Operation log analysis method and device and electronic equipment

Abstract

The invention discloses an operation log analysis method and device and electronic equipment. The method comprises the following steps: acquiring a target log sequence set from a historical operation log; a common subsequence of the target log sequence set is determined, an atomic operation log framework is determined according to the common subsequence, the common subsequence is used for representing common log features in the target log sequence set, and the atomic operation log framework is used for representing a standardized structure of each log sequence in the target log sequence set; a log sequence structure chart is determined according to the atomic operation log framework, a log analysis result of the target log sequence set is determined according to the log sequence structure chart, and the log sequence structure chart is a directed graph formed by combining the atomic operation log framework according to the actual operation process. According to the method and the device, the technical problem of relatively low log analysis efficiency due to the fact that operation log rechecking generally depends on manual checking in related technologies is solved.

Description

Technical Field

[0001] The present application relates to the field of IT operation and maintenance, and specifically, to an analysis method, device and electronic device for operation logs. Background Art

[0002] With the advent of the era of cloud computing and big data, IT operation and maintenance has become an important part of enterprise operations. Operation and maintenance operation review is the "last mile" of operation and maintenance management. It is mainly responsible for reviewing, monitoring and auditing the operation behavior of operation and maintenance personnel, and identifying the legality, compliance and rationality of the operation behavior.

[0003] In the related technologies, the IT system operation review based on operation logs is rarely used and usually relies on manual inspection. The main reason is that the operation logs are generated by IT systems, which are completely different from different manufacturers and different devices. It is difficult to check them with a universal method. With the widespread use of open source projects, this problem is more obvious. Secondly, as a semi-structured data, the operation log lacks grammatical norms compared to traditional natural languages, and is relatively arbitrary and cannot be parsed by machines compared to program codes. In the case of small workload, manual work is a cost-effective method. However, manual operation review has the disadvantages of subjective judgment, inconsistent compliance judgment standards, and low efficiency of operation log analysis, which seriously restricts the compliance, security, and efficiency and quality of auditing of operation and maintenance activities.

[0004] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0005] The embodiments of the present application provide an operation log analysis method, device, and electronic device to at least solve the technical problem that the operation log review in the related art usually relies on manual inspection, resulting in low log analysis efficiency.

[0006] According to one aspect of an embodiment of the present application, a method for analyzing an operation log is provided, comprising: obtaining a target log sequence set from historical operation logs, wherein the target log sequence set is used to represent a log sequence set obtained by classifying historical operation logs within a preset time range; determining a common subsequence of the target log sequence set, and determining an atomic operation log framework based on the common subsequence, wherein the common subsequence is used to represent common log features in the target log sequence set, and the atomic operation log framework is used to represent a standardized structure of each log sequence in the target log sequence set; determining a log sequence structure graph based on the atomic operation log framework, and determining a log analysis result of the target log sequence set based on the log sequence structure graph, wherein the log sequence structure graph is a directed graph of the atomic operation log framework combined according to an actual operation process, and the log analysis result is used to represent a matching situation between the operation logs in the target log sequence set and the actual operation diaries.

[0007] Optionally, obtaining a target log sequence set from historical operation logs includes: determining a target operation device and an operation start and end time of the target operation device, wherein the target operation device is any operation device that executes the historical operation log; determining a first operation log from the historical operation log based on the target operation device and the operation start and end time; classifying the first operation log based on a preset log operation type to obtain a first log sequence; and determining a target log sequence set based on the first log sequence.

[0008] Optionally, after obtaining the target log sequence set from the historical operation log, the method also includes: determining a log template library corresponding to the historical operation log; determining a log template sequence corresponding to each log sequence in the target log sequence set based on the log template library, wherein the log template sequence is used to represent a log sequence after the log structure of each log sequence in the target log sequence set is templated; and determining a template sequence set corresponding to the target log sequence set based on the log template sequence.

[0009] Optionally, after determining the common subsequence of the target log sequence set, the method further includes: determining the first occurrence frequency of each log sequence in the target log sequence set; deleting the log sequence whose first occurrence frequency is 1 in the target log sequence set, and arranging the remaining log sequences in the target log sequence set to obtain a second log sequence; using a dynamic programming algorithm to determine the longest common subsequence of the second log sequence; determining the second occurrence frequency of the longest common subsequence, and sorting the longest common subsequences according to the second occurrence frequency to obtain a longest common subsequence set.

[0010] Optionally, the log sequence structure diagram includes a serial atomic operation path and a parallel atomic operation path. The serial atomic operation path is used to indicate that there is a sequence of atomic operations in the target log sequence set, and the parallel atomic operation path is used to indicate that there is no sequence of atomic operations in the target log sequence set. The atomic operation represents a basic unit operation in the operation log that cannot be further divided.

[0011] Optionally, determining the log analysis results of the target log sequence set based on the log sequence structure diagram includes: determining a first execution sequence of atomic operations in the actual operation log; determining a second execution sequence of atomic operations in the target log sequence set based on the log sequence structure diagram; and comparing the first execution sequence and the second execution sequence to obtain the log analysis results.

[0012] Optionally, the log analysis results include at least one of the following: the degree of matching between the operation logs in the log sequence set and the actual operation diaries, and abnormal operation logs in the log sequence set, wherein the abnormal operation logs are operation logs in the log sequence set that do not match the execution order of the actual operation diaries.

[0013] According to another aspect of an embodiment of the present application, there is also provided an operation log analysis device, including: an acquisition module, used to acquire a target log sequence set from historical operation logs, wherein the target log sequence set is used to represent a log sequence set obtained after classifying historical operation logs within a preset time range; a first determination module, used to determine a common subsequence of the target log sequence set, and determine an atomic operation log framework based on the common subsequence, wherein the common subsequence is used to represent common log features in the target log sequence set, and the atomic operation log framework is used to represent a standardized structure of each log sequence in the target log sequence set; a second determination module, used to determine a log sequence structure diagram based on the atomic operation log framework, and determine a log analysis result of the target log sequence set based on the log sequence structure diagram, wherein the log sequence structure diagram is a directed graph of the atomic operation log framework combined according to the actual operation process, and the log analysis result is used to represent the matching situation between the operation logs in the target log sequence set and the actual operation diaries.

[0014] According to another aspect of the embodiments of the present application, there is also provided an electronic device, including: a memory and a processor, wherein the memory is used to store program instructions; the processor is connected to the memory and is used to execute the analysis method for implementing the above-mentioned operation log.

[0015] According to another aspect of the embodiments of the present application, a non-volatile storage medium is provided, the non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned operation log analysis method by running the computer program.

[0016] According to another aspect of the embodiments of the present application, a computer program product is provided, including computer instructions, which implement the above-mentioned operation log analysis method when executed by a processor.

[0017] In an embodiment of the present application, a target log sequence set is obtained from historical operation logs, wherein the target log sequence set is used to represent a log sequence set obtained after classifying historical operation logs within a preset time range; a common subsequence of the target log sequence set is determined, and an atomic operation log framework is determined based on the common subsequence, wherein the common subsequence is used to represent common log features in the target log sequence set, and the atomic operation log framework is used to represent the standardized structure of each log sequence in the target log sequence set; a log sequence structure graph is determined based on the atomic operation log framework, and a log analysis result of the target log sequence set is determined based on the log sequence structure graph, wherein the log sequence structure graph is a directed graph composed of the atomic operation log framework according to the actual operation process, and the log analysis result is used to represent the matching of the operation log in the target log sequence set with the actual operation log, thereby achieving the purpose of automating and standardizing the operation log analysis, thereby achieving the technical effect of improving the analysis efficiency and accuracy of the operation log, and further solving the technical problem that the operation log review in the related technology usually relies on manual inspection and has low log analysis efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0018] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0019] Figure 1 is a hardware structure diagram of a computer terminal for implementing an analysis method for operation logs according to an embodiment of the present application;

[0020] Figure 2 is a flow chart of a method for analyzing an operation log according to an embodiment of the present application;

[0021] Figure 3 It is a schematic diagram of an extraction process of an atomic operation log framework according to an embodiment of the present application;

[0022] Figure 4 is a log sequence structure diagram according to an embodiment of the present application;

[0023] Figure 5 It is a structural diagram of an operation log analysis device according to an embodiment of the present application. DETAILED DESCRIPTION

[0024] In order to enable those skilled in the art to better understand the solution of the present application, the technical solution in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present application.

[0025] It should be noted that the terms "first", "second", etc. in the specification and claims of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchangeable where appropriate, so that the embodiments of the present application described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0026] First, some nouns or terms that appear in the process of explaining the embodiments of the present application are subject to the following explanations:

[0027] Log template mining: Log template mining is the process of parsing logs from semi-structured data to structured data. Logs are composed of templates and variables. Templates are fixed parts of an event in multiple log messages, such as the description of the event; variables are parts that change over time, such as host name, IP, and time.

[0028] Subsequence: Given a sequence X =<x1,x2,x3,…,xm> , another sequence Z =<z1,z2,z3,…,zk> , if there exists a strictly increasing sequence of subscripts of X<i1,i2,…,ik> , so that for all j = 1, 2, …, k, xij = zj (where xij represents the element with subscript ij in the sequence X), then Z is called a subsequence of X.

[0029] Common subsequence: If sequence C is both a subsequence of sequence A and a subsequence of sequence B (or more sequences), then C is called a common subsequence of sequence A and sequence B (etc.).

[0030] Longest Common Subsequence (LCS): Among all common subsequences, the one with the longest length is called the longest common subsequence.

[0031] Atomic operation: In this article, it refers to a basic, indivisible operation, such as a virtual machine migration, a host shutdown, etc.

[0032] In order to solve the problem of poor log analysis efficiency in the related art, the present application embodiment provides an operation log analysis method, which can be run on Figure 1 In the computer terminal shown, the computer terminal is described below.

[0033] The operation log analysis method embodiment provided in the embodiment of the present application can be executed in a mobile terminal, a computer terminal or a similar computing device. Figure 1 FIG. 1 shows a hardware structure block diagram of a computer terminal for implementing an operation log analysis method. Figure 1 As shown, the computer terminal 10 may include one or more (102a, 102b, ..., 102n are used to illustrate) processors (the processor may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 104 for storing data, and a transmission module 106 for communication functions connected via a wired and / or wireless network. In addition, it may also include: a display, a keyboard, a cursor control device, an input / output interface (I / O interface), a universal serial bus (USB) port (which may be included as one of the ports of the I / O interface), a network interface, and a BUS bus. Those skilled in the art can understand that Figure 1 The structure shown is only for illustration and does not limit the structure of the above electronic device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations are shown.

[0034] It should be noted that the one or more processors and / or other data processing circuits described above may generally be referred to herein as "data processing circuits". The data processing circuits may be embodied in whole or in part as software, hardware, firmware, or any other combination thereof. In addition, the data processing circuit may be a single independent processing module, or may be incorporated in whole or in part into any of the other components in the computer terminal 10. As described in the embodiments of the present application, the data processing circuit acts as a processor control (e.g., selection of a variable resistor terminal path connected to an interface).

[0035] The memory 104 can be used to store software programs and modules of application software, such as the program instructions / data storage device corresponding to the analysis method of the operation log in the embodiment of the present application. The processor executes various functional applications and data processing by running the software programs and modules stored in the memory 104, that is, realizing the above-mentioned analysis method of the operation log. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely arranged relative to the processor, and these remote memories may be connected to the computer terminal 10 via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0036] The transmission module 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the computer terminal 10. In one example, the transmission module 106 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission module 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0037] The display may be, for example, a touch screen liquid crystal display (LCD) that enables a user to interact with a user interface of the computer terminal 10 .

[0038] It should be noted that, in some optional embodiments, the above Figure 1 The computer terminal shown may include hardware elements (including circuits), software elements (including computer code stored on a computer-readable medium), or a combination of hardware elements and software elements. It should be noted that Figure 1 This is merely one example of a particular embodiment and is intended to illustrate the types of components that may be present in the computer terminal described above.

[0039] In the above-mentioned operating environment, an embodiment of the present application provides an embodiment of an operation log analysis method. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although the logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0040] Figure 2 is a flow chart of a method for analyzing an operation log according to an embodiment of the present application, such as Figure 2As shown, the method comprises the following steps:

[0041] Step S202: acquiring a target log sequence set from the historical operation logs, wherein the target log sequence set is used to represent a log sequence set obtained by classifying the historical operation logs within a preset time range.

[0042] In the above step S202, a log sequence set with analysis value (i.e., the above target log sequence set) can be systematically extracted from the full historical operation log set to provide basic log data for subsequent log analysis, wherein the target log sequence set includes all relevant log records for a specific operating device within a specific time range.

[0043] Step S204, determine the common subsequence of the target log sequence set, and determine the atomic operation log framework based on the common subsequence, wherein the common subsequence is used to represent the common log features in the target log sequence set, and the atomic operation log framework is used to represent the standardized structure of each log sequence in the target log sequence set.

[0044] In the above step S204, the common subsequence of the target log sequence set can be analyzed and determined by, for example, a dynamic programming analysis algorithm, and the common subsequence reflects the common pattern or feature in the log record. Subsequently, the longest common subsequence is selected from the common subsequences, and an atomic operation log framework is constructed through the longest common subsequence, wherein the atomic operation log framework defines a standardized structure of the log record, and provides a structured template for log analysis, which is used for subsequent log analysis and matching.

[0045] Step S206, determine the log sequence structure diagram based on the atomic operation log framework, and determine the log analysis results of the target log sequence set based on the log sequence structure diagram, wherein the log sequence structure diagram is a directed graph composed of the atomic operation log framework based on the actual operation process, and the log analysis results are used to represent the matching status of the operation logs in the target log sequence set and the actual operation logs.

[0046] In the above step S206, according to the atomic operation log framework and the actual operation process, a log sequence structure diagram can be constructed to reflect the above target log sequence set, wherein the node of the log sequence structure diagram represents an atomic operation, and the edge represents the execution order between the atomic operations. By using the log sequence structure diagram, the expected execution sequence of the atomic operation is generated through a breadth-first search algorithm or other algorithms, and matched with the execution sequence of the atomic operation in the actual operation log, the log analysis result of the above target log sequence set can be obtained, wherein the log analysis result shows the matching of the atomic operations in the target log sequence set with the atomic operations in the actual operation log.

[0047] Through the above steps S202 to S206, the purpose of automating and standardizing the operation log analysis is achieved, thereby achieving the technical effect of improving the analysis efficiency and accuracy of the operation log, thereby solving the technical problem that the operation log review in the related art usually relies on manual inspection and has low log analysis efficiency. The following is a detailed description.

[0048] In the above step S202, a target log sequence set is obtained from the historical operation log, including: determining the target operation device and the operation start and end time of the target operation device, wherein the target operation device is any operation device that executes the historical operation log; determining the first operation log from the historical operation log according to the target operation device and the operation start and end time; classifying the first operation log according to a preset log operation type to obtain a first log sequence; and determining the target log sequence set according to the first log sequence.

[0049] In the embodiment of the present application, the purpose of obtaining the target log sequence set is to provide a structured log data set for subsequent log analysis and template extraction, so that the system can more effectively identify and understand the log patterns of different operation types. This is crucial for subsequent log template extraction and common subsequence analysis, because they rely on these structured data to identify and extract the common features of the operation. The specific process can be as follows:

[0050] First, the system needs to identify the specific operating device (such as a physical server, virtual machine, network device, etc.) and the start and end time of the operation associated with it, which is usually based on user input or some form of logging. For example, if the focus is on operations between 14:00-15:00, the preset time range will be set to that time period.

[0051] After determining the operation device (i.e. the first operation device mentioned above, taking the host machine as an example) and the time range, the system will intercept the operation log between the start and end time of the operation 14:00-15:00 from the full historical log set U, i.e. the first operation log mentioned above. The first operation log contains all operation records related to the device within the specified time.

[0052] Then, according to the operation content recorded in the log, the intercepted log is classified according to the preset basic operation type (ie, the preset log operation type mentioned above). The preset log operation type may be predefined, such as "virtual machine migration", "host shutdown", etc.

[0053] If an operation includes multiple basic operations, the logs of this operation will be classified into all related basic operation categories. For example, if an operation includes "VM migration", "host shutdown" and "host startup", the logs of this operation will be classified into these three categories.

[0054] Finally, the system will form a log sequence set for each preset log operation type, that is, the first log sequence mentioned above, which contains the log sequences of all operations of this type. Classify multiple preset log operation types and finally obtain the target log sequence set A of each basic operation. log ={a i |a i is the log sequence of the ith sample of the basic operation of type A during the operation}, B log , C log , and so on.

[0055] Optionally, after obtaining the target log sequence set from the historical operation log, the method also includes: determining a log template library corresponding to the historical operation log; determining a log template sequence corresponding to each log sequence in the target log sequence set based on the log template library, wherein the log template sequence is used to represent a log sequence after the log structure of each log sequence in the target log sequence set is templated; and determining a template sequence set corresponding to the target log sequence set based on the log template sequence.

[0056] In an embodiment of the present application, the above target log sequence set can be converted into a templated set that is easier to analyze and process, thereby providing support for subsequent log analysis, monitoring and automated processing. The specific process can be as follows:

[0057] First, a specialized log template mining tool is used to analyze the full historical log set U. These log template mining tools usually use machine learning or regular expression matching technology to identify common patterns in logs. Popular algorithms such as drain, spell, and log cluster can be used. Subsequently, a series of common log templates are extracted from the log set through the template mining tool. These templates represent common structures and patterns in logs. These templates are stored in the log template library Utemplate.

[0058] Through the template in Utemplate, each sample set (such as A log , B log , C log Each log sequence in the original log is templated, such as replacing specific values ​​in the original log with general placeholders (such as <*>) to indicate that these positions can be any values.

[0059] After template processing, each original log sequence is converted into one or more templated sequences, namely the above-mentioned log template sequence, which is organized into a new template sequence set A template ={a i ′|a i ′ is a i Sequence after template extraction}, B template , C template , and so on.

[0060] An example of extracting a log template is as follows: the original log sequence is "[instance:7a3b-40ab]Took6.11seconds for pre_live_migration on destination host JS-NJ-CLT01", and the result after template extraction is "[instance:<*>]Took<*>seconds for pre_live_migration on destinationhost<*>", where 7a3b-40ab is the ID of the virtual machine, 6.11 is the time, and JS-NJ-CLT01 is the host name. These variables can have different values ​​in logs of different operations.

[0061] In the above process, by converting the original log sequence into a templated form, the structure of different log data can be standardized, making it easier to process and analyze. At the same time, templated log data reduces the complexity of the analysis process, because analysts only need to focus on the variable part in the template, rather than the specific content of each log, which helps to identify and understand common and abnormal patterns in the log, which is crucial for fault diagnosis and performance optimization.

[0062] In the above step S204, after determining the common subsequence of the target log sequence set, the method further includes: determining the first occurrence frequency of each log sequence in the target log sequence set; deleting the log sequence whose first occurrence frequency is 1 in the target log sequence set, and arranging the remaining log sequences in the target log sequence set to obtain a second log sequence; determining the longest common subsequence of the second log sequence by using a dynamic programming algorithm; determining the second occurrence frequency of the longest common subsequence, and sorting the longest common subsequences according to the second occurrence frequency to obtain a longest common subsequence set.

[0063] In the embodiments of the present application, the analysis of the longest common subsequence generally includes the following steps:

[0064] 1. Frequency statistics and item deletion:

[0065] Each sequence in the target log sequence set is analyzed, and the frequency of occurrence of each item (such as a specific log entry or event) in all sequences is counted, that is, the first occurrence frequency mentioned above. Subsequently, the items that appear only once in the first occurrence frequency are deleted because they are not representative, thereby reducing the amount of data to be processed in subsequent steps and focusing on those items that are prevalent in multiple sequences. Further, the remaining log sequences in the target log sequence set are rearranged to form a second log sequence.

[0066] 2. Dynamic programming to find the longest common subsequence (LCS):

[0067] For the second log sequence after the above processing, a dynamic programming algorithm is used to find the longest common subsequence between two sequences. The dynamic programming algorithm constructs a table to record and compare the matching conditions between the log sequences, thereby finding the longest common subsequence between the two sequences.

[0068] 3. Frequency statistics and candidate set ranking:

[0069] After obtaining the longest common subsequence of all sequences, the frequency of these subsequences is counted, that is, the number of times each longest common subsequence appears in all sequences is counted to obtain the second occurrence frequency. The longest common subsequences are sorted according to the second occurrence frequency, and sorted from high to low according to the second occurrence frequency as a candidate set to obtain the longest common subsequence set, which represents the most significant common features in multiple sequences.

[0070] In the embodiment of the present application, the overall extraction process of the atomic operation log framework is as follows: Figure 3 As shown, after obtaining the longest common subsequence candidate set, the domain experts will evaluate and select the most appropriate longest common subsequence and convert it into an atomic operation log framework (LFA). Specifically: the domain experts select the most appropriate longest common subsequence based on business needs and experience; convert the selected longest common subsequence into an atomic operation log framework, using regular expression-like syntax (such as *, +, {m, n}, etc.) to indicate the number of occurrences and order of items, where * indicates matching the expression 0 or more times, + indicates matching the expression 1 or more times, and {m, n} indicates matching the expression mn times; finally, an atomic operation log framework is formed for log sequence verification and operation review.

[0071] For example: The original LCS selected by the expert is<S1,S2,S3,S4> , optimized<S1,S2*,S3{1-3},S4> As an atomic operation framework LF.

[0072] Optionally, the log sequence structure diagram includes a serial atomic operation path and a parallel atomic operation path. The serial atomic operation path is used to indicate that there is a sequence of atomic operations in the target log sequence set, and the parallel atomic operation path is used to indicate that there is no sequence of atomic operations in the target log sequence set. The atomic operation represents a basic unit operation in the operation log that cannot be further divided.

[0073] In the embodiment of the present application, the log sequence structure diagram G(V, E) is a directed graph representing the atomic operation log framework according to the actual operation process combination, such as Figure 3 As shown in the figure, V is a node of the log sequence structure graph, including a "start" node, an "end" node and multiple atomic operations LF1-LF4; E is an edge of the log sequence structure graph, and the direction of the arrow represents the execution order of the atomic operations.

[0074] like Figure 4 As shown in the figure, there is a serial atomic operation path and a parallel atomic operation path in the log sequence structure diagram. These two atomic operation paths are two basic relationships that describe the execution order between atomic operation log frames. There are 4 atomic operations LF1-LF4 in the process. LF1 and LF2 are performed in parallel. After the two atomic operations are completed, LF3 is performed. LF4 is performed independently of other atomic operations.

[0075] It should be noted that the serial atomic operation path indicates that there is a sequence between two atomic operations, that is, the second atomic operation can only be executed after the first atomic operation is completely completed. The serial atomic operation path is used to ensure the order of operations, which is very important in scenarios that have strict requirements on the execution order, such as database transaction processing, file system operations, etc. The parallel atomic operation path indicates that two atomic operations can be performed at the same time, there is no strict sequence between them, and they can be executed overlappingly. The parallel atomic operation path is used to improve efficiency and performance, and to reduce the total execution time by executing multiple operations simultaneously, so as to optimize resource utilization and time management, so that the system can process multiple operations more efficiently, especially in multi-core processors and distributed systems.

[0076] In the above step S206, the log analysis result of the target log sequence set is determined according to the log sequence structure diagram, including: determining a first execution sequence of atomic operations in the actual operation log; determining a second execution sequence of atomic operations in the target log sequence set according to the log sequence structure diagram; and comparing the first execution sequence and the second execution sequence to obtain the log analysis result.

[0077] Optionally, the log analysis results include at least one of the following: the degree of matching between the operation logs in the log sequence set and the actual operation diaries, and abnormal operation logs in the log sequence set, wherein the abnormal operation logs are operation logs in the log sequence set that do not match the execution order of the actual operation diaries.

[0078] In an embodiment of the present application, the log sequence structure graph G(V, E) can be traversed by using a breadth-first search (BFS) algorithm, and a corresponding verification (execution) sequence can be generated. Among them, BFS is a graph traversal algorithm, which starts from a node and traverses all nodes in the graph layer by layer. In the log sequence verification, BFS starts from the "start" node and accesses all atomic operation log frames layer by layer until it reaches the "end" node. During the traversal process, the accessed nodes are recorded in the order of access to form a second verification (execution) sequence. It should be noted that according to the serial and parallel relationships in the log sequence structure graph, multiple verification sequences may be generated, and each sequence represents a possible operation process.

[0079] Furthermore, the above method is used to determine in advance the first verification (execution) sequence of the atomic operations in the actual operation log, and the currently generated second verification sequence is matched with the first verification sequence of the actual operation log to check whether the atomic operations in the target log sequence set are consistent with the actual operations.

[0080] After completing the sequence matching, the log analysis results of the target log sequence set are output, which include the matching degree between the operation log in the target log sequence set and the actual operation log, as well as the abnormal operation log in the log sequence set. Among them, the matching degree refers to the matching status of all verification sequences, which is used to help operators understand whether the operation is performed according to the expected process, as well as the integrity and correctness of the operation. The abnormal operation log is a log entry that appears in the actual operation log and does not match the verification sequence. The abnormal operation log may indicate an error or anomaly in the operation, and further manual inspection and analysis are required to avoid missing unexpected errors and hidden dangers.

[0081] In an embodiment of the present application, the overall process may include two parts: log framework extraction and log sequence verification. The log framework extraction part includes operation log classification, log template extraction and common subsequence analysis: the operation log classification step intercepts the entire historical log according to the operation time window through the operation record, and classifies it according to the content of the operation; the log template extraction step extracts the template from the original operation log according to the historical log template library; the common subsequence analysis step calculates the common subsequence according to the same type of operation log, and finally obtains the atomic operation log framework after expert review and adjustment. The log sequence verification part includes two parts: framework selection and sequence matching. The log sequence structure expression step selects one or more atomic operation log frameworks according to the content of this operation and combines them to generate a verification sequence for comparison with the log of this operation, and finally obtains the matching results and other logs outside the framework for the operator to check.

[0082] In the above process, the atomic operation log framework can be flexibly combined to automatically check the operation log, which improves the efficiency of operation log analysis; compared with solutions that rely on specific system log syntax structures, it has stronger versatility and universality; compared with traditional common subsequence algorithms used in deep learning, it has stronger interpretability. In general, by using historical operation log information, it effectively assists the review of IT system operations, ensures the standardization and correctness of operations, and effectively improves the automation and intelligence level of IT operation and maintenance.

[0083] According to an embodiment of the present application, an operation log analysis device is provided. It should be noted that the operation log analysis device of the embodiment of the present application can be used to execute the operation log analysis method provided by the embodiment of the present application. The following introduces the operation log analysis device provided by the embodiment of the present application.

[0084] Figure 5 1 is a structural diagram of an operation log analysis device provided according to an embodiment of the present application. Figure 5 As shown, the device comprises:

[0085] An acquisition module 50 is used to acquire a target log sequence set from the historical operation logs, wherein the target log sequence set is used to represent a log sequence set obtained by classifying the historical operation logs within a preset time range;

[0086] A first determination module 52 is used to determine a common subsequence of the target log sequence set, and determine an atomic operation log framework based on the common subsequence, wherein the common subsequence is used to represent common log features in the target log sequence set, and the atomic operation log framework is used to represent a standardized structure of each log sequence in the target log sequence set;

[0087] The second determination module 54 is used to determine the log sequence structure diagram based on the atomic operation log framework, and determine the log analysis results of the target log sequence set based on the log sequence structure diagram, wherein the log sequence structure diagram is a directed graph composed of the atomic operation log framework based on the actual operation process, and the log analysis results are used to represent the matching status of the operation log in the target log sequence set and the actual operation log.

[0088] Through the acquisition module 50, the first determination module 52 and the second determination module 54 in the above-mentioned operation log analysis device, the purpose of automating and standardizing the operation log analysis is achieved, thereby realizing the technical effect of improving the analysis efficiency and accuracy of the operation log, and further solving the technical problem of low log analysis efficiency due to the fact that the operation log review in the related technology usually relies on manual inspection.

[0089] In the operation log analysis device provided in the embodiment of the present application, the acquisition module is also used to determine the target operation device and the operation start and end time of the target operation device, wherein the target operation device is any operation device that executes the historical operation log; determine the first operation log from the historical operation log based on the target operation device and the operation start and end time; classify the first operation log according to the preset log operation type to obtain a first log sequence; and determine the target log sequence set based on the first log sequence.

[0090] In the operation log analysis device provided in the embodiment of the present application, the acquisition module is also used to determine the log template library corresponding to the historical operation log; determine the log template sequence corresponding to each log sequence in the target log sequence set based on the log template library, wherein the log template sequence is used to represent the log sequence after the log structure of each log sequence in the target log sequence set is templated; determine the template sequence set corresponding to the target log sequence set based on the log template sequence.

[0091] In the operation log analysis device provided in the embodiment of the present application, the first determination module is also used to determine the first occurrence frequency of each log sequence in the target log sequence set; delete the log sequence whose first occurrence frequency is 1 in the target log sequence set, and arrange the remaining log sequences in the target log sequence set to obtain a second log sequence; use a dynamic programming algorithm to determine the longest common subsequence of the second log sequence; determine the second occurrence frequency of the longest common subsequence, and sort the longest common subsequences according to the second occurrence frequency to obtain a longest common subsequence set.

[0092] In the operation log analysis device provided in an embodiment of the present application, the second determination module is also used to determine the first execution sequence of atomic operations in the actual operation log; determine the second execution sequence of atomic operations in the target log sequence set based on the log sequence structure diagram; compare the first execution sequence and the second execution sequence to obtain the log analysis result.

[0093] An embodiment of the present application also provides an electronic device, including: a memory and a processor, wherein the memory is used to store program instructions; the processor is connected to the memory and is used to execute the analysis method for implementing the above-mentioned operation log.

[0094] It should be noted that the above electronic equipment is used to execute Figure 2 The analysis method of the operation log shown in the figure, therefore the relevant explanations in the above operation log analysis method are also applicable to the electronic device and will not be repeated here.

[0095] An embodiment of the present application further provides a non-volatile storage medium, which includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the above-mentioned operation log analysis method by running the computer program.

[0096] It should be noted that the above non-volatile storage medium is used to execute Figure 2 The analysis method of the operation log shown in the figure, therefore the relevant explanations in the above operation log analysis method are also applicable to the non-volatile storage medium, and will not be repeated here.

[0097] An embodiment of the present application also provides a computer program product, including computer instructions, which implement the above-mentioned operation log analysis method when executed by a processor.

[0098] It should be noted that the above-mentioned computer program product is used to execute Figure 2 The analysis method of the operation log shown in the figure, therefore the relevant explanations in the above operation log analysis method are also applicable to the computer program product, and will not be repeated here.

[0099] The serial numbers of the above-mentioned embodiments of the present application are for description only and do not represent the advantages or disadvantages of the embodiments.

[0100] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0101] In the several embodiments provided in this application, it should be understood that the disclosed technical content can be implemented in other ways. Among them, the device embodiments described above are only schematic. For example, the division of the units can be a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0102] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple units. Some or all of the units may be selected according to actual needs to achieve the purpose of the present embodiment.

[0103] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0104] If the integrated unit is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application is essentially or the part that contributes to the prior art or all or part of the technical solution can be embodied in the form of a software product, and the computer software product is stored in a storage medium, including a number of instructions to enable a computer device (which can be a personal computer, server or network device, etc.) to perform all or part of the steps of the method described in each embodiment of the present application. The aforementioned storage medium includes: U disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, RandomAccess Memory), mobile hard disk, disk or CD-ROM and other media that can store program codes.

[0105] The above is only a preferred implementation of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

Claims

1. A method for analyzing an operation log, characterized in that: include: Acquire a target log sequence set from the historical operation logs, wherein the target log sequence set is used to represent a log sequence set obtained by classifying the historical operation logs within a preset time range; Determine a common subsequence of the target log sequence set, and determine an atomic operation log framework based on the common subsequence, wherein the common subsequence is used to represent common log features in the target log sequence set, and the atomic operation log framework is used to represent a standardized structure of each log sequence in the target log sequence set; A log sequence structure diagram is determined based on the atomic operation log framework, and a log analysis result of the target log sequence set is determined based on the log sequence structure diagram, wherein the log sequence structure diagram is a directed graph of the atomic operation log framework combined according to the actual operation process, and the log analysis result is used to represent the matching status of the operation log in the target log sequence set and the actual operation log.

2. The method according to claim 1, characterized in that: Get the target log sequence set from the historical operation log, including: Determine a target operation device and the start and end time of the operation of the target operation device, wherein the target operation device is any operation device that executes the historical operation log; Determine a first operation log from the historical operation logs according to the target operation device and the start and end time of the operation; Classifying the first operation log according to a preset log operation type to obtain a first log sequence; The target log sequence set is determined according to the first log sequence.

3. The method according to claim 1, characterized in that After obtaining the target log sequence set from the historical operation log, the method further includes: Determine a log template library corresponding to the historical operation log; Determine a log template sequence corresponding to each log sequence in the target log sequence set according to the log template library, wherein the log template sequence is used to represent a log sequence after the log structure of each log sequence in the target log sequence set is templated; A template sequence set corresponding to the target log sequence set is determined according to the log template sequence.

4. The method according to claim 1, characterized in that: After determining the common subsequence of the target log sequence set, the method further includes: Determine the first occurrence frequency of each log sequence in the target log sequence set; Deleting the first log sequence with a frequency of 1 in the target log sequence set, and arranging the remaining log sequences in the target log sequence set to obtain a second log sequence; Determine the longest common subsequence of the second log sequence using a dynamic programming algorithm; A second occurrence frequency of the longest common subsequence is determined, and the longest common subsequences are sorted according to the second occurrence frequency to obtain a longest common subsequence set.

5. The method according to claim 1, characterized in that The log sequence structure diagram includes a serial atomic operation path and a parallel atomic operation path. The serial atomic operation path is used to indicate that there is a sequence of atomic operations in the target log sequence set, and the parallel atomic operation path is used to indicate that there is no sequence of atomic operations in the target log sequence set. The atomic operation represents a basic unit operation in the operation log that cannot be further divided.

6. The method according to claim 5, characterized in that Determining the log analysis result of the target log sequence set according to the log sequence structure diagram includes: Determine a first execution sequence of the atomic operations in the actual operation log; Determining a second execution sequence of atomic operations in the target log sequence set according to the log sequence structure diagram; The first execution sequence and the second execution sequence are compared to obtain the log analysis result.

7. The method according to claim 1, characterized in that The log analysis result includes at least one of the following: the degree of matching between the operation logs in the log sequence set and the actual operation diary, and the abnormal operation logs in the log sequence set, wherein the abnormal operation logs are operation logs in the log sequence set that do not match the execution order of the actual operation diary.

8. An operation log analysis device, characterized in that: include: An acquisition module, used to acquire a target log sequence set from historical operation logs, wherein the target log sequence set is used to represent a log sequence set obtained by classifying the historical operation logs within a preset time range; A first determination module is used to determine a common subsequence of the target log sequence set, and determine an atomic operation log framework based on the common subsequence, wherein the common subsequence is used to represent a common log feature in the target log sequence set, and the atomic operation log framework is used to represent a standardized structure of each log sequence in the target log sequence set; The second determination module is used to determine the log sequence structure diagram based on the atomic operation log framework, and determine the log analysis result of the target log sequence set based on the log sequence structure diagram, wherein the log sequence structure diagram is a directed graph of the atomic operation log framework combined according to the actual operation process, and the log analysis result is used to represent the matching status of the operation log in the target log sequence set and the actual operation log.

9. An electronic device, characterized in that: include: A memory and a processor, wherein the memory is used to store program instructions; The processor is connected to the memory and is used to execute the operation log analysis method described in any one of claims 1 to 7.

10. A non-volatile storage medium, characterized in that: The non-volatile storage medium includes a stored computer program, wherein the device where the non-volatile storage medium is located executes the operation log analysis method according to any one of claims 1 to 7 by running the computer program.

11. A computer program product comprising computer instructions, characterized in that: When the computer instructions are executed by a processor, the operation log analysis method described in any one of claims 1 to 7 is implemented.

Images