes the abnormal warning message to the message push target.

[0043] Optionally, a display function corresponding to the log classification information is also set in the log management system. The display function performs log classification identification statistics according to the log classification information, and displays the statistical distribution within a period of time in the form of bar charts, pie charts, line charts, etc.; the statistical totals of the log classification information corresponding to the time range of various log classification identifications can also be displayed in the form of a table.

[0044] The technical solution of the embodiment of the present invention classifies and updates the obtained application container log information, determines the log classification information, and classifies the application container log information, which can improve the efficiency of log monitoring; performs anomaly detection on the log classification information according to the frequency and time search range of the scheduled monitoring corresponding to the preset log matching rule, determines the abnormal alarm message log matching rule, and can simultaneously perform anomaly monitoring based on the log classification information through multiple log matching rules, determine the abnormal alarm message that meets the log matching rule, and can identify abnormal log information, improve the accuracy of the alarm, and prevent the omission of abnormal log information; send the abnormal alarm message to the message push system, and push the abnormal alarm message to the message push target through the message push system. Pushing the abnormal log information through the message push system can effectively solve the problem of pushing the log classification identifier and improve the timeliness of notifying the abnormal log. The technical problem of the inability to monitor and notify exceptions in the logs of application containers in the existing technology is that by classifying error logs according to exception types, the container log contents can be displayed clearly and orderly, which can improve the work efficiency of the development team, speed up the troubleshooting and problem solving, and improve the stability and reliability of the system; by reasonably setting alarm rules and processing alarm messages, it can ensure that the push of alarm messages avoids information overload and repeated alarms, thereby better helping developers to effectively handle exceptions.

[0045] Figure 2This is a flowchart of another method for warning of abnormal application container logs provided by an embodiment of the present invention. The relationship between this embodiment and the above embodiment is the specific process of abnormal monitoring through a log management system. Figure 2 As shown, the method includes:

[0046] S210: Classify and update the obtained application container log information to determine log classification information.

[0047] S220: Match the log classification information according to the frequency and time search range of the scheduled monitoring corresponding to the preset log matching rule.

[0048] Specifically, in the log management system, each preset log matching rule will match the log classification identifier in the log classification information within the frequency and time search range of the scheduled monitoring corresponding to the preset log matching rule, that is, the log classification information will be matched simultaneously by multiple preset log matching rules.

[0049] S230: When any one of the preset log matching rules successfully matches the log classification information, a log alarm event is triggered, and the abnormal alarm message is determined according to the log classification information and the preset log matching rule.

[0050] The log alarm event may be a notification or warning event when the log management system detects an abnormality in the log classification information.

[0051] Specifically, each preset log matching rule will match the log classification identifier in the log classification information within the frequency and time search range of the scheduled monitoring corresponding to the preset log matching rule. If any preset log matching rule successfully matches the log classification identifier in the log classification information, it means that this log classification information has triggered a log alarm event of the log management system. The log management system will generate an abnormal alarm message based on the log classification information and the preset log matching rule that successfully matches the log classification information.

[0052] Optionally, when the same preset log matching rule matches the log classification information, multiple different log classification information will be successfully matched, and one preset log matching rule can generate multiple log alarm messages; similarly, since one log classification message will be queried and searched and matched by multiple preset log matching rules, multiple log alarm messages obtained from one log classification message can be obtained.

[0053] Optionally, in another optional embodiment of the present invention, the determining the abnormal alarm message according to the log classification information and the preset log matching rule includes:

[0054] The alarm event data corresponding to the log alarm event is recorded according to the log classification information and the preset log matching rule; the alarm event data is message encapsulated to determine the abnormal alarm message.

[0055] Among them, the alarm event data can be the log information and alarm information corresponding to the abnormal alarm event. It should be noted that the alarm event data includes log information such as log content, log generation time, application container name corresponding to the log, and abnormal type; the alarm message can be the generation time and urgency of the alarm event. It should be noted that the generation time of the alarm event can be the time when a preset log matching rule successfully matches the log classification identifier in the log classification information, and the time when the log alarm event that triggers the log management system is recorded; the urgency can be the corresponding urgency set for the preset log matching rule before the preset log matching rule is set.

[0056] Optionally, when setting the urgency level, the abnormality type corresponding to the preset log matching rule can be referred to, and the corresponding urgency level can be set according to the harm level corresponding to the abnormality type. Exemplarily, the urgency level can be set to level 1, level 2, and level 3, corresponding to system abnormality, application abnormality, and network abnormality, respectively.

[0057] Optionally, after obtaining the alarm event data, the log management system obtains a predefined message structure, uses the alarm event data as message metadata, and then adds the message metadata to the message structure, which is the abnormal alarm message corresponding to the log alarm event; it should be noted that a message identifier can be generated based on the log information and alarm information in the alarm event data to identify each abnormal alarm message.

[0058] Specifically, the log management system extracts data from the log classification information, obtains the time when the emergency situation and abnormal alarm events corresponding to the preset log matching rules occur, and then records the alarm event data corresponding to the log alarm event, encapsulates the alarm event data into messages, and determines the abnormal alarm message.

[0059] S240: Send the abnormal warning message to a message push system, and push the abnormal warning message to a message push target through the message push system.

[0060] Optionally, in another optional embodiment of the present invention, sending the abnormal warning message to a message push system includes:

[0061] An abnormal alarm notification is generated based on the abnormal alarm message; wherein the abnormal alarm notification includes at least one abnormal alarm message; and the abnormal alarm notification is sent to the message push system through a preset notification sending frequency and a first sending period.

[0062] The abnormal alarm notification may be a notification of issuing a warning; the abnormal alarm notification is composed of an abnormal alarm message, and one abnormal alarm notification is usually composed of multiple abnormal alarm messages and may include multiple log information.

[0063] Optionally, the log management system can be set to limit the number of abnormal alarm messages carried by an abnormal alarm notification, and can set a corresponding notification sending frequency and sending period for each abnormal alarm notification. Among them, the sending period of the abnormal alarm notification can be set to the first sending period; the notification sending frequency can be the number of times the abnormal alarm notification is sent within a certain period of time; the first sending period can be the control mode for sending abnormal alarm notifications within a specific time period.

[0064] Optionally, the log management system may uniformly manage the abnormal alarm notifications, and may directly control the notification sending frequency and the first sending period of all abnormal alarm notifications, and set the notification sending frequency and the first sending period of all abnormal alarm notifications to the same value.

[0065] Specifically, the number of abnormal alarm messages usually carried by an abnormal alarm is set according to the log management system, an abnormal alarm notification is composed based on the abnormal alarm message, and then the abnormal alarm notification is sent to the message push system according to the preset notification sending frequency and the first sending cycle.

[0066] Optionally, in another optional embodiment of the present invention, pushing the abnormal warning message to the message push target through the message push system includes:

[0067] Extracting log content of the abnormal warning message through the message push system to determine the log content of the abnormal warning message;

[0068] When the amount of information in the log content of the abnormal warning message is greater than a preset content threshold, the log content of the abnormal warning message is cut by the message push system to determine an error push message;

[0069] When the push frequency corresponding to the abnormal type of the error push message is less than a preset push upper limit threshold, the error push message is pushed to the message push target through the message push system.

[0070] The log content may be the content of the application container log information generated by the application container in the abnormal alarm message.

[0071] Optionally, after receiving the abnormal alarm notification, the message push system extracts data from the abnormal alarm notification to obtain at least one abnormal alarm message, and performs secondary extraction on the abnormal alarm message to obtain log content in the abnormal alarm message.

[0072] Optionally, when the message push system pushes to the message push target, the message push target will limit the amount of information in the pushed text content, that is, set a preset content threshold. In order to prevent the pushed information from being greater than the preset content threshold, resulting in push failure, it is necessary to check the amount of information in the log content in the alarm message to prevent pushing messages with too much information.

[0073] The preset content threshold may be a size threshold that is preset to determine whether the log content meets the push requirement.

[0074] The error push information may be push content whose information volume meets a preset content threshold.

[0075] Optionally, the message push system determines the amount of information in the log content of the abnormal alarm message by a preset content threshold. If the amount of information in the log content of the abnormal alarm message is less than the preset content threshold, the log content of the abnormal alarm message is directly used as an error push message; if the amount of information in the log content of the abnormal alarm message is greater than the preset content threshold, the log content of the abnormal alarm message needs to be cut. The method of information cutting is to use the preset content threshold as a reference size for the amount of information to be cut, cut the log content of the abnormal alarm message, retain the key error information, and then obtain the error push message. It should be noted that in the application container log information, the error information is usually located in the first half, and the error push information obtained by cutting can provide sufficient error information.

[0076] Optionally, when the message push system pushes an error push message, it is necessary to detect the abnormal type of the error push message and determine the relationship between the push frequency corresponding to the abnormal type and the preset push upper limit threshold. If the push frequency corresponding to the abnormal type is equal to the preset push upper limit threshold, the message push system considers that the error push message of the abnormal type will not be pushed, and sets the second sending period corresponding to the abnormal type. During the second sending period, the message push system will not push the error push message of the abnormal type. Only after the second sending period ends, the message push system will push the error push message of the abnormal type again; if the push frequency corresponding to the abnormal type is less than the preset push upper limit threshold, the error push message will be pushed to the message push target. Among them, the second sending period can be the period in which the message push system sets a prohibition on pushing according to the abnormal type of the error push message; the push frequency can be the number of pushes within a certain time range; the push upper limit threshold can be the threshold information pre-set by the message push system to determine whether an error push message of an abnormal type needs to be pushed.

[0077] The embodiment of the present invention can monitor abnormal logs through preset log matching rules, record the alarm event data of the abnormal log through log alarm events, and encapsulate the message, and send the encapsulated abnormal alarm message to the message push system. Through the push mechanism of the message push system, the effectiveness and timeliness of the alarm message push are guaranteed, the work efficiency of the development team is improved, the core problem is directly located, the speed of troubleshooting and solving problems is accelerated, and the stability and reliability of the system are improved.

[0078] Figure 3 This is a flowchart of another application container log abnormality warning method provided by an embodiment of the present invention. The relationship between this embodiment and the above embodiment is the specific process of log classification and updating of application container log information through a log management system. Figure 3 As shown, the method includes:

[0079] S310: Extract information from the application container log information to determine the exception type and the application container name.

[0080] The exception type may be classification information of the error exception in the application container log information.

[0081] Optionally, when an exception exists in the application container log information, the application container log information will be labeled with an exception tag. The application container log information is extracted through a preset regular expression to identify the log fields in the application container log information, obtain the log content in the application container log information, and filter out the exception log content with the exception tag, and extract the exception type and application container name corresponding to the exception tag. Among them, the application container name can be the name corresponding to the application container. Exemplarily, the log field can be a "message" field; the exception identifier can be an "ERROR" tag; the exception type can be "Exception", and the preset regular expression can be: (?:\bERROR\b.*?message\s*[:=]\s*)? (?:\bException\b.*).

[0082] S320: Classify and update the application container log information according to the exception type and the application container name to determine log classification information.

[0083] Specifically, the application container log information is classified and updated according to the exception type and the application container name to determine the log classification information.

[0084] Optionally, in another optional embodiment of the present invention, classifying and updating the application container log information according to the exception type and the application container name to determine the log classification information includes:

[0085] The exception type and the application container name are combined into a field to determine a log classification identifier; and the application container log information is classified and updated according to the log classification identifier to determine the log classification information.

[0086] The log classification identifier may be identification information for classifying the application container log information. Optionally, the log classification identifier is composed of the application container name and the exception type through a field combination.

[0087] Optionally, after obtaining the log classification identifier, the log management system adds the log classification identifier to the log content of the application container log information to complete the update of the application container log information; in the process of classifying the application container log information, the log classification information is obtained by classifying the log classification identifier in the application container log information.

[0088] Specifically, the exception type and the application container name are combined into fields to determine a log classification identifier, and the application container log information is classified and updated according to the log classification identifier to determine the log classification information.

[0089] S330: Perform anomaly detection on the log classification information according to the frequency and time search range of the scheduled monitoring corresponding to the preset log matching rule, and determine an abnormal alarm message.

[0090] S340: Send the abnormal warning message to a message push system, and push the abnormal warning message to a message push target through the message push system.

[0091] The technical solution of the embodiment of the present invention classifies and updates the obtained application container log information, determines the log classification information, and classifies the application container log information, which can improve the efficiency of log monitoring; performs anomaly detection on the log classification information according to the frequency and time search range of the scheduled monitoring corresponding to the preset log matching rule, determines the abnormal alarm message log matching rule, and can simultaneously perform anomaly monitoring based on the log classification information through multiple log matching rules, determine the abnormal alarm message that meets the log matching rule, and can identify abnormal log information, improve the accuracy of the alarm, and prevent the omission of abnormal log information; send the abnormal alarm message to the message push system, push the abnormal alarm message to the message push target through the message push system, and push the abnormal log information through the message push system, which can effectively solve the problem of pushing the log classification identifier and improve the timeliness of notifying the abnormal log. The technical problem of the inability to monitor and notify exceptions in the logs of application containers in the existing technology is that by classifying error logs according to exception types, the container log contents can be displayed clearly and orderly, which can improve the work efficiency of the development team, speed up the troubleshooting and problem solving, and improve the stability and reliability of the system; by reasonably setting alarm rules and processing alarm messages, it can ensure that the push of alarm messages avoids information overload and repeated alarms, thereby better helping developers to effectively handle exceptions.

[0092] Figure 4 A schematic diagram of a warning device for abnormal application container logs provided by an embodiment of the present invention. Figure 4 As shown, the device includes: a log classification module 410, an anomaly detection module 420 and a message push module 430; wherein,

[0093] The log classification module 410 is used to classify and update the obtained application container log information and determine the log classification information;

[0094] Anomaly detection module 420, used to perform anomaly detection on the log classification information according to the frequency and time search range of the scheduled monitoring corresponding to the preset log matching rule, and determine the abnormal alarm message;

[0095] The message push module 430 is used to send the abnormal warning message to the message push system, and push the abnormal warning message to the message push target through the message push system.

[0096] The technical solution of the embodiment of the present invention classifies and updates the obtained application container log information, determines the log classification information, and classifies the application container log information, which can improve the efficiency of log monitoring; performs anomaly detection on the log classification information according to the frequency and time search range of the scheduled monitoring corresponding to the preset log matching rule, determines the abnormal alarm message log matching rule, and can simultaneously perform anomaly monitoring based on the log classification information through multiple log matching rules, determine the abnormal alarm message that meets the log matching rule, and can identify abnormal log information, improve the accuracy of the alarm, and prevent the omission of abnormal log information; send the abnormal alarm message to the message push system, push the abnormal alarm message to the message push target through the message push system, and push the abnormal log information through the message push system, which can effectively solve the problem of pushing the log classification identifier and improve the timeliness of notifying the abnormal log. The technical problem of the inability to monitor and notify exceptions in the logs of application containers in the existing technology is that by classifying error logs according to exception types, the container log contents can be displayed clearly and orderly, which can improve the work efficiency of the development team, speed up the troubleshooting and problem solving, and improve the stability and reliability of the system; by reasonably setting alarm rules and processing alarm messages, it can ensure that the push of alarm messages avoids information overload and repeated alarms, thereby better helping developers to effectively handle exceptions.

[0097] Optionally, the anomaly detection module is specifically used to:

[0098] Matching the log classification information according to the frequency and time search range of the scheduled monitoring corresponding to the preset log matching rule;

[0099] In the case that any one of the preset log matching rules successfully matches the log classification information, a log alarm event is triggered, and the abnormal alarm message is determined according to the log classification information and the preset log matching rule.

[0100] Optionally, the anomaly detection module is further used to:

[0101] Recording the alarm event data corresponding to the log alarm event according to the log classification information and the preset log matching rule;

[0102] The alarm event data is encapsulated into a message to determine the abnormal alarm message.

[0103] Optionally, the anomaly detection module is further used to:

[0104] Generate an abnormal alarm notification based on the abnormal alarm message; wherein the abnormal alarm notification includes at least one abnormal alarm message;

[0105] The abnormal alarm notification is sent to the message push system through a preset notification sending frequency and a first sending cycle.

[0106] Optionally, the message push module is specifically used for:

[0107] Extracting log content of the abnormal warning message through the message push system to determine the log content of the abnormal warning message;

[0108] When the amount of information in the log content of the abnormal alarm message is greater than a preset content threshold, the message push system performs information segmentation on the log content of the abnormal alarm message to determine an error push message;

[0109] When the push frequency corresponding to the abnormal type of the error push message is less than a preset push upper limit threshold, the error push message is pushed to the message push target by the message push system.

[0110] Optionally, the log classification module is specifically used for:

[0111] Extracting information from the application container log information to determine the exception type and the application container name;

[0112] The application container log information is classified and updated according to the exception type and the application container name to determine log classification information.

[0113] Optionally, the log classification module is further used to:

[0114] Combining the exception type and the application container name into fields to determine a log classification identifier;

[0115] The application container log information is classified and updated according to the log classification identifier to determine the log classification information.

[0116] The application container log abnormality warning device provided in the embodiment of the present invention can execute the application container log abnormality warning method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0117] Figure 5A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their modes are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0118] like Figure 5 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0119] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer grid such as the Internet and / or various telecommunication grids.

[0120] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 executes the various methods and processes described above, such as a warning method for abnormal application container logs.

[0121] In some embodiments, the warning method for application container log anomalies may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the warning method for application container log anomalies described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the warning method for application container log anomalies in any other appropriate manner (e.g., by means of firmware).

[0122] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0123] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the modes / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0124] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0125] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0126] The systems and techniques described herein can be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a grid browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system can be interconnected by any form or medium of digital data communication (e.g., a communication grid). Examples of communication grids include: a local area network (LAN), a wide area network (WAN), a blockchain grid, and the Internet.

[0127] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication grid. The client and server relationship is generated by computer programs running on the respective computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0128] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0129] This embodiment provides a computer-readable storage medium, on which a computer program is stored. When the program is executed by a processor, the steps of the warning method for abnormal application container log provided in any embodiment of the present invention are implemented. The method includes:

[0130] Classify and update the obtained application container log information to determine the log classification information;

[0131] Perform anomaly detection on the log classification information according to the frequency and time search range of the scheduled monitoring corresponding to the preset log matching rule, and determine the abnormal alarm message;

[0132] The abnormal warning message is sent to a message push system, and the abnormal warning message is pushed to a message push target through the message push system.

[0133] The computer storage medium of the embodiment of the present invention can adopt any combination of one or more computer-readable media. The computer-readable medium can be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium can be, for example, but not limited to: an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples (non-exhaustive list) of computer-readable storage media include: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this document, a computer-readable storage medium can be any tangible medium containing or storing a program, which can be used by an instruction execution system, device or device or used in combination with it.

[0134] Computer-readable signal media may include data signals propagated in baseband or as part of a carrier wave, which carry computer-readable program code. Such propagated data signals may take a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. Computer-readable signal media may also be any computer-readable medium other than a computer-readable storage medium, which may send, propagate, or transmit a program for use by or in conjunction with an instruction execution system, apparatus, or device.

[0135] The program code embodied on the computer readable medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

[0136] Computer program code for performing the operation of the present invention may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of grid, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0137] It should be understood by those skilled in the art that the above modules or steps of the present invention can be implemented by a general-purpose computing device, they can be concentrated on a single computing device, or distributed on a grid composed of multiple computing devices, optionally, they can be implemented by a program code executable by a computer device, so that they can be stored in a storage device and executed by the computing device, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present invention is not limited to any specific combination of hardware and software.

[0138] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0139] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A warning method for abnormal application container logs, characterized in that: include: Classify and update the obtained application container log information to determine the log classification information; Perform anomaly detection on the log classification information according to the frequency and time search range of the scheduled monitoring corresponding to the preset log matching rule, and determine the abnormal alarm message; The abnormal warning message is sent to a message push system, and the abnormal warning message is pushed to a message push target through the message push system.

2. The method according to claim 1, characterized in that The number of the preset log matching rules is at least one, and the abnormality detection of the log classification information according to the frequency and time search range of the scheduled monitoring corresponding to the preset log matching rules is performed to determine the abnormal alarm message, including: Matching the log classification information according to the frequency and time search range of the scheduled monitoring corresponding to the preset log matching rule; In the case that any one of the preset log matching rules successfully matches the log classification information, a log alarm event is triggered, and the abnormal alarm message is determined according to the log classification information and the preset log matching rule.

3. The method according to claim 2, characterized in that The determining the abnormal alarm message according to the log classification information and the preset log matching rule includes: Recording the alarm event data corresponding to the log alarm event according to the log classification information and the preset log matching rule; The alarm event data is encapsulated into a message to determine the abnormal alarm message.

4. The method according to claim 3, characterized in that The sending of the abnormal warning message to the message push system includes: Generate an abnormal alarm notification based on the abnormal alarm message; wherein the abnormal alarm notification includes at least one abnormal alarm message; The abnormal alarm notification is sent to the message push system through a preset notification sending frequency and a first sending cycle.

5. The method according to claim 1, characterized in that The method of pushing the abnormal warning message to the message push target through the message push system includes: Extracting log content of the abnormal warning message through the message push system to determine the log content of the abnormal warning message; When the amount of information in the log content of the abnormal alarm message is greater than a preset content threshold, the log content of the abnormal alarm message is cut by the message push system to determine an error push message; When the push frequency corresponding to the abnormal type of the error push message is less than a preset push upper limit threshold, the error push message is pushed to the message push target through the message push system.

6. The method according to claim 1, characterized in that The step of classifying and updating the obtained application container log information to determine the log classification information includes: Extracting information from the application container log information to determine the exception type and the application container name; The application container log information is classified and updated according to the exception type and the application container name to determine log classification information.

7. The method according to claim 6, characterized in that The classifying and updating the application container log information according to the exception type and the application container name to determine the log classification information includes: Combining the exception type and the application container name into fields to determine a log classification identifier; The application container log information is classified and updated according to the log classification identifier to determine the log classification information.

8. A warning device for abnormal application container logs, characterized in that: include: A log classification module, used to classify and update the obtained application container log information and determine the log classification information; An anomaly detection module, used to perform anomaly detection on the log classification information according to the frequency and time search range of the scheduled monitoring corresponding to the preset log matching rule, and determine the abnormal alarm message; The message push module is used to send the abnormal warning message to the message push system, and push the abnormal warning message to the message push target through the message push system.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the method for warning of application container log anomalies according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the method for warning of application container log abnormality according to any one of claims 1 to 7 when executed.

Images