Event log recording method and device, computer equipment and storage medium

Abstract

The invention relates to the technical field of logs, and discloses an event log recording method and device, and the method comprises the steps: obtaining a first event log, and searching at least one event log matched with the first event log from an event log array according to the event identifier and event attribute information of the first event log, according to a target event merging strategy corresponding to the first event log, target event attribute information corresponding to the target event merging strategy is extracted from the first event log and the second event log, and first target event attribute information corresponding to the target event merging strategy extracted from the first event log is extracted from the second event log; and matching the first event log with second target event attribute information corresponding to the target event merging strategy extracted from the second event log, and determining whether to merge the first event log and the second event log, thereby achieving the technical effect of optimizing and simplifying the event log array.

Description

Technical Field

[0001] The present invention relates to the field of log technology, and in particular to a method, device, computer equipment and storage medium for recording event logs. Background Art

[0002] Event log systems play a vital role in the management and maintenance of modern storage devices. These systems are responsible for recording the operating status of the device, storage resource usage, performance indicators, and fault information, thereby helping operation and maintenance personnel and development engineers to quickly locate the root cause of the problem and accelerate fault repair when the system fails. By analyzing event logs, not only can business processes be optimized, but also system efficiency can be improved. However, as the scale of the system and the complexity of business logic increase, the requirements for logging become more stringent. Unreasonable logging strategies, such as excessive or redundant logging, will not only increase storage costs, but also increase complexity in the log analysis and backtracking process. Specifically, inappropriate logging design, log level selection, and incomplete logging of log information will significantly affect the effectiveness and utilization value of logs.

[0003] Therefore, developing an optimized event logging method to improve the reliability and security of event logs is the key to solving these problems. Summary of the invention

[0004] In view of this, the present invention provides a method, apparatus, computer device, and storage medium for recording an event log to solve the problem of how to improve the efficiency and accuracy of the event log.

[0005] In a first aspect, the present invention provides a method for recording an event log, the method comprising:

[0006] Obtaining a first event log, wherein the first event log is a newly reported event log, and the event log includes: event attribute information, event identifier, and event merging strategy;

[0007] In the case of searching at least one event log matching the first event log from the event log array according to the event identifier of the first event log and the event attribute information, according to the target event merging strategy corresponding to the first event log, extracting target event attribute information corresponding to the target event merging strategy from the first event log and the second event log respectively, wherein the second event log is any one of the at least one event log, and the event log array is used to store event logs;

[0008] The first target event attribute information corresponding to the target event merging strategy extracted from the above-mentioned first event log is matched with the second target event attribute information corresponding to the above-mentioned target event merging strategy extracted from the above-mentioned second event log, and based on the matching result, it is determined whether to merge the above-mentioned first event log and the above-mentioned second event log.

[0009] The event log recording method provided by the present invention has the following advantages:

[0010] First, the event log carries event attributes, event identifiers, and event merging strategies. According to the event identifier and event attribute information of the newly reported first event log, at least one event log matching the above-mentioned first event log is searched from the event log array. According to the target event merging strategy of the first event log, the target attribute information corresponding to the first event log and the second event log is extracted. The target attribute information of the first event log and the second event log is matched, and it is determined whether to merge the first event log and the second event log according to the matching result. Through the above scheme, according to the event identifier and target attribute information of the newly reported event log, the event log matching in the event log array is searched, and according to the matching situation between the newly reported event log and the event log array, it is determined whether to merge the newly reported event log with the event log matching in the event log array, thereby avoiding excessive or unnecessary event log records, achieving the technical effect of optimizing and streamlining the event log array, and then improving the reliability and security of the event log, and enhancing the maintainability and operation and maintenance efficiency of the system, and being able to more effectively cope with challenges and changes in complex system environments.

[0011] In an optional implementation, the event attribute information includes: event status and event reporting time, and searching the event log that matches the first event log from the event log array according to the event identifier of the first event log and the event attribute information specifically includes:

[0012] According to the event status and the event reporting time, searching from the event log array whether there is an event log whose event reporting time is earlier than the event reporting time of the first event log and whose event status is an unrepaired state;

[0013] When it is determined that there is a candidate event log whose event reporting time is earlier than the event reporting time of the above-mentioned first event log and whose event status is an unrepaired state, the above-mentioned candidate event logs are searched to see whether there is a target event log with the same identifier as the above-mentioned first event log as the event log that matches the above-mentioned first event log.

[0014] Specifically, in the steps of the method, the event attribute information includes the event status and the event reporting time. According to the event identifier of the first event log and the event attribute information, the event log matching the first event log is searched from the event log array. Specifically, according to the event status and the event reporting time, the event data whose event status is unrepaired and whose event reporting time is earlier than the first event log is searched from the event log array. After finding the candidate event log whose event reporting time is earlier than the event reporting time of the first event log and whose event status is unrepaired, the target event log with the same identifier as the first event log is searched from the candidate events. Through the above method, by matching the event log in the event log array that is unrepaired and whose reporting time is earlier than the event reporting time of the first event log with the event identifier of the first event log, the target event log with the same identifier as the first event log is used as the event log matching the first event log. Thereby, the unrepaired events reported multiple times are merged, and the technical effect of further streamlining the event log array is achieved.

[0015] In an optional implementation, the event attribute information further includes: event type. The method further includes:

[0016] When it is determined that there is no event log matching the first event log in the event log array, searching the event log array for a target array element whose event status is unused, and storing the first event log in the target array element;

[0017] Alternatively, when it is determined that there is no array element with an event status of unused in the event log array, searching for the event reporting time of the event log corresponding to each event type;

[0018] Selecting a target event log according to the event reporting time of the event log corresponding to each event type, the priority corresponding to the event type, and one or more event attribute information in the event state;

[0019] The first event log is overwritten and stored in the array element to which the target event log belongs.

[0020] Specifically, in the steps of the method, the event attribute information includes the event type, and the event log matching the above-mentioned first event log is searched from the event log array, but when it is determined that there is no matching event log, the target array element whose event type is unused is searched from the event log array, and the above-mentioned first event log is stored in the above-mentioned target array element. Or when the unused array element is not found, the reporting time of the event log corresponding to each event type is searched, and the target event log is selected according to the event reporting time of the event log corresponding to each event type, the priority corresponding to the above-mentioned event type, and one or more event attribute information in the above-mentioned event state. Through the above scheme, when there is no event log matching the first event log in the event log array, the unused target array element and the above-mentioned first event log are stored in the target array element according to the event state in the event log array. When the unused target array element is not found, the event reporting time of the event log of each event type is searched, and the target event log is selected according to the event reporting time of the event log corresponding to each event type, the priority corresponding to the above-mentioned event type, and one or more event attribute information in the above-mentioned event state. This makes it possible to store newly reported event logs that cannot be merged multiple times into unused target array elements, or to overwrite the earliest repaired event log with the newly reported event log, thereby avoiding the continuous growth of the event log. The event log array is cleared while the newly reported event log is entered, achieving the technical effect of further streamlining or clearing the event log array.

[0021] In an optional implementation, the target event log is selected according to the event reporting time of the event log corresponding to each event type, the priority corresponding to the above event type, and one or more event attribute information in the above event state, specifically including:

[0022] According to the event status of each event log, identifying whether there is a repaired event log in the event log array;

[0023] When it is determined that there is a repaired event log, and the repaired event log is not the earliest reported event log of the first preset type, or is not an event log of the second preset type, selecting the earliest repaired event log among the repaired event logs as the target event log;

[0024] or,

[0025] When it is determined that there is no repaired event log, identifying the event type of each event log in the event log array;

[0026] or,

[0027] When the existence of an event log of the third preset type and / or an event log of the fourth preset type is identified, the event log corresponding to the earliest event reporting time in the event log of the third preset type and / or the event log of the fourth preset type is selected as the target event log;

[0028] or,

[0029] When the event log array does not include the event log of the third preset type and the event log of the fourth preset type, but includes the event log of the first preset type, then the event log of the first preset type except the event log with the earliest event reporting time is selected as the target event log;

[0030] or,

[0031] When the event log array includes only event logs of the second preset type and / or includes event logs of the first preset type with the earliest event reporting time, event prompt information indicating that the log is full is generated.

[0032] Specifically, in the steps of the method, it is determined whether there is a repaired event log in the event log array according to the event status of the event log, and the event log that is not the first preset type and is not the earliest repaired event log in the repaired event log is used as the above-mentioned target event log. Or in the case where there is no repaired event log, the event type of each event log in the event log array is identified. Or when it is identified that there is an event log of the third preset type and / or the fourth preset type, the event log corresponding to the earliest event reporting time in the event log of the third preset type and / or the event log of the fourth preset type is used as the above-mentioned target event log. Or when the event log of the third preset type and the event log of the fourth preset type do not exist, the event log of the first preset type except the event log with the earliest reporting time is used as the above-mentioned target event log. Or when there is only the event log of the second preset type left in the event log array, and / or the event log with the earliest reporting time of the first preset type is included, an event prompt message indicating that the log is full is generated. Through the above steps, the event logs in the log array are divided into multiple preset types, and each type of event log has a different priority. The earliest repaired event log is overwritten according to the event priority to prevent the repaired event log from occupying the space of the event log array. The earliest reported event log is further overwritten to prevent outdated information or configuration events from occupying the space of the event log array. This solves the problem that continuous recording of events may lead to the continuous growth of event logs, effectively controls the number of logs, and ensures the analyzability and continuity of log applications.

[0033] In an optional implementation, when the first target event attribute information corresponding to the target event merging strategy extracted from the first event log includes a first root sequence, a first object type, and a first object identification information, and the second target event attribute information corresponding to the target event merging strategy extracted from the second event log includes a second root sequence, a second object type, and a second object identification information, the first target event attribute information corresponding to the target event merging strategy extracted from the first event log and the second target event attribute information corresponding to the target event merging strategy extracted from the second event log are matched, and according to the matching result, it is determined whether to merge the first event log and the second event log, specifically including:

[0034] When it is determined that the first root sequence is the same as the second root sequence, the first object type is the same as the second object type, and the first object identification information is the same as the second object identification information, it is determined that the first event log and the second event log are to be merged.

[0035] Alternatively, when the first root sequence and the second root sequence are different, and / or the first object type and the second object type are different, and / or the first object identification information and the second object identification information are different, it is determined that the first event log and the second event log are not to be merged.

[0036] Specifically, in the steps of the method, the root sequence, object type, and object identification information of the first event log and the second event log are matched, and it is determined whether to merge the first event log and the second event log according to one or more matching results of the root sequence, object type, and object identification information. Therefore, it is possible to generate corresponding merging strategies according to different target event attribute information set for different event logs, and to process whether to merge the first event log and the second event log based on multiple merging strategies, so that the simplified event log array method is more targeted.

[0037] In an optional implementation, when the first target event attribute information corresponding to the target event merging strategy extracted from the first event log includes the first object identification information, and the second target event attribute information corresponding to the target event merging strategy extracted from the second event log includes the second object identification information, the first target event attribute information corresponding to the target event merging strategy extracted from the first event log and the second target event attribute information corresponding to the target event merging strategy extracted from the second event log are matched, and according to the matching result, it is determined whether to merge the first event log and the second event log, specifically including:

[0038] When it is determined that the first object identification information and the second object identification information are the same, determining to merge the first event log and the second event log;

[0039] Alternatively, when it is determined that the first object identification information and the second object identification information are different, it is determined that the first event log and the second event log are not to be merged.

[0040] Specifically, in the steps of the method, the object identification information of the first event log and the second event log are matched, and whether to merge the first event log and the second event log is determined according to the matching result of the object identification information. Therefore, different object identification information can be set according to different event logs for separate merging, and the first event log and the second event log are merged based on the object identification information, so that when the event log array is streamlined, the events generated by the described object corresponding to the specific object identification information are still recorded, and the event log of the described object is updated while simplifying the merging operation.

[0041] In an optional implementation, when the first target event attribute information corresponding to the target event merging strategy extracted from the first event log includes the first event type information, and the second target event attribute information corresponding to the target event merging strategy extracted from the second event log includes the second event type information, the first target event attribute information corresponding to the target event merging strategy extracted from the first event log and the second target event attribute information corresponding to the target event merging strategy extracted from the second event log are matched, and according to the matching result, it is determined whether to merge the first event log and the second event log, specifically including:

[0042] When it is determined that the first event type information and the second event type information are the same, determining to merge the first event log and the second event log;

[0043] Alternatively, when it is determined that the first event type information and the second event type information are different, it is determined that the first event log and the second event log are not to be merged.

[0044] Specifically, in the steps of the method, the event type information of the first event log and the second event log are matched, and whether to merge the first event log and the second event log is determined according to the matching result of the event type information. Therefore, different event type information can be set according to different event logs for separate merging, and the first event log and the second event log are merged based on the event type information, so that when the event log array is streamlined, the events generated by the described object corresponding to the specific event type information are still recorded, and the event log of the described object is updated while simplifying the merging operation.

[0045] In an optional implementation, when the first target event attribute information corresponding to the target event merging strategy extracted from the first event log includes the first event object, the first event object identifier, and the first event node identifier, and the second target event attribute information corresponding to the target event merging strategy extracted from the second event log includes the second event object, the second event object identifier, and the second event node identifier, the first target event attribute information corresponding to the target event merging strategy extracted from the first event log and the second target event attribute information corresponding to the target event merging strategy extracted from the second event log are matched, and according to the matching result, it is determined whether to merge the first event log and the second event log, specifically including:

[0046] When it is determined that the first event object is the same as the second event object, the first event object identifier is the same as the second event object identifier, and the first event node identifier is the same as the second event node identifier, determining that the first event log and the second event log are to be merged;

[0047] Alternatively, when the first event object and the second event object are different, and / or the first event object identifier and the second event object identifier, and / or the first event node identifier and the second event node identifier are different, it is determined that the first event log and the second event log are not merged.

[0048] Specifically, in the steps of the method, the event object, event object identifier, and event node identifier of the first event log and the second event log are matched, and it is determined whether to merge the first event log and the second event log according to one or more matching results of the event object, event object identifier, and event node identifier. Therefore, it is possible to generate corresponding merging strategies according to different target event attribute information set for different event logs, and to process whether to merge the first event log and the second event log based on multiple merging strategies, so that the simplified event log array method is more targeted.

[0049] In a second aspect, the present invention provides a device for recording an event log, the device comprising:

[0050] An acquisition module, used to acquire a first event log, wherein the first event log is a newly reported event log, and the event log includes: event attribute information, event identifier, and event merging strategy;

[0051] An extraction module, configured to extract target event attribute information corresponding to the target event merging strategy from the first event log and the second event log respectively, when searching for at least one event log matching the first event log from the event log array according to the event identifier of the first event log and the event attribute information, wherein the second event log is any one of the at least one event log, and the event log array is used to store event logs;

[0052] A matching module is used to match the first target event attribute information corresponding to the target event merging strategy extracted from the above-mentioned first event log with the second target event attribute information corresponding to the above-mentioned target event merging strategy extracted from the above-mentioned second event log, and determine whether to merge the above-mentioned first event log and the above-mentioned second event log based on the matching result.

[0053] The event log recording device provided by the present invention has the following advantages:

[0054] First, the event log carries event attributes, event identifiers, and event merging strategies. According to the event identifier and event attribute information of the newly reported first event log, at least one event log matching the above-mentioned first event log is searched from the event log array. According to the target event merging strategy of the first event log, the target attribute information corresponding to the first event log and the second event log is extracted. The target attribute information of the first event log and the second event log is matched, and it is determined whether to merge the first event log and the second event log according to the matching result. Through the above scheme, according to the event identifier and target attribute information of the newly reported event log, the event log matching in the event log array is searched, and according to the matching situation between the newly reported event log and the event log array, it is determined whether to merge the newly reported event log with the matching event log in the event log array, thereby avoiding excessive or unnecessary event log records, achieving the technical effect of optimizing and streamlining the event log array, and then providing effective support for the subsequent analysis and utilization of the event log.

[0055] In a third aspect, the present invention provides a computer device, comprising: a memory and a processor, the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the event log recording method of the first aspect or any corresponding embodiment thereof by executing the computer instructions.

[0056] In a fourth aspect, the present invention provides a computer-readable storage medium having computer instructions stored thereon, the computer instructions being used to enable a computer to execute the event log recording method of the first aspect or any corresponding embodiment thereof. BRIEF DESCRIPTION OF THE DRAWINGS

[0057] In order to more clearly illustrate the specific implementation methods of the present invention or the technical solutions in the prior art, the drawings required for use in the specific implementation methods or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are some implementation methods of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0058] Figure 1 It is a flowchart of a method for recording an event log according to an embodiment of the present invention.

[0059] Figure 2 It is a flowchart of another event log recording method according to an embodiment of the present invention.

[0060] Figure 3 This is one of the event log array schematic diagrams of the event log recording method according to an embodiment of the present invention.

[0061] Figure 4 This is a second schematic diagram of an event log array of the event log recording method according to an embodiment of the present invention.

[0062] Figure 5 Schematic diagram of a device for recording an event log according to an embodiment of the present invention.

[0063] Figure 6 It is a schematic diagram of the hardware structure of a computer device according to an embodiment of the present invention. DETAILED DESCRIPTION

[0064] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative work are within the scope of protection of the present invention.

[0065] According to an embodiment of the present invention, an embodiment of a method for recording an event log is provided. It should be noted that the steps shown in the flowchart of the accompanying drawings can be executed in a computer system such as a set of computer executable instructions, and although a logical order is shown in the flowchart, in some cases, the steps shown or described can be executed in an order different from that shown here.

[0066] In this embodiment, a method for recording an event log is provided, which can be used for the above-mentioned server. Figure 1 is a flow chart of a method for recording an event log according to an embodiment of the present invention. Figure 1 shown.

[0067] Before introducing the method embodiment, the event types that may be introduced later in the embodiment of the present application are first explained. The event types may include, for example, five types: fault events, alarm events, information events, configuration events, and derived events.

[0068] Among them, fault events refer to unexpected errors, failures or abnormal conditions that occur in the system or application.

[0069] Alert events: refers to a state or condition discovered during the operation of the system or application, which may indicate potential problems or situations that require attention.

[0070] Information events: refers to general information recording events in the system, which do not involve exceptions or warnings. Such events usually include the recording of the status and operation information during the system operation process, so as to facilitate subsequent analysis and monitoring of the normal operation of the system.

[0071] Configuration events: mainly used to record system configuration changes and parameter adjustment information. These events are very important for tracking changes in system configuration for auditing, troubleshooting, and version control.

[0072] Derived events: These events are causally related to other events and are likely to occur only after other events are triggered. The event log records a server crash (event A), which may further record the website downtime caused by the server crash (event B), and user complaints caused by the website downtime (event C). These events can be used to quickly identify the root cause of the problem.

[0073] In the embodiment of the present application, taking the above event type as an example, the event log corresponding to the above event type is obtained.

[0074] Each event is accompanied by key information that helps describe and understand each event. For details, please refer to the following, which may include one or more of the following information:

[0075] Event Type: The five event types defined above.

[0076] Event object name and its identifier: The type of object involved in the event, such as a disk, cabinet, node, cluster, or a module in the system. Detailed event object classification is more conducive to the analysis of event logs.

[0077] Event sequence number: Each time a new event is reported and entered into the event log array, the sequence number is increased by 1 to reflect the number of reported events.

[0078] Event root sequence number: The root sequence is mainly used for derived events. When reporting derived events, you need to enter the sequence of the root event. When reporting non-derived events, the sequence is the default value 0 or empty.

[0079] Event reporting time: system time when the event is reported.

[0080] Event detailed data: Event data is a user-defined string that can carry more detailed event information. For the same event, different event data can be carried to facilitate more accurate identification of event reporting scenarios. It can also be empty.

[0081] Event status: The status of the event can be presented in the form of a bit array, where each bit identifies a status, such as the alarm usage status, repair status, expiration status, etc., which can be expanded as needed.

[0082] Specifically, the process includes the following steps:

[0083] Step S101, obtaining a first event log.

[0084] The first event log is a newly reported event log. The first event log includes: event attribute information, event identifier and event merging strategy. In one implementation, the first event log is obtained from a business system.

[0085] The above event attribute information can be the basic attributes of the event log determined by the business system according to the business logic to describe the event, or it can be the information that supplements the event description when reporting the event. The event identifier is the unique identifier of the event, which is used to distinguish event logs. The event merging strategy can be a pre-set scheme for determining how to merge the newly reported event log with the event log in the event log array.

[0086] Step S102, when searching for at least one event log matching the first event log from the event log array based on the event identifier of the first event log and the event attribute information, according to the target event merging strategy corresponding to the first event log, extract the target event attribute information corresponding to the target event merging strategy from the first event log and the second event log respectively.

[0087] In order to enter the first event log into the event log array, it is first determined whether the first event log can be merged with the event log with the same event identifier in the event log array. The merging strategy determines which event attribute information is used for the judgment. Therefore, it is necessary to search for at least one event log that matches the first event log from the event log array based on the event identifier of the first event log and the event attribute information. Specifically, the at least one event log that matches has the same event identifier as the first event log.

[0088] The second event log is any one of the at least one event log, and the event log array is used to store event logs.

[0089] There may be one or more event logs in the above event log array that match the first event log in terms of event identification and event attribute information. Therefore, it is necessary to determine the judgment indicator corresponding to the first event log from the target event merging strategy, that is, based on which specific event attribute information the judgment is made, so it is necessary to extract the above target attribute information.

[0090] Step S103, matching the first target event attribute information corresponding to the target event merging strategy extracted from the first event log with the second target event attribute information corresponding to the target event merging strategy extracted from the second event log, and determining whether to merge the first event log and the second event log based on the matching result.

[0091] The above-mentioned matching process can be carried out by comparing the calculated hash values ​​of the first target event attribute information and the second target event attribute information to determine whether the two are the same. After obtaining the same matching results for the two, the information corresponding to the second event log can be replaced by the information of the newly reported event log except the first target event attribute and the event identifier, and the information of the newly reported event log can be entered into the event log array to realize the merging of the above-mentioned first event log and the above-mentioned second event log.

[0092] The event log recording method provided by the present invention has the following advantages:

[0093] First, the event log carries event attributes, event identifiers, and event merging strategies. According to the event identifier and event attribute information of the newly reported first event log, at least one event log matching the above-mentioned first event log is searched from the event log array. According to the target event merging strategy of the first event log, the target attribute information corresponding to the first event log and the second event log is extracted. The target attribute information of the first event log and the second event log is matched, and it is determined whether to merge the first event log and the second event log according to the matching result. Through the above scheme, according to the event identifier and target attribute information of the newly reported event log, the event log matching in the event log array is searched, and according to the matching situation between the newly reported event log and the event log array, it is determined whether to merge the newly reported event log with the event log matching in the event log array, thereby avoiding excessive or unnecessary event log records, achieving the technical effect of optimizing and streamlining the event log array, and then improving the reliability and security of the event log, and enhancing the maintainability and operation and maintenance efficiency of the system, and being able to more effectively cope with challenges and changes in complex system environments.

[0094] In an optional implementation, in order to further optimize the event logs of different event attribute information, the event attribute information includes: event status and event reporting time, according to the event identifier of the first event log and the event attribute information, search the event log array for an event log that matches the first event log. Figure 2 FIG. 1 is a flow chart of another method for recording an event log according to an embodiment of the present invention. Figure 2 As shown, including:

[0095] Step S1011, according to the event status and the event reporting time, searching from the event log array whether there is an event log whose event reporting time is earlier than the event reporting time of the first event log and whose event status is unrepaired.

[0096] There may be multiple event logs that need to be recorded in the event log array in parallel, and the progress of each recording process is not necessarily the same. It is possible that the event log reported after the first event log has been recorded before the first event log. In order to avoid conflicts in the merging process when recording events, it is necessary to select the event log whose event reporting time is before the first event log from the event log array for matching.

[0097] The above-mentioned event log array can be a structure array, and the event status and event reporting time can be array elements defined in the structure array. When searching for the event reporting time and the event status, it can be through traversing the array elements corresponding to the event reporting time and the event status in the structure array, and then by comparing with the set array element value, it can be determined that the event reporting time is earlier than the event reporting time of the above-mentioned first event log, and the event status is an unrepaired state. Event log.

[0098] Step S1012, when it is determined that there is a candidate event log whose event reporting time is earlier than the event reporting time of the above-mentioned first event log and whose event status is an unrepaired state, search from the above-mentioned candidate event logs whether there is a target event log with the same identifier as the above-mentioned first event log as the event log that matches the above-mentioned first event log.

[0099] The candidate event log whose reporting time is earlier than the event reporting time of the first event log and whose event status is unrepaired can be a historical record of the same system problem, which will continuously generate new reported event logs of unrepaired status, so the unrepaired event log is selected in the event log array for matching. The first event log is the latest record corresponding to the system problem, so it can be further determined whether to merge the first event log with the candidate event log, that is, to use the candidate event log with the same identifier as the first event log as the target event log, so as to avoid repeated recording in the event log array after the unrepaired problem event is periodically reported, occupying the event log array space and interfering with the use of subsequent event log arrays.

[0100] Specifically, in the method steps, the event attribute information includes the event state and the event reporting time, and the above-mentioned searching for an event log matching the above-mentioned first event log from the event log array according to the event identifier of the first event log and the above-mentioned event attribute information specifically includes:

[0101] According to the event status and event reporting time, search the event log array for event data whose event status is unrepaired and whose event reporting time is earlier than that of the first event log. If a candidate event log is found whose event reporting time is earlier than that of the first event log and whose event status is unrepaired, determine the target event log with the same identifier as the first event log from the candidate events.

[0102] The unrepaired state refers to a state in which a fault or alarm event is presented in the form of a bit array and has not been repaired.

[0103] The method provided in this embodiment matches the event logs in the event log array that have not been repaired and whose reporting time is earlier than the event reporting time of the first event log with the event identifier of the first event log, and uses the target event log with the same identifier as the first event log as the event log that matches the first event log. This achieves the merging of the unrepaired events reported multiple times, and achieves the technical effect of further streamlining the event log array.

[0104] In an optional implementation, in order to further optimize the event logs of different event attribute information in a targeted manner, the event attribute information further includes: event type. The method further includes:

[0105] When it is determined that there is no event log matching the first event log in the event log array, a target array element whose event status is unused is searched from the event log array, and the first event log is stored in the target array element.

[0106] The above event types may be alarm, information, fault, etc. Different event types may correspond to different priorities and corresponding processing strategies may be different. Therefore, event type, an event attribute information, is introduced.

[0107] Alternatively, when it is determined that there is no array element with an event status of unused in the event log array, the event reporting time of the event log corresponding to each event type is searched.

[0108] The target event log is selected according to the event reporting time of the event log corresponding to each event type, the priority corresponding to the above event type, and one or more event attribute information in the above event status.

[0109] In the case that there is no matching event log, first find unused array elements, and then consider overwriting the event log in the event log array. There are multiple event logs in the event log array, which can be different reporting times, priorities, and event statuses. Therefore, it is necessary to comprehensively consider the reporting time, priority, and event status to select the target event log to be overwritten at the first time.

[0110] The first event log is overwritten and stored in the array element to which the target event log belongs.

[0111] Specifically, in the steps of the method, the event attribute information includes the event type, and the event log matching the first event log is searched from the event log array, but when it is determined that there is no matching event log, the target array element whose event type is unused is searched from the event log array, and the first event log is stored in the target array element. Or when no unused array element is found, the reporting time of the event log corresponding to each event type is searched, and the target event log is selected according to the event reporting time of the event log corresponding to each event type, the priority corresponding to the event type, and one or more event attribute information in the event state.

[0112] Through the above scheme, when there is no event log matching the first event log in the event log array, the unused target array element and the above first event log are stored in the target array element according to the event status in the event log array. When the unused target array element is not found, the event reporting time of the event log of each event type is searched, and the target event log is selected according to the event reporting time of the event log corresponding to each event type, the priority corresponding to the above event type, and one or more event attribute information in the above event status. Thereby, the newly reported event logs that cannot be merged for multiple times are stored in the unused target array elements, or the newly reported event logs overwrite the earliest repaired event logs, thereby avoiding the continuous growth of the event logs, and clearing the event log array while entering the newly reported event logs, so as to achieve the technical effect of further streamlining or clearing the event log array.

[0113] In an optional implementation, in order to further optimize the coverage mode of the event log array, the target event log is selected according to the event reporting time of the event log corresponding to each event type, the priority corresponding to the above event type, and one or more event attribute information in the above event state, specifically including:

[0114] According to the event status of each event log, it is identified whether there is a repaired event log in the event log array.

[0115] The repaired event log has the lowest priority, and the first event log may be given priority to overwriting the repaired event log.

[0116] When it is determined that there is a repaired event log, and the repaired event log is not the earliest reported event log of the first preset type, or is not an event log of the second preset type, the earliest repaired event log among the repaired event logs is selected as the above-mentioned target event log.

[0117] When there are multiple repaired event logs, priority may be given to overwriting the earliest repaired event log, but fault events need to be retained and cannot be overwritten, that is, the first preset type is the fault event log.

[0118] Alternatively, when it is determined that no repaired event log exists, the event type of each event log in the event log array is identified.

[0119] In the case where there is no repaired event log in the event log array, it is necessary to determine the event type of each event log and perform further processing based on the event type.

[0120] Alternatively, when the existence of an event log of a third preset type and / or an event log of a fourth preset type is identified, the event log corresponding to the earliest event reporting time in the event log of the third preset type and / or the event log of the fourth preset type is selected as the target event log.

[0121] The event logs of the third preset type and the fourth preset type may be information type and configuration type event logs, and such events may be overwritten if they are not repaired, but the earliest reported event will be overwritten first.

[0122] Alternatively, when the event log array does not include event logs of the third preset type and event logs of the fourth preset type, but includes event logs of the first preset type, then the event logs of the first preset type, except for the event log with the earliest event reporting time, are selected as the target event logs.

[0123] The above situation may be that only the event log of the first preset type remains in the event log array, and the event logs other than the earliest reported event log may be overwritten by the first event log. The first preset type may be a fault event. The earliest reported fault event is the root cause of the fault or alarm event, and therefore needs to be retained.

[0124] Alternatively, when the event log array includes only event logs of the second preset type and / or includes event logs of the first preset type with the earliest event reporting time, event prompt information indicating that the log is full is generated.

[0125] When only the event log of the second preset type and / or the event log with the earliest event reporting time of the first preset type remain in the event log array, the first event log cannot be recorded any further. At this time, it is necessary to generate an event prompt message indicating that the log is full to indicate that the event log array is full. The event prompt message can be stored in a fixed reserved position of the event log array so that it can be reported together with the event log array.

[0126] Specifically, in the steps of the method, the earliest repaired event log is overwritten according to the priority of the event to prevent the repaired event log from occupying the space of the event log array, and the earliest reported event log is further overwritten to prevent outdated information or configuration events from occupying the space of the event log array, thereby solving the problem that continuous recording of events may lead to the continuous growth of event logs, effectively controlling the number of logs and ensuring the analyzability and continuity of application of logs.

[0127] In an optional implementation, in order to further optimize the merging method of the event log array, when the first target event attribute information corresponding to the target event merging strategy extracted from the above-mentioned first event log includes a first root sequence, a first object type, and a first object identification information, and the second target event attribute information corresponding to the target event merging strategy extracted from the above-mentioned second event log includes a second root sequence, a second object type, and a second object identification information, the first target event attribute information corresponding to the target event merging strategy extracted from the above-mentioned first event log and the second target event attribute information corresponding to the target event merging strategy extracted from the above-mentioned second event log are matched, and according to the above-mentioned matching result, it is determined whether to merge the above-mentioned first event log and the above-mentioned second event log, specifically including:

[0128] When it is determined that the first root sequence is the same as the second root sequence, the first object type is the same as the second object type, and the first object identification information is the same as the second object identification information, it is determined that the first event log and the second event log are to be merged.

[0129] The first root sequence may be the sequence number of the event log corresponding to the root cause of the event log (i.e., the root event that triggered the event log), which is used to indicate the root cause of the event log. The first object type may be the type of the object described in the event log, such as server node, disk, cluster, cabinet, etc., which is used to indicate the recording target of the event log. The first object identification information may be the number of the object described, such as node 1, node 2, cluster 1, cabinet 2, which is used to distinguish the recording targets of the same object type.

[0130] Alternatively, when the first root sequence and the second root sequence are different, and / or the first object type and the second object type are different, and / or the first object identification information and the second object identification information are different, it is determined that the first event log and the second event log are not to be merged.

[0131] The event merging strategy requires that the root sequence, object type, and object identification information are all the same before the first event log and the second event log can be merged. If any of them are different, they cannot be merged, thereby improving the rigor of event log merging.

[0132] Specifically, in the steps of the method, the root sequence, object type, and object identification information of the first event log and the second event log are matched, and it is determined whether to merge the first event log and the second event log according to one or more matching results of the root sequence, object type, and object identification information. Therefore, it is possible to generate corresponding merging strategies according to different target event attribute information set for different event logs, and to process whether to merge the first event log and the second event log based on multiple merging strategies, so that the simplified event log array method is more targeted.

[0133] In an optional implementation, in order to further optimize the merging method of the event log array, when the first target event attribute information corresponding to the target event merging strategy extracted from the above-mentioned first event log includes the first object identification information, and the second target event attribute information corresponding to the target event merging strategy extracted from the above-mentioned second event log includes the second object identification information, the first target event attribute information corresponding to the above-mentioned target event merging strategy extracted from the above-mentioned first event log and the second target event attribute information corresponding to the above-mentioned target event merging strategy extracted from the above-mentioned second event log are matched, and according to the above-mentioned matching result, it is determined whether to merge the above-mentioned first event log and the above-mentioned second event log, specifically including:

[0134] When it is determined that the first object identification information and the second object identification information are the same, it is determined that the first event log and the second event log are merged.

[0135] Alternatively, when it is determined that the first object identification information and the second object identification information are different, it is determined that the first event log and the second event log are not to be merged.

[0136] The above event merging strategy is that some newly reported event types only need to match the object identification information. For example, if multiple IO timeouts occur on the same volume, multiple timeout events will be reported, which can be merged. The entire cluster shares the volume, so only the object identification information needs to be matched. This allows for quick merging, judgment, and processing of event logs.

[0137] Specifically, in the steps of the method, the object identification information of the first event log and the second event log are matched, and whether to merge the first event log and the second event log is determined according to the matching result of the object identification information. Therefore, different object identification information can be set according to different event logs for separate merging, and the first event log and the second event log are merged based on the object identification information, so that when the event log array is streamlined, the events generated by the described object corresponding to the specific object identification information are still recorded, and the event log of the described object is updated while simplifying the merging operation.

[0138] In an optional implementation, in order to further optimize the merging method of the event log array, when the first target event attribute information corresponding to the target event merging strategy extracted from the above-mentioned first event log includes the first event type information, and the second target event attribute information corresponding to the target event merging strategy extracted from the above-mentioned second event log includes the second event type information, the first target event attribute information corresponding to the target event merging strategy extracted from the above-mentioned first event log and the second target event attribute information corresponding to the target event merging strategy extracted from the above-mentioned second event log are matched, and according to the above-mentioned matching result, it is determined whether to merge the above-mentioned first event log and the above-mentioned second event log, specifically including:

[0139] When it is determined that the first event type information and the second event type information are the same, it is determined that the first event log and the second event log are merged.

[0140] Alternatively, when it is determined that the first event type information and the second event type information are different, it is determined that the first event log and the second event log are not to be merged.

[0141] The above event merging strategy is that some newly reported event types only need to match the object identification information, for example, arbitration service software update, certificate update, etc. There will only be one object in the cluster at the same time, so there is no need to match the object type (such as node) and object identification. Therefore, the event log merging judgment and processing can be quickly performed.

[0142] Specifically, in the steps of the method, the event type information of the first event log and the second event log are matched, and whether to merge the first event log and the second event log is determined according to the matching result of the event type information. Therefore, different event type information can be set according to different event logs for separate merging, and the first event log and the second event log are merged based on the event type information, so that when the event log array is streamlined, the events generated by the described object corresponding to the specific event type information are still recorded, and the event log of the described object is updated while simplifying the merging operation.

[0143] In an optional implementation, in order to further optimize the merging method of the event log array, when the first target event attribute information corresponding to the target event merging strategy extracted from the above-mentioned first event log includes the first event object, the first event object identifier, and the first event node identifier, and the second target event attribute information corresponding to the target event merging strategy extracted from the above-mentioned second event log includes the second event object, the second event object identifier, and the second event node identifier, the first target event attribute information corresponding to the target event merging strategy extracted from the above-mentioned first event log and the second target event attribute information corresponding to the target event merging strategy extracted from the above-mentioned second event log are matched, and according to the above-mentioned matching result, it is determined whether to merge the above-mentioned first event log and the above-mentioned second event log, specifically including:

[0144] When it is determined that the first event object is the same as the second event object, the first event object identifier is the same as the second event object identifier, and the first event node identifier is the same as the second event node identifier, it is determined that the first event log and the second event log are merged.

[0145] Alternatively, when the first event object and the second event object are different, and / or the first event object identifier and the second event object identifier, and / or the first event node identifier and the second event node identifier are different, it is determined that the first event log and the second event log are not merged.

[0146] The above event merging strategy requires that the event object, event object identifier, and event node identifier are all the same before the above first event log and the above second event log can be merged. If any of them are different, they cannot be merged, thereby improving the rigor of event log merging. For example, serial channel, fiber channel and other related events. Each node card is independent of each other, so it is necessary to match the node identifier and object identifier at the same time.

[0147] Specifically, in the steps of the method, the event object, event object identifier, and event node identifier of the first event log and the second event log are matched, and it is determined whether to merge the first event log and the second event log according to one or more matching results of the event object, event object identifier, and event node identifier. Therefore, it is possible to generate corresponding merging strategies according to different target event attribute information set for different event logs, and to process whether to merge the first event log and the second event log based on multiple merging strategies, so that the simplified event log array method is more targeted.

[0148] To further illustrate the use process of the event log recording method of the present invention, the following is an explanation in conjunction with two states of the event log array. Figure 3 FIG. 1 is one of the event log array schematic diagrams of the event log recording method according to an embodiment of the present invention, such as Figure 3 As shown, the event log array includes elements such as sequence, event identifier, event type, object name and object tag, event merging strategy, root sequence, event status, event reporting time, etc.

[0149] The event log array size is such that it can store up to five event logs. Currently, there are three event logs stored. The event log at the first position has a sequence of 1, an event ID of 111, an event type of information event, an object name and object ID of disk / 1, an event merge strategy of no merge, a root sequence of 0 (i.e., no root event exists), an event status of in use and unrepaired, and an event reporting event of 16:20:30. The event log at the second position has a sequence of 2, an event ID of 222, an event type of alarm event, an object name and object ID of cabinet / 2, an event merge strategy of object ID merge, a root sequence of 0, an event status of in use and unrepaired, and an event reporting event of 16:20:31. The sequence of the event log at the third position is 3, the event ID is 333, the event type is a fault event, the object name and object ID are node / 1, the event merge strategy is object ID merge, the root sequence is 2 (that is, the second event log is the root cause of the third event log), the event status is used and not repaired, and the event reporting time is 16:20:31. Among them, the fourth position is an unused blank event log. The fifth position is a full event dedicated to reporting the event log array.

[0150] exist Figure 3Based on the event log array shown, at 16:20:40, cabinet 2 reported the fourth event with event identifier 222, and the merge strategy was merge based on object identifier. By traversing the event log array, it is found that the object identifier of the event log at the second position mentioned above is consistent with the merge strategy of the fourth event, so the event data of the fourth event can replace the second position, and the corresponding event reporting time can be updated. At 16:20:45, node 2 reported the fifth event with event identifier 333, and the merge strategy was merge based on object identifier. By traversing the event log array, it is found that there is no event log that meets the merge strategy, so the fifth event is recorded in the fourth position of the event log array.

[0151] At 16:20:50, disk 2 reported the fifth event of the fault class with event identifier 444 and the merge strategy was object identifier merge. After traversing the event log array, it was found that there was no event log that met the merge strategy and there was no unused position. However, the first position of the event log array was an information event. Therefore, the fifth event can overwrite the event log at the first position of the event log array.

[0152] At 16:20:55, disk 3 reports the sixth event with event ID 555. After traversing the event log array, it is found that there is no event log that can be overwritten or merged. Therefore, the sixth event cannot be recorded in the event log array. At this time, it is necessary to enter the full event of the event log array with sequence number 6, leave ID 666, event type alarm, object name and object ID cluster / 1, event merging strategy not merged, root sequence 0, and event status used and unrepaired in the fifth position of the full event dedicated to reporting the event log array, and use the reporting time of the sixth event 16:20:55 as the event reporting time of the full event.

[0153] Finally get Figure 4 The event log array shown, Figure 4 FIG. 2 is a second schematic diagram of an event log array of a method for recording an event log according to an embodiment of the present invention. Figure 4 As shown, it includes: fault events at the first position, the third position, and the fourth position, a full event of the event log array at the sixth position, and an alarm event at the second position (as the root event of the event at the third position).

[0154] In an optional implementation, in order to further optimize the merging strategy of the event log array, there are multiple event merging strategies for the above event log array, specifically: first, in the event merging process, a multidimensional matching model is constructed based on the event attribute information of the first event log and the second event log. The model considers multiple dimensions such as event type, event status, reporting time and priority. Secondly, each dimension is scored using a weighted algorithm, and a comprehensive score is generated to determine the priority of the merge. Finally, based on the results of the comprehensive score, a specific strategy for merging or not is selected, and a detailed merge report is generated after the merge, including the reason for the merge, the event log identifiers involved, and the attribute information of the new event log after the merge, to ensure the transparency and auditability of the merge process.

[0155] In this embodiment, a recording device for an event log is also provided, which is used to implement the above-mentioned embodiments and preferred implementation modes, and the descriptions that have been made will not be repeated. As used below, the term "module" can implement a combination of software and / or hardware of a predetermined function. Although the devices described in the following embodiments are preferably implemented in software, the implementation of hardware, or a combination of software and hardware, is also possible and conceivable.

[0156] This embodiment provides a device for recording an event log, which is applied to a server. Figure 5 is a schematic diagram of a recording device for an event log according to an embodiment of the present invention, such as Figure 5 As shown, the above device comprises:

[0157] The acquisition module 501 is used to acquire a first event log, where the first event log is a newly reported event log.

[0158] The above event log includes: event attribute information, event identification and event merging strategy.

[0159] The extraction module 502 is used to extract the target event attribute information corresponding to the target event merging strategy from the first event log and the second event log respectively, based on the target event merging strategy corresponding to the first event log, when searching for at least one event log matching the first event log from the event log array according to the event identifier of the first event log and the event attribute information.

[0160] The second event log is any one of the at least one event log, and the event log array is used to store event logs.

[0161] The matching module 503 is used to match the first target event attribute information corresponding to the target event merging strategy extracted from the above-mentioned first event log, and the second target event attribute information corresponding to the above-mentioned target event merging strategy extracted from the above-mentioned second event log, and determine whether to merge the above-mentioned first event log and the above-mentioned second event log based on the matching result.

[0162] In an optional implementation, the event attribute information includes: event status and event reporting time, and the extraction module 502 includes:

[0163] The first search unit is used to search from the event log array whether there is an event log whose event reporting time is earlier than the event reporting time of the first event log and whose event status is unrepaired according to the event status and the event reporting time.

[0164] The second search unit is used to search from the candidate event logs whether there is a target event log with the same identifier as the first event log, as an event log that matches the first event log, when it is determined that there is a candidate event log whose event reporting time is earlier than the event reporting time of the first event log and whose event status is an unrepaired state.

[0165] Specifically, in the steps of the method, the event attribute information includes the event status and the event reporting time. According to the event identifier of the first event log and the event attribute information, the event log matching the first event log is searched from the event log array. Specifically, according to the event status and the event reporting time, the event data whose event status is unrepaired and whose event reporting time is earlier than the first event log is searched from the event log array. After finding the candidate event log whose event reporting time is earlier than the event reporting time of the first event log and whose event status is unrepaired, the target event log with the same identifier as the first event log is searched from the candidate events. Through the above method, by matching the event log in the event log array that is unrepaired and whose reporting time is earlier than the event reporting time of the first event log with the event identifier of the first event log, the target event log with the same identifier as the first event log is used as the event log matching the first event log. Thereby, the unrepaired events reported multiple times are merged, and the technical effect of further streamlining the event log array is achieved.

[0166] In an optional implementation manner, the event attribute information further includes: event type. The device further includes:

[0167] The storage module is used to search for a target array element whose event status is unused from the event log array when it is determined that there is no event log matching the first event log in the event log array, and store the first event log in the target array element.

[0168] Alternatively, the reporting time module is used to search for the event reporting time of the event log corresponding to each event type when it is determined that there is no array element with an event status of unused in the above event log array.

[0169] The target event log is selected according to the event reporting time of the event log corresponding to each event type, the priority corresponding to the above event type, and one or more event attribute information in the above event status.

[0170] The first overwriting module is used to overwrite and store the first event log into the array element to which the target event log belongs.

[0171] Specifically, in the steps of the method, the event attribute information includes the event type, and the event log matching the above-mentioned first event log is searched from the event log array, but when it is determined that there is no matching event log, the target array element whose event type is unused is searched from the event log array, and the above-mentioned first event log is stored in the above-mentioned target array element. Or when the unused array element is not found, the reporting time of the event log corresponding to each event type is searched, and the target event log is selected according to the event reporting time of the event log corresponding to each event type, the priority corresponding to the above-mentioned event type, and one or more event attribute information in the above-mentioned event state. Through the above scheme, when there is no event log matching the first event log in the event log array, the unused target array element and the above-mentioned first event log are stored in the target array element according to the event state in the event log array. When the unused target array element is not found, the event reporting time of the event log of each event type is searched, and the target event log is selected according to the event reporting time of the event log corresponding to each event type, the priority corresponding to the above-mentioned event type, and one or more event attribute information in the above-mentioned event state. This allows newly reported event logs that cannot be merged multiple times to be stored in unused target array elements, or the newly reported event logs overwrite the earliest repaired event logs, thereby achieving the technical effect of further streamlining or cleaning up the event log array.

[0172] In an optional implementation, the device is further configured to select a target event log according to the event reporting time of the event log corresponding to each event type, the priority corresponding to the event type, and one or more event attribute information in the event state, specifically including:

[0173] The first identification module is used to identify whether there is a repaired event log in the event log array according to the event status of each event log.

[0174] The first preset selection module is used to select the earliest repaired event log among the repaired event logs as the above-mentioned target event log when it is determined that there is a repaired event log and the repaired event log is not the earliest reported event log of the first preset type, or is not an event log of the second preset type.

[0175] or,

[0176] The second identification module is used to identify the event type of each event log in the event log array when it is determined that there is no repaired event log.

[0177] or,

[0178] The second preset selection module is used to select the event log corresponding to the earliest event reporting time in the event log of the third preset type and / or the event log of the fourth preset type as the above-mentioned target event log when the existence of the event log of the third preset type and / or the event log of the fourth preset type is identified.

[0179] or,

[0180] The third preset selection module is used to select the event logs of the first preset type except the event log with the earliest event reporting time among the event logs of the first preset type as the target event logs when the event log array does not include the event logs of the third preset type and the event logs of the fourth preset type, but includes the event logs of the first preset type.

[0181] or,

[0182] The fourth preset selection module is used to generate a log full event prompt message when the event log array only includes event logs of the second preset type and / or includes event logs of the first preset type with the earliest event reporting time.

[0183] Specifically, in the steps of the method, it is determined whether there is a repaired event log in the event log array according to the event status of the event log, and the event log that is not the first preset type and is not the earliest repaired event log in the repaired event log is used as the above-mentioned target event log. Or in the case where there is no repaired event log, the event type of each event log in the event log array is identified. Or when it is identified that there is an event log of the third preset type and / or the fourth preset type, the event log corresponding to the earliest event reporting time in the event log of the third preset type and / or the event log of the fourth preset type is used as the above-mentioned target event log. Or when the event log of the third preset type and the event log of the fourth preset type do not exist, the event log of the first preset type except the event log with the earliest reporting time is used as the above-mentioned target event log. Or when there is only the event log of the second preset type left in the event log array, and / or the event log with the earliest reporting time of the first preset type is included, an event prompt message indicating that the log is full is generated. Through the above steps, the event logs in the log array are divided into multiple preset types, and different processing is performed based on different preset types. Thereby, the event log array can be streamlined without damaging the preservation of important event logs in the event log array.

[0184] In an optional implementation, the device is further used for matching the first target event attribute information corresponding to the target event merging strategy extracted from the first event log and the second target event attribute information corresponding to the target event merging strategy extracted from the second event log when the first target event attribute information corresponding to the target event merging strategy extracted from the first event log includes a first root sequence, a first object type, and a first object identification information, and the second target event attribute information corresponding to the target event merging strategy extracted from the second event log includes a second root sequence, a second object type, and a second object identification information, and determining whether to merge the first event log and the second event log according to the matching result, specifically including:

[0185] The first determination module is used to determine that the first event log and the second event log are to be merged when it is determined that the first root sequence is the same as the second root sequence, the first object type is the same as the second object type, and the first object identification information is the same as the second object identification information.

[0186] Alternatively, a second determination module is used to determine that the first event log and the second event log are not to be merged when the first root sequence and the second root sequence are different, and / or the first object type and the second object type are different, and / or the first object identification information and the second object identification information are different.

[0187] Specifically, in the steps of the method, the root sequence, object type, and object identification information of the first event log and the second event log are matched, and it is determined whether to merge the first event log and the second event log according to one or more matching results of the root sequence, object type, and object identification information. Therefore, it is possible to generate corresponding merging strategies according to different target event attribute information set for different event logs, and to process whether to merge the first event log and the second event log based on multiple merging strategies, so that the simplified event log array method is more targeted.

[0188] In an optional implementation, the device is further used for matching the first target event attribute information corresponding to the target event merging strategy extracted from the first event log and the second target event attribute information corresponding to the target event merging strategy extracted from the second event log when the first target event attribute information corresponding to the target event merging strategy extracted from the first event log includes the first object identification information, and the second target event attribute information corresponding to the target event merging strategy extracted from the second event log includes the second object identification information, and determining whether to merge the first event log and the second event log according to the matching result, specifically including:

[0189] A third determination module, configured to determine to merge the first event log and the second event log when it is determined that the first object identification information and the second object identification information are the same;

[0190] Alternatively, the fourth determination module is configured to determine not to merge the first event log and the second event log when it is determined that the first object identification information and the second object identification information are different.

[0191] Specifically, in the steps of the method, the object identification information of the first event log and the second event log are matched, and whether to merge the first event log and the second event log is determined according to the matching result of the object identification information. Therefore, different object identification information can be set according to different event logs for separate merging, and the first event log and the second event log are merged based on the object identification information, so that the object identification information is not lost when the event log array is streamlined.

[0192] In an optional implementation, the device is further used for matching the first target event attribute information corresponding to the target event merging strategy extracted from the first event log and the second target event attribute information corresponding to the target event merging strategy extracted from the second event log when the first target event attribute information corresponding to the target event merging strategy extracted from the first event log includes the first event type information, and the second target event attribute information corresponding to the target event merging strategy extracted from the second event log includes the second event type information, and determining whether to merge the first event log and the second event log based on the matching result, specifically including:

[0193] The fifth determination module is further configured to determine to merge the first event log and the second event log when it is determined that the first event type information and the second event type information are the same.

[0194] Alternatively, the sixth determination module is further configured to determine not to merge the first event log and the second event log when it is determined that the first event type information and the second event type information are different.

[0195] Specifically, in the steps of the method, the event type information of the first event log and the second event log are matched, and whether to merge the first event log and the second event log is determined according to the matching result of the event type information. Therefore, different event type information can be set according to different event logs for separate merging, and the first event log and the second event log are merged based on the event type information, so that the event type information is not lost when the event log array is streamlined.

[0196] In an optional implementation, the device is further used for matching the first target event attribute information corresponding to the target event merging strategy extracted from the first event log with the second target event attribute information corresponding to the target event merging strategy extracted from the second event log when the first target event attribute information corresponding to the target event merging strategy extracted from the first event log includes the first event object, the first event object identifier, and the first event node identifier, and the second target event attribute information corresponding to the target event merging strategy extracted from the second event log includes the second event object, the second event object identifier, and the second event node identifier, and determining whether to merge the first event log and the second event log based on the matching result, specifically including:

[0197] The seventh determination module is also used to determine that the first event log and the second event log are to be merged when it is determined that the first event object is the same as the second event object, the first event object identifier is the same as the second event object identifier, and the first event node identifier is the same as the second event node identifier.

[0198] Alternatively, the eighth determination module is also used to determine that the first event log and the second event log are not to be merged when the first event object and the second event object are different, and / or the first event object identifier and the second event object identifier, and / or the first event node identifier and the second event node identifier are different.

[0199] Specifically, in the steps of the method, the event object, event object identifier, and event node identifier of the first event log and the second event log are matched, and it is determined whether to merge the first event log and the second event log according to one or more matching results of the event object, event object identifier, and event node identifier. Therefore, it is possible to generate corresponding merging strategies according to different target event attribute information set for different event logs, and to process whether to merge the first event log and the second event log based on multiple merging strategies, so that the simplified event log array method is more targeted.

[0200] The event log recording device provided by the present invention has the following advantages:

[0201] First, the event log carries event attributes, event identifiers, and event merging strategies. According to the event identifier and event attribute information of the newly reported first event log, at least one event log matching the above-mentioned first event log is searched from the event log array. According to the target event merging strategy of the first event log, the target attribute information corresponding to the first event log and the second event log is extracted. The target attribute information of the first event log and the second event log is matched, and it is determined whether to merge the first event log and the second event log according to the matching result. Through the above scheme, according to the event identifier and target attribute information of the newly reported event log, the event log matching in the event log array is searched, and according to the matching situation between the newly reported event log and the event log array, it is determined whether to merge the newly reported event log with the event log matching in the event log array, thereby avoiding excessive or unnecessary event log records, achieving the technical effect of optimizing and streamlining the event log array, and then improving the reliability and security of the event log, and enhancing the maintainability and operation and maintenance efficiency of the system, and being able to more effectively cope with challenges and changes in complex system environments.

[0202] The further functional description of each of the above modules and units is the same as that of the above corresponding embodiments and will not be repeated here.

[0203] The event log recording device in this embodiment is presented in the form of a functional unit, where the unit refers to an ASIC (Application Specific Integrated Circuit) circuit, a processor and memory that executes one or more software or fixed programs, and / or other devices that can provide the above functions.

[0204] The embodiment of the present invention also provides a computer device having the above Figure 5 The event log of the recording device is shown.

[0205] See also Figure 6 , Figure 6 is a schematic diagram of the structure of a computer device provided by an optional embodiment of the present invention, such as Figure 6 As shown, the computer device includes: one or more processors 10, a memory 20, and interfaces for connecting various components, including high-speed interfaces and low-speed interfaces. Various components are connected to each other using different buses for communication, and can be installed on a common mainboard or installed in other ways as needed. The processor can process the instructions executed in the computer device, including instructions stored in or on the memory to display the graphical information of the GUI on an external input / output device (such as, a display device coupled to the interface). In some optional embodiments, if necessary, multiple processors and / or multiple buses can be used together with multiple memories and multiple memories. Similarly, multiple computer devices can be connected, and each device provides some necessary operations (for example, as a server array, a group of blade servers, or a multi-processor system). Figure 6 A processor 10 is taken as an example.

[0206] The processor 10 may be a central processing unit, a network processor or a combination thereof. The processor 10 may further include an integrated circuit. The integrated circuit may be a dedicated integrated circuit, a programmable logic device or a combination thereof. The programmable logic device may be a complex programmable logic device, a field programmable gate array, a general purpose array logic or any combination thereof.

[0207] The memory 20 stores instructions executable by at least one processor 10, so that the at least one processor 10 executes the method shown in the above embodiment.

[0208] The memory 20 may include a program storage area and a data storage area, wherein the program storage area may store an operating system, an application required for at least one function; the data storage area may store data created according to the use of the computer device, etc. In addition, the memory 20 may include a high-speed random access memory, and may also include a non-transient memory, such as at least one disk storage device, a flash memory device, or other non-transient solid-state storage device. In some optional embodiments, the memory 20 may optionally include a memory remotely arranged relative to the processor 10, and these remote memories may be connected to the computer device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0209] The memory 20 may include a volatile memory, such as a random access memory; the memory may also include a non-volatile memory, such as a flash memory, a hard disk or a solid state drive; the memory 20 may also include a combination of the above types of memory.

[0210] The computer device further comprises a communication interface 30 for the computer device to communicate with other devices or a communication network.

[0211] The embodiment of the present invention also provides a computer-readable storage medium. The method according to the embodiment of the present invention can be implemented in hardware, firmware, or can be implemented as a computer code that can be recorded in a storage medium, or can be implemented as a computer code that is originally stored in a remote storage medium or a non-temporary machine-readable storage medium and will be stored in a local storage medium through a network download, so that the method described herein can be stored in such software processing on a storage medium using a general-purpose computer, a dedicated processor, or programmable or dedicated hardware. Among them, the storage medium can be a magnetic disk, an optical disk, a read-only storage memory, a random access memory, a flash memory, a hard disk or a solid-state hard disk, etc.; further, the storage medium can also include a combination of the above types of memories. It can be understood that a computer, a processor, a microprocessor controller, or programmable hardware includes a storage component that can store or receive software or computer code. When the software or computer code is accessed and executed by a computer, a processor, or hardware, the method shown in the above embodiment is implemented.

[0212] Although the embodiments of the present invention have been described in conjunction with the accompanying drawings, those skilled in the art may make various modifications and variations without departing from the spirit and scope of the present invention, and such modifications and variations are all within the scope defined by the appended claims.

Claims

1. A method for recording an event log, characterized in that: The method comprises: Acquire a first event log, where the first event log is a newly reported event log, and the event log includes: event attribute information, event identifier, and event merging strategy; In the case of searching at least one event log matching the first event log from an event log array according to the event identifier of the first event log and the event attribute information, according to the target event merging strategy corresponding to the first event log, extracting target event attribute information corresponding to the target event merging strategy from the first event log and the second event log respectively, wherein the second event log is any one of the at least one event log, and the event log array is used to store event logs; The first target event attribute information corresponding to the target event merging strategy extracted from the first event log is matched with the second target event attribute information corresponding to the target event merging strategy extracted from the second event log, and based on the matching result, it is determined whether to merge the first event log and the second event log.

2. The method according to claim 1, characterized in that The event attribute information includes: event status and event reporting time. According to the event identifier of the first event log and the event attribute information, searching an event log matching the first event log from an event log array includes: According to the event status and the event reporting time, searching from the event log array whether there is an event log whose event reporting time is earlier than the event reporting time of the first event log and whose event status is an unrepaired state; When it is determined that there is a candidate event log whose event reporting time is earlier than the event reporting time of the first event log and whose event status is an unrepaired state, the candidate event logs are searched to see whether there is a target event log with the same identifier as the first event log as the event log that matches the first event log.

3. The method according to claim 2, characterized in that The event attribute information also includes: event type; the method also includes: In the case where it is determined that there is no event log matching the first event log in the event log array, searching the event log array for a target array element whose event status is unused, and storing the first event log in the target array element; Alternatively, when it is determined that there is no array element with an event status of unused in the event log array, searching for the event reporting time of the event log corresponding to each event type; Selecting a target event log according to the event reporting time of the event log corresponding to each event type, the priority corresponding to the event type, and one or more event attribute information in the event state; The first event log is overwritten and stored in the array element to which the target event log belongs.

4. The method according to claim 3, characterized in that Selecting a target event log according to the event reporting time of the event log corresponding to each event type, the priority corresponding to the event type, and one or more event attribute information in the event state includes: According to the event status of each event log, identifying whether there is a repaired event log in the event log array; When it is determined that there is a repaired event log, and the repaired event log is not the earliest reported event log of the first preset type, or is not an event log of the second preset type, selecting the earliest repaired event log among the repaired event logs as the target event log; or, When it is determined that there is no repaired event log, identifying the event type of each event log in the event log array; or, When the existence of an event log of a third preset type and / or an event log of a fourth preset type is identified, an event log corresponding to the earliest event reporting time in the event log of the third preset type and / or the event log of the fourth preset type is selected as the target event log; or, When the event log array does not include the event log of the third preset type and the event log of the fourth preset type, but includes the event log of the first preset type, then the event log of the first preset type, except the event log with the earliest event reporting time, is selected as the target event log; or, When the event log array includes only event logs of the second preset type and / or includes event logs of the first preset type with the earliest event reporting time, event prompt information indicating that the log is full is generated.

5. The method according to any one of claims 1 to 4, characterized in that: When the first target event attribute information corresponding to the target event merging strategy extracted from the first event log includes a first root sequence, a first object type, and first object identification information, and the second target event attribute information corresponding to the target event merging strategy extracted from the second event log includes a second root sequence, a second object type, and second object identification information, matching the first target event attribute information corresponding to the target event merging strategy extracted from the first event log and the second target event attribute information corresponding to the target event merging strategy extracted from the second event log, and determining whether to merge the first event log and the second event log according to the matching result, includes: When it is determined that the first root sequence is the same as the second root sequence, the first object type is the same as the second object type, and the first object identification information is the same as the second object identification information, determining to merge the first event log and the second event log; Alternatively, when the first root sequence and the second root sequence are different, and / or the first object type and the second object type are different, and / or the first object identification information and the second object identification information are different, it is determined that the first event log and the second event log are not to be merged.

6. The method according to any one of claims 1 to 4, characterized in that: When the first target event attribute information corresponding to the target event merging strategy extracted from the first event log includes first object identification information, and the second target event attribute information corresponding to the target event merging strategy extracted from the second event log includes second object identification information, matching the first target event attribute information corresponding to the target event merging strategy extracted from the first event log and the second target event attribute information corresponding to the target event merging strategy extracted from the second event log, and determining whether to merge the first event log and the second event log according to the matching result, includes: When it is determined that the first object identification information and the second object identification information are the same, determining to merge the first event log and the second event log; Alternatively, when it is determined that the first object identification information and the second object identification information are different, it is determined that the first event log and the second event log are not to be merged.

7. The method according to any one of claims 1 to 4, characterized in that: When the first target event attribute information corresponding to the target event merging strategy extracted from the first event log includes first event type information, and the second target event attribute information corresponding to the target event merging strategy extracted from the second event log includes second event type information, matching the first target event attribute information corresponding to the target event merging strategy extracted from the first event log and the second target event attribute information corresponding to the target event merging strategy extracted from the second event log, and determining whether to merge the first event log and the second event log according to the matching result, including: When it is determined that the first event type information and the second event type information are the same, determining to merge the first event log and the second event log; Alternatively, when it is determined that the first event type information and the second event type information are different, it is determined that the first event log and the second event log are not to be merged.

8. The method according to any one of claims 1 to 4, characterized in that: When the first target event attribute information corresponding to the target event merging strategy extracted from the first event log includes a first event object, a first event object identifier, and a first event node identifier, and the second target event attribute information corresponding to the target event merging strategy extracted from the second event log includes a second event object, a second event object identifier, and a second event node identifier, matching the first target event attribute information corresponding to the target event merging strategy extracted from the first event log and the second target event attribute information corresponding to the target event merging strategy extracted from the second event log, and determining whether to merge the first event log and the second event log according to the matching result, includes: When it is determined that the first event object is the same as the second event object, the first event object identifier is the same as the second event object identifier, and the first event node identifier is the same as the second event node identifier, determining that the first event log and the second event log are to be merged; Alternatively, when the first event object and the second event object are different, and / or the first event object identifier and the second event object identifier, and / or the first event node identifier and the second event node identifier are different, it is determined that the first event log and the second event log are not to be merged.

9. A device for recording an event log, characterized in that: The device comprises: An acquisition module, configured to acquire a first event log, wherein the first event log is a newly reported event log, and the event log includes: event attribute information, event identifier, and event merging strategy; An extraction module, configured to, when searching for at least one event log matching the first event log from an event log array according to the event identifier of the first event log and the event attribute information, extract target event attribute information corresponding to the target event merging strategy from the first event log and a second event log respectively according to the target event merging strategy corresponding to the first event log, wherein the second event log is any one of the at least one event log, and the event log array is used to store event logs; A matching module is used to match the first target event attribute information corresponding to the target event merging strategy extracted from the first event log with the second target event attribute information corresponding to the target event merging strategy extracted from the second event log, and determine whether to merge the first event log and the second event log based on the matching result.

10. A computer device, characterized in that: include: A memory and a processor, wherein the memory and the processor are communicatively connected to each other, the memory stores computer instructions, and the processor executes the event log recording method according to any one of claims 1 to 8 by executing the computer instructions.

11. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a computer to execute the event log recording method according to any one of claims 1 to 8.

Images