Log storage method, chip and server

Abstract

The embodiment of the invention provides a log storage method, a chip and a server, and the method comprises the steps: recording received log data based on a first log file; when the available storage capacity of the first log file is smaller than a threshold value, backing up the first log file and switching to record the received log data based on a second log file; and when the available storage capacity of the second log file is smaller than the threshold value, backing up the second log file, emptying the storage content of the first log file, and switching to record the received log data based on the first log file. Therefore, when the log is backed up in the log rolling process, the newly received log data is recorded by emptying the backed-up log file, and the problem that the log is lost in the log rolling process is solved.

Description

Technical Field

[0001] The present application relates to the field of server technology, and in particular to a log storage method, chip and server. Background Art

[0002] The System Event Log (SEL) is a log file used to record different types of system events on a server. It is stored in the server's Baseboard Management Controller (BMC). Due to the memory space limitations of the BMC, there is a maximum limit on the number of SEL logs that can be stored in the BMC. When the number of SEL logs stored reaches the maximum limit of the BMC, it is necessary to back up the SEL logs that have been recorded therein and clear the earliest created SEL logs to complete the log rolling to ensure that the BMC has a certain amount of memory space to record the SEL logs.

[0003] During the SEL log rolling process, the recorded SEL log needs to be backed up. When the server generates a new SEL log, the BMC is backing up the SEL log and there is no available memory space. Therefore, the newly generated SEL log may not be written into the BMC in time, resulting in log loss. Summary of the invention

[0004] In view of this, the embodiments of the present application provide a log storage method, a chip and a server, which aim to solve the problem of log loss in the existing log rolling solution.

[0005] In a first aspect, an embodiment of the present application provides a log storage method, the method comprising:

[0006] recording the received log data based on the first log file;

[0007] When the available storage capacity of the first log file is less than a threshold, backing up the first log file and switching to recording the received log data based on the second log file;

[0008] When the available storage capacity of the second log file is less than the threshold, the second log file is backed up, the storage content of the first log file is cleared, and the received log data is recorded based on the first log file.

[0009] The embodiment of the present application provides a log storage method, a chip and a server. In the log storage method provided by the embodiment of the present application, firstly, the log data received in real time is recorded based on the first log file. When the available storage capacity of the first log storage file is less than the threshold value, the first log file is backed up immediately, and the second log file is switched to log recording. The log backup process for the first log file will not affect the reception and recording of new log data. Moreover, when the available storage capacity of the second log file is less than the threshold value, the log data stored in the first log file is cleared, and the first log file is switched again to log recording. Since the first log file has started to be backed up when switching to the second log file for log recording, when the available storage capacity of the second log file is less than the threshold value, the log data in the first log file has been backed up, so the storage content in the first log file can be directly cleared, and the log data can be recorded again based on the first log file. Thus, when the log is backed up during the log rolling process, the log file that has been backed up is cleared to record the newly received log data, which solves the problem of log loss during the log rolling process.

[0010] In a possible implementation, recording the received log data based on the first log file includes:

[0011] Based on a preset log generation specification, the received log data is structured and parsed to obtain parsed log data; the received log data is log data generated by the server according to the preset log generation specification;

[0012] The parsed log data is recorded in the first log file.

[0013] In this implementation, based on the preset log generation specification, the received log data is structured and parsed, and the normalized log data can be parsed into complete log data, thereby ensuring the log integrity of the recorded log data.

[0014] In a possible implementation manner, after recording the received log data based on the first log file, the method further includes:

[0015] When the available storage capacity of the first log file is not less than the threshold, the received log data is recorded based on the first log file, and the running state of the second log file is maintained to an idle state; when the running state of the second log file is the idle state, the second log file is not used to record the received log data.

[0016] In this implementation, when the available storage capacity of the first log file is not less than the threshold, the received log data is maintained based on the first log file, and the operation state of the second log file is maintained to the idle state. In this way, when there is not enough storage capacity in the first log file, even if the first log file is backed up, the second log file can be immediately switched to record the latest generated log, thereby preventing the problem that the latest generated log record data may be lost when the log data is backed up.

[0017] In a possible implementation, the method further includes:

[0018] In response to a log reading instruction, obtaining a first log record quantity of the first log file and a second log record quantity of the second log file; the log reading instruction is used to read the latest log data generated by the server;

[0019] The log data corresponding to the log reading instruction is read according to the first log record quantity and the second log record quantity.

[0020] In this implementation, when responding to a log reading instruction, the log data is read according to the first log record quantity and the second log record quantity, so that the latest log data generated by the server can be effectively read.

[0021] In a possible implementation, reading log data corresponding to the log reading instruction according to the first log record quantity and the second log record quantity includes:

[0022] When the first log record quantity is greater than the second log record quantity, or the second log record quantity is greater than the first log record quantity, log superposition reading is performed based on the log files stored in the first log file and the second log file to read the log data corresponding to the log reading instruction.

[0023] In this implementation, the log data reading according to the first log record number and the second log record number is divided into the case where the first log record number is greater than the second log record number and the case where the second log record number is greater than the first log record number. In both cases, the log superposition reading is performed in combination with the first log record number and the second log record number, so as to read the latest log data generated by the server.

[0024] In a possible implementation, when the first log record quantity is greater than the second log record quantity, or the second log record quantity is greater than the first log record quantity, performing log superposition reading based on the log files stored in the first log file and the second log file, and reading the log data corresponding to the log reading instruction includes:

[0025] When the first log record quantity is greater than the second log record quantity, determining the first log overlap quantity by using the second log record quantity and the first log record quantity;

[0026] Based on the first log overlap quantity, the log data recorded in the second log file is overlapped with the log data recorded in the first log file to obtain a first overlapped log file;

[0027] The log data corresponding to the log reading instruction is read according to the first overlay log file.

[0028] In this implementation, when the number of first log records is greater than the number of second log records, the number of first log superpositions is determined based on the number of first log records and the number of second log records. Based on the number of first log superpositions, the log data recorded in the second log file is superimposed with the log data recorded in the first log file to obtain a first superimposed log file. Finally, the first superimposed log file obtained is read to complete the superimposed reading of the logs, and the latest log data generated by the server is read, and the reading precision of the log data is improved.

[0029] In a possible implementation, when the first log record quantity is greater than the second log record quantity, or the second log record quantity is greater than the first log record quantity, performing log superposition reading based on the log files stored in the first log file and the second log file, and reading the log data corresponding to the log reading instruction includes:

[0030] When the second log record quantity is greater than the first log record quantity, determining a second log overlap quantity by using the second log record quantity and the first log record quantity;

[0031] Based on the second log superposition quantity, superimposing the log data recorded in the first log file with the log data recorded in the second log file to obtain a second superimposed log file;

[0032] The log data corresponding to the log reading instruction is read according to the second overlay log file.

[0033] In this implementation, the corresponding second log overlay quantity is determined by the number of log records in the first log file and the number of log records in the second log file, and the corresponding second overlay log file is generated based on the second log overlay quantity, thereby reading the latest log file generated by the server and improving the reading accuracy of the log data.

[0034] In a possible implementation, the method further includes:

[0035] Performing security analysis on the log data recorded in real time to obtain security analysis results of the log data;

[0036] When the security analysis result of the log data indicates that there is a danger, an alarm signal is generated and the recording of the log data is terminated.

[0037] In this implementation, by performing security analysis on the real-time recorded log data, potential security threats such as network attacks and system intrusions can be discovered in a timely manner. When the security analysis result shows that there is a danger, an alarm signal is immediately generated and the recording of log data is terminated. This prevents malicious attackers from forging log data to cover up their behavior. This ensures the authenticity and integrity of the log data and guarantees the operational safety of the server.

[0038] In a second aspect, an embodiment of the present application provides a log storage device, characterized in that the device includes:

[0039] A first recording module, configured to record received log data based on a first log file;

[0040] A first backup switching module, configured to back up the first log file and switch to recording the received log data based on a second log file when the available storage capacity of the first log file is less than a threshold;

[0041] The second backup switching module is used to back up the second log file when the available storage capacity of the second log file is less than the threshold, clear the storage content of the first log file, and switch to recording the received log data based on the first log file.

[0042] In a third aspect, an embodiment of the present application provides a BMC chip, wherein the BMC chip is used to implement the log storage method as described in any possible implementation manner in the first aspect.

[0043] In a fourth aspect, an embodiment of the present application provides a server, comprising: a processor, and a memory communicatively connected to the processor;

[0044] The memory is used to store computer-executable instructions;

[0045] The processor is used to execute the computer-executable instructions stored in the memory to implement the log storage method as described in any possible implementation manner in the first aspect.

[0046] In a fifth aspect, an embodiment of the present application provides a computer storage medium, in which a code is stored. When the code is executed, a device executing the code implements the log storage method described in any possible implementation manner in the first aspect above. BRIEF DESCRIPTION OF THE DRAWINGS

[0047] In order to more clearly illustrate the technical solutions in this embodiment or the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0048] Figure 1 A schematic diagram of a log storage method in an actual application scenario provided by an embodiment of the present application;

[0049] Figure 2 A flowchart of a log rolling method for a practical application scenario provided by an embodiment of the present application;

[0050] Figure 3 A flow chart of a log reading method in an actual application scenario provided by an embodiment of the present application;

[0051] Figure 4 A schematic diagram of the storage of a first log file and a second log file SEL log provided in an embodiment of the present application;

[0052] Figure 5 A schematic diagram of a SEL log presentation result in an actual application scenario provided by an embodiment of the present application;

[0053] Figure 6 A flowchart of a log storage method provided in an embodiment of the present application. DETAILED DESCRIPTION

[0054] It should be noted that the embodiments described in this application are only part of the embodiments of this application, rather than all the embodiments. Based on the embodiments in this application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0055] In order to make the following embodiments clear, the technical terms involved in this application are first introduced.

[0056] System Event Log (SEL) is a log that records important events in a computer or server system. These events include hardware failures, system errors, security warnings, temperature anomalies, etc., covering almost all key events that affect the system's operating status and security. SEL logs are of great significance to system administrators in problem diagnosis, system monitoring, performance analysis, and system security.

[0057] SEL logs are usually generated and maintained by the system's management hardware or software components, such as the baseboard management controller in a server. The baseboard management controller can run independently of the main operating system and can record events even if the system crashes or is shut down, ensuring the integrity and reliability of the log.

[0058] BMC is a hardware module embedded in a server or network device. BMC refers to a hardware management controller embedded in the motherboard of a server, network device or other embedded system, responsible for hardware monitoring and management functions. It usually consists of a BMC chip (such as ASPEED, BMC solution, etc.) and related firmware, with an independent processor and memory. The BMC system provides remote monitoring, configuration, control and management functions by isolating it from the host processor and operating system, allowing administrators to perform management operations without direct access to the device.

[0059] The BMC constantly monitors the health and status of the system, and any critical events such as hardware failures, temperature anomalies, and security attack warnings are recorded in the SEL. When a problem occurs in the system, the system administrator can view the records in the SEL log to help diagnose the root cause of the problem. Since the SEL log records the time and specific information of the event, the system administrator can use this data to analyze which events may have led to the current system status.

[0060] Business operations usually refer to operations related to specific business needs or functions. Business operations are operations designed for specific application scenarios or business goals, such as configuring network parameters, starting or stopping services, and managing user permissions. The business operations that can be implemented by different BMC application software may also be different.

[0061] The Intelligent Platform Management Interface (IMPI) specification is an open, vendor-independent interface standard that defines a set of interfaces that can be used to monitor, manage, and control server system hardware. The IPMI specification allows system administrators to manage servers and monitor their operating status through a unified set of interfaces, even when the operating system crashes or is shut down.

[0062] Log rolling is a log management technology that aims to process SEL logs that have been stored in the server for too long through a pre-set processing strategy to prevent the log data from growing indefinitely and consuming the storage space in the server. In some log rolling schemes, when the SEL log stored in the BMC reaches the maximum entry limit, it is necessary to back up and transfer the SEL logs stored therein, and clear the earliest created SEL logs to achieve log rolling. Although this method can effectively achieve log rolling in the BMC, during the process of SEL log backup and transfer, the server may generate new SEL logs. At this time, because the BMC is backing up the SEL logs, it cannot write the newly generated SEL logs, which will cause part of the SEL logs to be lost.

[0063] In view of the above technical problems, the embodiment of the present application provides a log storage method, a chip and a server. In the log storage method provided by the embodiment of the present application, firstly, the log data received in real time is recorded based on the first log file, and when the available storage capacity of the first log storage file is less than the threshold value, the first log file is backed up immediately, and the second log file is switched to log recording. So that the log backup process for the first log file will not affect the reception and recording of real-time log data. And, when the available storage capacity of the second log file is less than the threshold value, the log data stored in the first log file is cleared, and the first log file is switched again to log recording. Since the first log file has started to be backed up when switching to the second log file for log recording, when the available storage capacity of the second log file is less than the threshold value, the log data in the first log file has been backed up, so the storage content in the first log file can be directly cleared, and the log data can be recorded again based on the first log file. Thereby realizing that when the log is backed up in the log rolling process, the log data received in real time is recorded by clearing the log file that has been backed up, solving the problem of log loss in the log rolling process.

[0064] It should be noted that the log storage method provided in the embodiment of the present application can be applied to log rolling schemes of different log types. In this embodiment, the SEL log is used as an exemplary log type to explain a log storage method provided in the embodiment of the present application. The embodiment of the present application does not limit the log type targeted by the log storage method.

[0065] In order to facilitate understanding of the technical solution provided by the embodiment of the present application, a log storage method provided by the embodiment of the present application will be introduced below in combination with an actual application scenario.

[0066] See also Figure 1, which is a schematic diagram of a log storage method in an actual application scenario provided by an embodiment of the present application, and includes a BMC, a business process module, a SEL log processing module, and a first log file and a second log file.

[0067] The SEL log processing module includes a log reading unit and a log writing unit. The log writing unit is used to record the SEL log into the first log file and the second log file according to the available storage capacity of the first log file and the second log file. The log reading unit is used to respond to the SEL reading instruction sent by the business process module, and when the business process module needs to obtain the SEL log stored in the first log file and the second log file, the required SEL log is read from the first log file and the second log file.

[0068] In the process of the log writing unit recording the SEL log according to the available storage capacity of the first log file and the second log file, when the available storage capacity of the first log file and the second log file are the same, the SEL log sent by the business process module is recorded based on the first log file. As the first log file continues to record the SEL log, the available storage capacity of the first log file will gradually decrease. When the available storage capacity of the first log file is less than a preset threshold, it indicates that the storage space in the first log file is no longer sufficient to maintain the recording and storage of the SEL log. At this time, the SEL log recorded in the first log file is backed up, and the recording task for the SEL log is switched to the second log file for execution.

[0069] In the process of recording the SEL log, the SEL log is recorded only through one of the first log file and the second log file. For example, when recording the SEL log through the first log file, when the available storage capacity in the first log file is not less than a threshold, the SEL log is recorded based on the first log file, and the operation state of the second log file is maintained to an idle state.

[0070] At this time, the recording of the SEL log is completed only by the first log file, and the second log file is always in an idle state. Therefore, when the first log file does not have sufficient storage capacity, even if the first log file is backed up, the second log file can be immediately switched to record the latest generated SEL log, thereby preventing the problem that the latest generated SEL log may be lost when backing up the SEL log.

[0071] Correspondingly, in the process of recording the SEL log in the second log file, the file backup for the first log file is carried out synchronously, and when the available storage capacity in the second log file is less than the threshold, the file backup for the first log file has been completed. At this time, the file backup step for the second log file can be executed, and the storage content in the first log file can be cleared, and the first log file can be switched back to record the newly generated SEL log. In this way, the newly generated SEL log can still be recorded normally during the process of backing up the SEL log, which solves the problem that the newly generated SEL log record may be lost when backing up the SEL log.

[0072] Further, in Figure 1 In the BMC shown, the business process module is used to send the SEL log generated by the server in real time to the SEL log processing module.

[0073] In one possible implementation, the business process module can use the IPMI specification as a reference specification when generating the SEL log. When a business process in the server generates an event, a corresponding SEL log is generated based on the IPMI specification and sent to the SEL log processing module for logging. The IPMI specification specifies how events generated by business processes should be recorded, stored, and managed. Its specification defines the standard recording format for various types of events to facilitate the unified storage of SEL logs.

[0074] Accordingly, although the SEL log generated based on the IPMI specification is standardized format data, the records of the SEL log may be different in different usage scenarios, and the standardized format data may cause some recorded SEL logs to be incomplete. Therefore, when the business process module generates the SEL log based on the IPMI specification, the log writing unit needs to restructure and parse the received SEL log according to the format specified by the IPMI specification, and record and store the SEL log obtained after parsing, so as to ensure the integrity of the recorded SEL log.

[0075] Next, continue with Figure 1 As an actual application scenario, the manner in which the log writing unit stores logs based on the first log file and the second log file is further explained in detail.

[0076] See also Figure 2 , which is a flow chart of a log rolling method for an actual application scenario provided by an embodiment of the present application. The overall log rolling logic is executed by a log writing unit, and specifically includes the following steps:

[0077] S1201: The log writing unit receives the SEL log generated in real time.

[0078] The log writing unit receives the SEL log generated in real time from the business process module. The SEL log can be received through a specific system interface, such as a system management bus or other customized communication interface.

[0079] In a possible implementation, the log writing unit may receive the SEL log based on the preset log generation specification that the business process module refers to when generating the SEL log during the process of receiving the SEL log. When the business process module generates the SEL log based on the preset log generation specification, the log writing unit needs to perform structured parsing on the SEL log according to the specific preset log generation specification to parse the SEL log under the preset log generation specification into a complete SEL log.

[0080] The original SEL log information includes information transmitted by each sensor in the server, such as the timestamp of the system event, the type of event, the severity level of the event, and the sensor identification. The original log information is directly obtained by each sensor in the server, and the information format between different log information is also different. Therefore, when the business process module sends the SEL log to the log writing unit, it is often necessary to generate the SEL log according to the predetermined preset log generation specification to ensure the standardized generation of the SEL log.

[0081] Therefore, in the process of the log writing unit receiving the SEL log, it is necessary to perform structured analysis on the SEL log according to the corresponding preset log generation specification, so as to re-parse the standardized SEL log into complete SEL log data, thereby ensuring the log integrity of the recorded SEL log.

[0082] S1202: Determine whether the log file used to record the SEL log is the first log file.

[0083] After receiving the SEL log generated in real time, determine the log file used to record the SEL log, and judge whether the log file used to record the SEL log is the first log file. If the log file used to record the SEL log is the first log file, execute step S1203 and step S1205 corresponding to S1203. Otherwise, execute step S1204 and step S1206 corresponding to S1204.

[0084] It should be noted that after determining the log file for recording the SEL log, only one of the first log file and the second log file will participate in recording the SEL log, and the other log file is in an idle state or in a file backup state for the SEL log.

[0085] S1203: Recording a SEL log based on the first log file.

[0086] After determining that the log file used to record the SEL log is the first log file, the SEL log generated based on the log generation specification is parsed into a complete SEL log by performing structured parsing on the received SEL log, and the parsed SEL log is recorded in the first log file.

[0087] S1204: Recording a SEL log based on the second log file.

[0088] Correspondingly, if the log file used to record the SEL log is not the first log file, the received SEL log will be recorded based on the second log file. At this time, the first log file may be in the stage of backing up the SEL log, or may be in an idle state where no SEL log has been received.

[0089] S1205: Determine whether the available storage capacity of the first log file is less than a threshold.

[0090] In the process of recording the SEL log based on the first log file, the available storage capacity of the first log file is monitored in real time to determine whether the available storage capacity in the first log file is less than the set threshold. When its available storage capacity is less than the preset threshold, it indicates that a large number of SEL logs have been stored in the first log file, and its storage capacity for recording the SEL log is insufficient. At this time, step S1207 needs to be executed to switch the second log file to record the SEL log, and to perform a file backup of the SEL log recorded in the first log file.

[0091] Correspondingly, when the available storage capacity of the first log file is not less than the threshold value, it indicates that the current storage capacity of the first log file is sufficient for recording the SEL log. At this time, step S1201 is executed to continuously and cyclically execute the judgment step for the available storage capacity in the first log file, thereby maintaining the monitoring of the available storage capacity of the first log file. In this process, the recording of the SEL log is still completed by the first log file, and the second log file does not participate in the recording of the SEL log. The running state of the second log file is idle.

[0092] S1206: Determine whether the available storage capacity of the second log file is less than a threshold.

[0093] Similarly, in the process of recording the SEL log based on the second log file, the available storage capacity of the second log file is also continuously monitored. When the available storage capacity is not less than the threshold, step S1201 is executed to maintain the monitoring process for the available storage capacity of the second log file. When the available storage capacity is less than the threshold, step S1207 is executed to switch the first log file to record the SEL log.

[0094] S1207: Switch to a log file whose available storage capacity is not less than a threshold to record the SEL log.

[0095] When the available storage capacity of the first log file or the second log file is less than a threshold, another log file whose available storage capacity is not less than the threshold is immediately switched to record the SEL log, thereby ensuring that the latest SEL log generated by the server can be continuously received for recording, avoiding the problem of SEL log record loss.

[0096] S1208: Back up the log files whose available storage capacity is greater than the threshold.

[0097] Accordingly, after switching to a log file with an available storage capacity less than a threshold value to record the SEL log, it is necessary to synchronously back up the SEL log recorded in the log file with an available storage capacity greater than the threshold value. In this way, the SEL log can be recorded in another log file during the SEL log backup process, thereby solving the problem that the SEL log cannot be recorded during the SEL log backup process.

[0098] In the log storage method provided in the embodiment of the present application, the records for the SEL log are divided into a first log file and a second log file for recording. This dual-file rotation backup and recording method can switch to another second log file with a certain available storage capacity for log recording when the first log file does not have a certain available storage capacity, and when the second log file does not have a certain available storage capacity, the backed up logs in the first log file are cleared, so that the first log file is used for log recording, and this cycle is used to achieve log backup and record synchronization processing, which solves the problem of record loss during the log backup process.

[0099] It should be noted that when the available storage capacity of the first log file is less than the threshold, the second log file is switched to record the SEL log and perform a file backup on the first log file. At this time, the first log file is in the process of file backup, and the received SEL log is recorded by the second log file. When the available storage capacity in the second log file is also less than the threshold, since in the stage of recording the SEL log based on the second log file, the first log file has been performing a file backup on the SEL log stored internally. Therefore, when the available capacity of the second log file is less than the threshold, the SEL log in the first log file has been backed up, and the storage content recorded in the first log file can be cleared, and the first log file can be switched again to record the received SEL log, thereby realizing the continuous recording of the SEL log.

[0100] In an actual application scenario, the first log file is in a file backup state, and the second log file is used to record logs as an application scenario example. At this time, the total number of logs stored in the first log file and the second log file is greater than the maximum storable number of a single log file. In this scenario, when reading the latest received log, it is necessary to present the latest received SEL log on the maximum storable number of a single log file. Since the total number of log entries stored in the first log file and the second log file is greater than the maximum storable number of a single log file, it is necessary to superimpose the latest received log recorded in the second log file with the log recorded in the first log file to present the latest received log.

[0101] In order to achieve this technical effect, in combination with the above-mentioned embodiment of the present application Figure 1 In the provided log storage method, when the log reading unit reads the SEL log in the log storage file, it is necessary to complete the log reading according to the number of log entries stored in the first log file and the second log file, so as to present the latest received log.

[0102] The following continues Figure 1 As an actual application scenario, a method in which the log reading unit presents the recorded SEL log to the business process module according to the number of logs in the first log storage file and the second log storage file is specifically introduced:

[0103] See also Figure 3 , which is a flow chart of a log reading method in an actual application scenario provided by an embodiment of the present application, and specifically includes the following steps:

[0104] S1101: In response to a log reading instruction, obtaining a first log record quantity of a first log file and a second log record quantity of a second log file; the log reading instruction is used to read the latest log data generated by the server;

[0105] The log reading unit in the SEL log processing module responds to the log reading instruction, and obtains the first log record quantity of the first log file and the second log record quantity of the second log file respectively, where the log record quantity is used to indicate the number of log items recorded in the file.

[0106] S1102: Read log data corresponding to the log reading instruction according to the first log record quantity and the second log record quantity.

[0107] In an actual application scenario, when one of the first log file and the second log file is performing log backup, the SEL log generated in real time by the server is recorded by another log file. When the log reading instruction needs to read the latest SEL log generated by the server, the reading process needs to be performed with the maximum log storage quantity of the log file, and a part of the latest generated SEL log is recorded in another log file that is not in a backup state. At this time, it is necessary to combine the first log record quantity and the second log record quantity to perform log superposition reading, so as to read the latest SEL log generated by the server.

[0108] Specifically, it can be divided into two situations: the number of first log records is greater than the number of second log records, or the number of second log records is greater than the number of first log records. In the first situation, since the number of first log records is greater than the number of second log records, it indicates that the first log file is backing up its recorded logs, and the latest generated SEL log record is in the second log file. Similarly, in the second situation, the second log file is backing up the logs, and the latest generated SEL log record is in the first log file. Here, the number of first log records is set to n1, and the number of second log records is set to n2, to introduce the log superposition reading method in the above two situations.

[0109] See also Figure 4 , this figure is a schematic diagram of the storage of a first log file and a second log file SEL log provided in an embodiment of the present application.

[0110] As shown in the figure, the SEL log serial number identifiers stored in the first log file are 1-2-3-4-5 from top to bottom according to the chronological order. In the first log file, the SEL log with serial number 1 represents the log that is first written to the first log file, that is, the log with the longest storage time in the first log file. Correspondingly, the SEL log with serial number 5 represents the log with the shortest storage time in the first log file. Correspondingly, the relationship between the log serial number and the storage time in the second log file is the same as that in the first log file, and will not be repeated here.

[0111] exist Figure 4In the first log file shown, the number of first log records n1=5, and the number of second log records n2=2. At this time, the number of first log records is greater than the number of second log records. From the above description of log writing and log rolling logic between the first log file and the second log file, it can be seen that when the available storage capacity in the first log file is less than the threshold, it is necessary to switch to the second log file to record the SEL log, so as to continuously record the latest generated SEL log and prevent the loss of the SEL log record.

[0112] Therefore, in Figure 4 In the application scenario shown, the writing and storage of the SEL log is completed by the second log file, and the first log file is not used to record the SEL log. Correspondingly, it can be known that the SEL logs with sequence numbers 6 and 7 stored in the second log file are the latest received SEL logs. Therefore, for reading the SEL log, it is necessary to read the SEL log recorded in the second log file on the basis of the SEL log recorded in the first log file.

[0113] Since the SEL log stored in the second log file is the latest received SEL log, when responding to the log reading instruction to read the SEL log, the logs with sequence numbers 6 and 7 need to be superimposed on the first log file to ensure that the latest received SEL log recorded in the second log file can be superimposed and read.

[0114] In this application scenario, n1=5, n2=2, the number of first log records is greater than the number of second log records, and if you want to overlay the latest received SEL log recorded in the second log file on the basis of the SEL log recorded in the first log file, you need to determine the first log overlay number based on the first log record number and the second log record number. Specifically, subtract the first log record number from the second log record number to get the first log overlay number.

[0115] Corresponds to Figure 4 In the application scenario, the result of n1-n2 is the number of the first log stacking. In the first log file, the result of n1-n2 is used as the SEL log that needs to be stacked in the first line of the first log file, so that the log stacking reading can be realized. For details, please refer to Figure 5 A schematic diagram of SEL log presentation results in an actual application scenario is shown.

[0116] As shown in the figure, by subtracting the number of first log records from the number of second log records, the first log superposition number can be obtained, that is, n1-n2=3. Therefore, it is necessary to use the SEL log represented by the third line in the first log file as the first line of log, and superimpose the SEL logs of sequence numbers 6 and 7 in the second log file on the SEL logs of sequence numbers 4 and 5 in the first log file, and the log reading result is: 3-4-5-6-7. In this scenario, since the latest received SEL log recorded in the second log file is the SEL log of sequence numbers 6-7, the latest received SEL log of sequence numbers 6-7 needs to be superimposed on the original position of sequence numbers 4-5. Correspondingly, the SEL log file of sequence numbers 1-2 will be superimposed by the SEL log file of sequence numbers 3-4, thereby obtaining the log reading result of 3-4-5-6-7. In this way, the first superimposed log file after superposition can be obtained, and the logs recorded in the first superimposed log file are: 3-4-5-6-7. During reading, by reading the first overlay log file, the overall log overlay reading process can be implemented, and the latest log data generated by the server can be read.

[0117] Furthermore, in actual application scenarios, the SEL logs presented on the first log file still need to be arranged according to normal serial numbers. Therefore, after reading the SEL logs with serial numbers 3-7, their serial numbers are modified again to present the original SEL logs with serial numbers 1-5, thereby reading the latest received SEL logs 6 and 7, and combining them with the SEL logs recorded in the first log for log presentation.

[0118] It can be seen that through the above method, the SEL logs with sequence number 6 and sequence number 7 that are newly received in the second log file can be presented immediately when the log is read. In the process of reading the SEL log, the newly received SEL log can be read and presented by the number of logs corresponding to the first log file and the second log file. This method can effectively present the newly received SEL log without losing records in the SEL log, and the precision of log reading is improved.

[0119] Similarly, when the number of second log records is greater than the number of first log records, the same method as above needs to be adopted to superimpose the latest received log data recorded in the first log file with the second log file, determine the second log superposition number based on the number of log records of the two, and generate a corresponding second superimposed log file based on the second log superposition number, so as to read the latest log file generated by the server. The generation principles and processes of the first superimposed log file and the second superimposed log file are the same, so they will not be elaborated here.

[0120] Next, the log storage method provided by the embodiment of the present application will be introduced in conjunction with the accompanying drawings.

[0121] See also Figure 6 , which is a flow chart of a log storage method provided by an embodiment of the present application, and specifically includes the following steps:

[0122] S101: Record received log data based on a first log file.

[0123] In the server to which the log storage method of the embodiment of the present application is applied, a first log file and a second log file are provided in the server. First, when both the first log file and the second log file have a certain available storage capacity, the received log data is first recorded based on the first log file. In the process of recording the received log data in the first log file, the second log file is in an idle state, and the recording process of the log data is only completed by the first log file. In this way, when the available storage capacity in the first log file is less than a threshold value, the second log file can be switched immediately to record the log data, thereby preventing the loss of the log data.

[0124] S102: When the available storage capacity of the first log file is less than a threshold, back up the first log file and switch to recording the received log data based on the second log file.

[0125] In the process of receiving log data through the first log file, the received log data is continuously recorded based on the first log file, and the available storage capacity of the first log file is monitored in real time. When a large amount of log data has been recorded in the first log file, so that its available storage capacity is less than a threshold, the log data recorded in the first log file is backed up, and the second log file is switched to record the received log data.

[0126] In a possible implementation, the available storage capacity of the first log file can be determined based on the file size of the first log file. By obtaining the file size of the first log file and further determining the storage capacity already used by the first log file based on its file size, the available storage capacity of the first log file can be effectively determined. Furthermore, in order to ensure the accuracy of obtaining the available storage capacity of the first log file, the available storage capacity of the first log file can be obtained after recording the log data each time the first log file records new log data, thereby ensuring the data accuracy of the available storage capacity.

[0127] In another possible implementation, the file backup for the first log file can be completed through a specific log backup or a log backup script, and the log data backed up in the first log file can be stored in a log data storage platform in the cloud to facilitate query and acquisition of log data.

[0128] S103: When the available storage capacity of the second log file is less than the threshold, back up the second log file, clear the storage content of the first log file, and switch to recording the received log data based on the first log file.

[0129] After switching to the second log file to record log data, at this time, the first log file is in the backup stage of log data, and the log data recording task is taken over by the second log file. In the process of recording log data in the second log file, a large amount of time is given to back up the log data in the first log file. Therefore, when the available storage capacity of the second log file is also less than the threshold, the log data in the first log file has been backed up at this time, so the log data in the first log file can be cleared. Therefore, the log data in the second log file is also backed up, and the storage content of the first log file is cleared, and then the first log file can be switched back to record the received log data through the first log file, while providing time for the file backup of the second log file, preventing the problem of log record loss.

[0130] In a possible implementation, in the process of recording log data through the first log file and the second log file, a security analysis may also be performed on the log data recorded in real time in the first log file or the second log file to obtain a security analysis result for the log data recorded in real time.

[0131] In this way, by conducting security analysis on the real-time recorded log data, potential security threats such as network attacks and system intrusions can be discovered in a timely manner. When the security analysis result shows that there is a danger, an alarm signal is immediately generated and the recording of log data is terminated. This prevents malicious attackers from forging log data to cover up their behavior. This ensures the authenticity and integrity of the log data and guarantees the safety of the server operation.

[0132] The above are some specific implementations of the log storage method provided in the embodiment of the present application. Based on this, the present application also provides corresponding chips and servers. The chip and server provided in the embodiment of the present application will be introduced below in combination with the above log storage method.

[0133] The embodiment of the present application further provides a BMC chip, and the BMC chip is used to implement the log storage method described in any of the above embodiments.

[0134] The embodiment of the present application further provides a server, comprising: a processor, and a memory communicatively connected to the processor;

[0135] The memory is used to store computer-executable instructions;

[0136] The processor is used to execute the computer-executable instructions stored in the memory to implement the log storage method described in any of the above embodiments.

[0137] The embodiment of the present application also provides a computer storage medium for implementing the solution provided by the embodiment of the present application.

[0138] The computer storage medium stores codes, and when the codes are executed, the device executing the codes implements the log storage method described in any embodiment of the present application.

[0139] The "first" and "second" in the names such as "first" and "second" (if any) mentioned in the embodiments of the present application are only used as name identifiers and do not represent the first or second in order.

[0140] Through the description of the above implementation methods, it can be known that those skilled in the art can clearly understand that all or part of the steps in the above-mentioned embodiment method can be implemented by means of software plus a general hardware platform. Based on such an understanding, the technical solution of the present application can be embodied in the form of a software product, which can be stored in a storage medium, such as a read-only memory (ROM) / RAM, a magnetic disk, an optical disk, etc., including a number of instructions for a computer device (which can be a personal computer, a server, or a network communication device such as a router) to execute the methods described in each embodiment of the present application or some parts of the embodiments.

[0141] Each embodiment in this specification is described in a progressive manner, and the same and similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device embodiment, since it is basically similar to the method embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment. Some or all of the modules can be selected according to actual needs to achieve the purpose of the scheme of this embodiment. Ordinary technicians in this field can understand and implement it without paying creative work.

[0142] The above description is merely an exemplary embodiment of the present application and is not intended to limit the protection scope of the present application.

Claims

1. A log storage method, characterized in that: The method comprises: recording the received log data based on the first log file; When the available storage capacity of the first log file is less than a threshold, backing up the first log file and switching to recording the received log data based on the second log file; When the available storage capacity of the second log file is less than the threshold, the second log file is backed up, the storage content of the first log file is cleared, and the received log data is recorded based on the first log file.

2. The method according to claim 1, characterized in that The step of recording the received log data based on the first log file includes: Based on a preset log generation specification, the received log data is structured and parsed to obtain parsed log data; the received log data is log data generated by the server according to the preset log generation specification; The parsed log data is recorded in the first log file.

3. The method according to claim 1, characterized in that After recording the received log data based on the first log file, the method further includes: When the available storage capacity of the first log file is not less than the threshold, the received log data is recorded based on the first log file, and the running state of the second log file is maintained to an idle state; when the running state of the second log file is the idle state, the second log file is not used to record the received log data.

4. The method according to claim 1, characterized in that: The method further comprises: In response to a log reading instruction, obtaining a first log record quantity of the first log file and a second log record quantity of the second log file; the log reading instruction is used to read the latest log data generated by the server; The log data corresponding to the log reading instruction is read according to the first log record quantity and the second log record quantity.

5. The method according to claim 4, characterized in that The step of reading log data corresponding to the log reading instruction according to the first log record quantity and the second log record quantity includes: When the first log record quantity is greater than the second log record quantity, or the second log record quantity is greater than the first log record quantity, log superposition reading is performed based on the log files stored in the first log file and the second log file to read the log data corresponding to the log reading instruction.

6. The method according to claim 5, characterized in that When the first log record quantity is greater than the second log record quantity, or the second log record quantity is greater than the first log record quantity, performing log superposition reading based on the log files stored in the first log file and the second log file, and reading the log data corresponding to the log reading instruction, includes: When the first log record quantity is greater than the second log record quantity, determining the first log overlap quantity by using the second log record quantity and the first log record quantity; Based on the first log overlap quantity, the log data recorded in the second log file is overlapped with the log data recorded in the first log file to obtain a first overlapped log file; The log data corresponding to the log reading instruction is read according to the first overlay log file.

7. The method according to claim 5, characterized in that When the first log record quantity is greater than the second log record quantity, or the second log record quantity is greater than the first log record quantity, performing log superposition reading based on the log files stored in the first log file and the second log file, and reading the log data corresponding to the log reading instruction, includes: When the second log record quantity is greater than the first log record quantity, determining a second log overlap quantity by using the second log record quantity and the first log record quantity; Based on the second log superposition quantity, superimposing the log data recorded in the first log file with the log data recorded in the second log file to obtain a second superimposed log file; The log data corresponding to the log reading instruction is read according to the second overlay log file.

8. The method according to claim 1, characterized in that The method further comprises: Performing security analysis on the log data recorded in real time to obtain security analysis results of the log data; When the security analysis result of the log data indicates that there is a danger, an alarm signal is generated and the recording of the log data is terminated.

9. A BMC chip, characterized in that: The BMC chip is used to implement the log storage method according to any one of claims 1 to 8.

10. A server, characterized in that: include: A processor, and a memory communicatively connected to the processor; The memory is used to store computer-executable instructions; The processor is used to execute the computer-executable instructions stored in the memory to implement the log storage method according to any one of claims 1 to 8.

Images