Log management method and system, electronic equipment and readable storage medium

Abstract

The invention discloses a log management method and system, electronic equipment and a readable storage medium, relates to the field of server testing, and aims to solve the problem that a captured log cannot accurately locate a problem reason and influences on system communication overhead. The method comprises the steps that multiple parameters influencing the health state of a client server are acquired according to a first monitoring period; when the alarm parameter meeting any alarm condition exists in the multiple parameters, the alarm state of the server is determined based on the alarm condition met by the alarm parameter; if the alarm state is a risk early warning state, multiple parameters influencing the health state of the server are obtained according to a second monitoring period corresponding to the alarm parameters, and the duration of the second monitoring period is smaller than that of the first monitoring period; and if the alarm state is a fault alarm state, obtaining an association log of the server, and uploading the association log to the server-side server. According to the method and the device, the accuracy of capturing the log before the server downtime can be improved, and the system overhead and bandwidth are relatively reduced.

Description

Technical Field

[0001] The present invention relates to the field of server testing, and in particular to a log management method, system, electronic equipment and readable storage medium. Background Art

[0002] When the server is undergoing production testing, it generally uses a diskless operating system, which is started through PXE (Preboot Execution Environment) and works based on the Client / Server mode. Considering the problems with the machine itself or the diagnostic program used for testing, as well as the customer's requirements for server quality, more and more customers require their own diagnostic programs to be added during the factory server aging test, resulting in frequent errors in the server production test, and a small number of problems will cause the server to crash directly. In addition, due to the use of a diskless operating system, the original error environment and related logs no longer exist after the server is restarted, which is not conducive to the analysis of the problem.

[0003] At present, by establishing a scheduled synchronization task on the client side, the system logs and the intermediate process logs generated by the test program are collected at fixed intervals and then synchronized to the server side. This method can see the logs of the period before the server crashes, but if the interval is set to be long, the time of the obtained logs will be far away from the time when the server crashes, and the cause of the problem cannot be accurately located. The timeliness of the logs is poor. If the time interval is set to be very short, the action of synchronizing the logs will have a greater impact on the system communication overhead and will also be a great challenge to the network bandwidth.

[0004] Therefore, how to provide a solution to the above technical problems is a problem that those skilled in the art need to solve at present. Summary of the invention

[0005] The object of the present invention is to provide a log management method, system, electronic device and readable storage medium, which can improve the accuracy of capturing logs before server downtime and relatively reduce system overhead and bandwidth.

[0006] In order to solve the above technical problems, the present invention provides a log management method, comprising:

[0007] When performing an aging test on a client server using a diskless operating system, obtaining multiple parameters affecting the health status of the client server according to a first monitoring period;

[0008] When there is an alarm parameter satisfying any alarm condition among the multiple parameters, the alarm state of the client server is determined based on the alarm condition satisfied by the alarm parameter; the alarm state is a risk warning state or a fault alarm state;

[0009] If the alarm state is the risk warning state, obtaining multiple parameters affecting the health state of the client server according to a second monitoring period, wherein the duration of the second monitoring period is determined based on the alarm parameters and is shorter than the duration of the first monitoring period;

[0010] If the alarm state is the fault alarm state, obtain the associated log of the client server, and upload the associated log to the service server.

[0011] The plurality of parameters include at least one first parameter, the first parameter is a parameter having a numerical range, and the alarm condition includes a first alarm condition, a second alarm condition and a third alarm condition;

[0012] The log management method further includes:

[0013] For each of the first parameters, determining a risk warning threshold range and a fault alarm threshold range corresponding to the first parameter; an upper limit threshold of the risk warning threshold range is less than a lower limit threshold of the fault alarm threshold range;

[0014] After acquiring multiple parameters affecting the health status of the client server according to the first monitoring cycle, the log management method further includes:

[0015] For each of the first parameters among the multiple parameters, determine whether the first parameter is within the corresponding risk warning threshold range or the fault alarm threshold range; if the first parameter is within the corresponding risk warning threshold range, determine that the first parameter is an alarm parameter that meets the first alarm condition; if the first parameter is within the corresponding fault alarm threshold range, determine that the first parameter is an alarm parameter that meets the second alarm condition;

[0016] When any second parameter exists among the multiple parameters, the second parameter is determined as an alarm parameter that meets the third alarm condition; the second parameter is a parameter that does not have a numerical range.

[0017] The process of determining the alarm status of the client server based on the alarm condition satisfied by the alarm parameter includes:

[0018] When the alarm condition satisfied by the alarm parameter is the first alarm condition, determining that the alarm state of the client server is the risk warning state;

[0019] When the alarm condition satisfied by the alarm parameter is the second alarm condition or the third alarm condition, it is determined that the alarm state of the client server is the fault alarm state.

[0020] After acquiring a plurality of parameters affecting the health status of the client server according to the second monitoring period, the log management method further includes:

[0021] Determining whether the first parameters acquired in a continuous preset number of second monitoring cycles are all within their corresponding normal threshold ranges; the continuous preset number of second monitoring cycles includes a first second monitoring cycle;

[0022] If so, multiple parameters affecting the health status of the client server are obtained according to the first monitoring period.

[0023] Wherein, the log management method further includes:

[0024] Determining whether the alarm parameter does not exist during the aging test on the client server;

[0025] If yes, when the aging test is completed, the associated log of the client server is obtained, and the associated log is uploaded to the service server.

[0026] The process of obtaining the associated log of the client server and uploading the associated log to the service server includes:

[0027] Obtaining the kernel message log, system message log, security event log and aging test log of the client server;

[0028] Determine the kernel message log, the system message log, the security event log, and the aging test log as associated logs;

[0029] The associated log is renamed with the current time and packaged into a compressed file, and then uploaded to the client server.

[0030] The client server includes a storage space for storing the associated logs, and the process of uploading the associated logs to the service server includes:

[0031] When the storage capacity of the storage space meets the uploading condition, uploading the associated log to the client server;

[0032] When the storage capacity of the storage space does not meet the uploading condition, the client server is triggered to clear the associated logs in the storage space, and then the associated logs are re-uploaded to the client server at a preset interval.

[0033] To solve the above technical problems, the present application also provides a log management system, including:

[0034] A first acquisition module, configured to acquire, during an aging test of a client server using a diskless operating system, a plurality of parameters affecting a health status of the client server according to a first monitoring period;

[0035] A first determination module is used to determine the alarm state of the client server based on the alarm condition satisfied by the alarm parameter when there is an alarm parameter satisfying any alarm condition among the multiple parameters; the alarm state is a risk warning state or a fault alarm state;

[0036] an early warning processing module, configured to obtain, if the alarm state is the risk early warning state, a plurality of parameters affecting the health state of the client server according to a second monitoring period, wherein the duration of the second monitoring period is determined based on the alarm parameters and is less than the duration of the first monitoring period;

[0037] The alarm processing module is used to obtain the associated log of the client server if the alarm state is the fault alarm state, and upload the associated log to the service server.

[0038] In order to solve the above technical problems, the present application also provides an electronic device, including:

[0039] Memory for storing computer programs;

[0040] A processor is used to implement the steps of the log management method as described in any one of the above when executing the computer program.

[0041] To solve the above technical problems, the present application also provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the log management method as described in any one of the above are implemented.

[0042] The present application provides a log management method. When performing an aging test on a client server using a diskless operating system, a first monitoring cycle is first used to obtain multiple parameters that affect the health status of the client server. If any parameter satisfies the alarm condition, the alarm state of the server is determined to be a risk warning state or a fault alarm state according to the alarm condition satisfied by the alarm parameter. If it is a risk warning state, a second monitoring cycle is selected according to the alarm parameter. The duration of the second monitoring cycle is less than the duration of the first monitoring cycle, so that possible risks can be monitored more frequently. If the alarm state is a fault alarm state, the associated log is uploaded to the server-side server so that fault analysis and location can be performed on the server-side server based on the associated log. The duration of the monitoring cycle in the present application is dynamically adjustable, which helps to adjust the time for capturing the associated log, and the associated log is captured only after the server meets the fault alarm state, ensuring that the time when the associated log is captured is not much different from the time when the server crashes, thereby improving the accuracy of capturing the log before the server crashes, and relatively reducing system overhead and bandwidth.

[0043] The present application also provides a log management system, an electronic device and a computer-readable storage medium, which have the same beneficial effects as the above-mentioned log management method. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention, the following briefly introduces the drawings required for use in the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0045] Figure 1 A flow chart of the steps of a log management method provided by the present invention;

[0046] Figure 2 A flowchart of another log management method provided by the present invention;

[0047] Figure 3 A structural diagram of a log management system provided by the present invention;

[0048] Figure 4 A schematic diagram of the structure of an electronic device provided by the present invention;

[0049] Figure 5 This is a schematic diagram of the structure of a computer-readable storage medium provided by the present invention. DETAILED DESCRIPTION

[0050] The core of the present invention is to provide a log management method, system, electronic device and readable storage medium, which can improve the accuracy of capturing logs before server downtime and relatively reduce system overhead and bandwidth.

[0051] In order to make the purpose, technical solution and advantages of the embodiments of the present invention clearer, the technical solution in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0052] First, please refer to Figure 1 , Figure 1 A flow chart of the steps of a log management method provided by the present invention, the log management method comprising:

[0053] S101: when performing an aging test on a client server using a diskless operating system, obtaining multiple parameters affecting the health status of the client server according to a first monitoring period;

[0054] Diskless operating system refers to a network computer architecture, in which the server provides operating system and data to multiple client servers, and the client servers do not need to install local hard disks or other storage devices, and can be started through PXE boot mode. This architecture realizes resource sharing and management through network connection, and has the advantages of centralized management, easy maintenance, high security and cost reduction. PXE boot of server is a network boot technology that allows the server to obtain operating system image or other boot files from a remote server (PXE server) through the network when starting, so as to start or install the operating system. It works based on Client / Server mode. The PXE boot process includes four steps: DHCP (Dynamic Host Configuration Protocol) request, DHCP response, TFTP (Trivial File Transfer Protocol) download, and boot image execution.

[0055] Considering that newly produced servers may have defects in the manufacturing process or use defective components, it is necessary to perform an aging test on the server to discover these potential problems before the server is put into formal operation. Considering that the server uses a diskless operating system during the aging test, after the server is restarted, the original error environment and related logs no longer exist. Therefore, in order to facilitate the analysis and location of the server fault, it is necessary to obtain the relevant logs before the server crashes for subsequent analysis.

[0056] In this embodiment, when performing an aging test on a client server using a diskless operating system, the parameters of the client server are obtained according to the first monitoring cycle. The client server is the server to be tested during the aging test. The parameters obtained in this embodiment are parameters that will affect the health status of the server. On the one hand, the changes in these parameters can timely identify the possible downtime risk of the server, which is convenient for subsequent accurate capture of the logs before the server downtime. On the other hand, it can provide data support for subsequent fault analysis, which is convenient for locating the cause of the server downtime. By regularly monitoring these key parameters, preventive maintenance can be performed before potential problems lead to serious failures.

[0057] S102: When there is an alarm parameter satisfying any alarm condition among the multiple parameters, determine the alarm state of the client server based on the alarm condition satisfied by the alarm parameter; the alarm state is a risk warning state or a fault alarm state;

[0058] In this embodiment, there may be multiple alarm conditions. The acquired parameters are compared with the alarm conditions. If there are alarm parameters that satisfy any alarm condition, it is determined that the client server is currently in a state where a failure is at risk or has already occurred. In this embodiment, a correspondence between different alarm conditions and their combinations and alarm states is pre-established. Based on the alarm conditions currently satisfied by the alarm parameters and the correspondence, it can be determined that the alarm state of the client server is a risk warning state or a fault alarm state.

[0059] The correspondence between different pre-established alarm conditions and their combinations and alarm states is explained. Assuming that the alarm conditions include A, B, and C, and assuming that the first alarm parameter γ1 satisfies A, the second alarm parameter γ2 satisfies A, and the third alarm parameter γ3 satisfies A, this indicates that there may be a potential problem or trend that requires attention but may not require immediate action. It can be determined that the risk warning state is met. Assuming that the first alarm parameter γ1 satisfies A, the second alarm parameter γ2 satisfies B, and the third alarm parameter γ3 satisfies A, this indicates that the system may have a serious problem and immediate action is required. Rapid identification and response can reduce the impact of the fault. At this time, it can be determined that the fault alarm state is met.

[0060] Of course, as an optional embodiment, alarm priorities can also be set for different alarm conditions. The alarm state corresponding to the highest alarm priority is a fault alarm state, that is, if there is an alarm parameter that meets the alarm condition corresponding to the highest alarm priority, then the alarm state is determined to be a fault alarm state. If the alarm priorities are all at a lower level, the alarm state can be determined based on the number of alarm parameters that meet the alarm conditions corresponding to the second highest alarm priority. Setting the priority of the alarm condition can help the system give priority to the most serious or urgent problems when multiple alarms occur at the same time, ensuring that key problems are resolved in a timely manner. Through effective alarm management and priority setting, unnecessary intervention can be reduced, thereby reasonably selecting the capture time of associated logs.

[0061] S103: If the alarm state is a risk warning state, multiple parameters affecting the health state of the client server are obtained according to a second monitoring period, and the duration of the second monitoring period is determined based on the alarm parameters and is shorter than the duration of the first monitoring period;

[0062] In this embodiment, if the current alarm state is a risk warning state, it indicates that the server may have a potential problem or a trend of failure, which requires attention but may not require immediate action. Therefore, in the current alarm state, the duration of the monitoring cycle of the parameters affecting the health status of the client server is adjusted, and the parameters affecting the health status of the client server are obtained according to the second monitoring cycle. The duration of the second monitoring cycle is determined based on the alarm parameters and is less than the duration of the first monitoring cycle. By shortening the duration of the parameter monitoring cycle, it is possible to check the parameters affecting the health status of the server more frequently, and abnormal changes in the parameters can be discovered more quickly, so that timely action can be taken. Since the parameter acquisition interval is shorter, abnormal situations are easier to capture, which helps to more accurately locate the time and cause of the problem, and can provide a faster response time, so that corresponding measures can be taken before the problem worsens.

[0063] It can be understood that the duration of the second monitoring cycle can be determined according to a certain alarm parameter, such as when the existing alarm parameter is γ1, the duration of the second monitoring cycle is set to T1, and when the existing alarm parameter is γ2, the duration of the second monitoring cycle is set to T2. By setting different durations of monitoring cycles for different alarm parameters, the response time to potential risks can be optimized while ensuring monitoring efficiency, or, when there are multiple alarm parameters, as long as γ1 exists among the multiple alarm parameters, the duration of the second monitoring cycle is set to T1. The duration of the second monitoring cycle can also be determined according to multiple alarm parameters. Assuming that the multiple alarm parameters include γ1 and γ2, the duration corresponding to γ1 is T1, and the duration corresponding to γ2 is T2, the duration of the second monitoring cycle can be determined according to the following relationship: T=αT1+βT2, where α and β are both adjustable coefficients. It can be understood that different alarm parameters may have different degrees of influence on system health. α and β can be used as weights to make the monitoring cycle more in line with actual needs so that important parameters can be monitored faster. The duration of the second monitoring cycle can also be determined according to the larger or smaller value of T1 and T2, or, when any alarm parameter exists, the duration of the second monitoring cycle is set to T1. By dynamically setting the monitoring cycle, a flexible, dynamic and efficient monitoring strategy can be provided, which helps to accurately monitor the status of the server and improve the accuracy of capturing the log before the server crashes.

[0064] S104: If the alarm state is a fault alarm state, obtain the associated log of the client server, and upload the associated log to the service server.

[0065] In order to accurately obtain the logs before the server crashes, if the alarm status is a fault alarm status, the associated logs of the client server are captured and uploaded to the server-side server so that the server-side server can perform fault analysis and location. It can be understood that when the alarm status is a fault alarm status, it indicates that the server is likely to crash soon.

[0066] It can be seen that in this embodiment, when performing an aging test on a client server using a diskless operating system, the first monitoring cycle is first used to obtain multiple parameters that affect the health status of the client server. If any parameter satisfies the alarm condition, the alarm state of the server is determined to be a risk warning state or a fault alarm state according to the alarm condition satisfied by the alarm parameter. If it is a risk warning state, the second monitoring cycle is selected according to the alarm parameter. The duration of the second monitoring cycle is less than the duration of the first monitoring cycle, so that possible risks can be monitored more frequently. If the alarm state is a fault alarm state, the associated log is uploaded to the server-side server so that fault analysis and positioning can be performed based on the associated log in the server-side server. The duration of the monitoring cycle in this application is dynamically adjustable, which helps to adjust the time for capturing the associated log, and the associated log is captured only after the server meets the fault alarm state, ensuring that the time when the associated log is captured is not much different from the time when the server crashes, thereby improving the accuracy of capturing the log before the server crashes, and relatively reducing system overhead and bandwidth.

[0067] Based on the above embodiments:

[0068] In an exemplary embodiment, the plurality of parameters include at least one first parameter, the first parameter is a parameter having a numerical range, and the alarm condition includes a first alarm condition, a second alarm condition, and a third alarm condition;

[0069] Log management methods also include:

[0070] For each first parameter, determine a risk warning threshold range and a fault alarm threshold range corresponding to the first parameter; the upper limit threshold of the risk warning threshold range is less than the lower limit threshold of the fault alarm threshold range;

[0071] After acquiring multiple parameters affecting the health status of the client server according to the first monitoring cycle, the log management method further includes:

[0072] For each first parameter among the multiple parameters, determine whether the first parameter is within its corresponding risk warning threshold range or fault alarm threshold range; if the first parameter is within its corresponding risk warning threshold range, determine that the first parameter is an alarm parameter that meets the first alarm condition; if the first parameter is within its corresponding fault alarm threshold range, determine that the first parameter is an alarm parameter that meets the second alarm condition;

[0073] When any second parameter exists among the multiple parameters, the second parameter is determined as an alarm parameter that meets the third alarm condition; the second parameter is a parameter that does not have a numerical range.

[0074] In this embodiment, the parameters include a first parameter and a second parameter, wherein the first parameter is a parameter with a numerical range, and the second parameter is a parameter without a numerical range. It can be understood that the first parameter with a numerical range has a gradual effect on the health status of the server. Taking the first parameter as the CPU occupancy rate as an example, the CPU occupancy rate has a numerical range of 0 to 100%. The closer it is to 100%, the higher the CPU occupancy rate is, the slower the server will process tasks, and the more obvious the server response delay and jamming phenomenon will be, which will affect the health status of the server. The second parameter has an immediate effect on the health status of the server. Taking the second parameter as the hardware fault parameter (Hardware ERR) as an example, as long as it occurs, it will cause relatively serious consequences to the server, such as downtime. Based on this, this embodiment determines the alarm conditions based on the above-mentioned first parameter and second parameter respectively.

[0075] Exemplarily, the first parameter includes but is not limited to CPU occupancy, CPU temperature, memory usage, etc. The second parameter includes system log keywords, such as keywords in the Sel log: dead, call trace, bad, MCERR, CATERR, hung, etc., keywords in the Dmesg log: Hardware Error, dead device, lockup, fatal, temperature, canceling I / O, etc., and the settings can be selected according to actual project needs. This embodiment does not make specific limitations here.

[0076] In this embodiment, different first parameters have different risk warning threshold ranges and fault alarm threshold ranges, as shown in Table 1.

[0077] Table 1 Relationship between the risk warning threshold range and fault alarm threshold range of the first parameter

[0078] If any first parameter is within the risk warning threshold range, the first parameter is determined to be an alarm parameter that meets the first alarm condition; if any first parameter is within the fault alarm threshold range, the first parameter is determined to be an alarm parameter that meets the second alarm condition; if the second parameter exists among multiple parameters, it is determined that the third alarm condition is met; when the alarm condition met by the alarm parameter is the first alarm condition, the alarm state of the client server is determined to be a risk warning state; when the alarm condition met by the alarm parameter is the second alarm condition or the third alarm condition, the alarm state of the client server is determined to be a fault alarm state.

[0079] In this embodiment, by setting different risk warning and fault alarm threshold ranges for each first parameter, changes in each parameter can be monitored more accurately to ensure that the problem can be discovered in time when it reaches a certain level. By dividing the alarm conditions into first alarm conditions, second alarm conditions and third alarm conditions, and corresponding alarm states (risk warning state and fault alarm state), a multi-level alarm mechanism can be implemented, which helps to distinguish problems of different severity, thereby improving the accuracy and reliability of capturing logs before downtime.

[0080] In an exemplary embodiment, after acquiring multiple parameters affecting the health status of the client server according to the second monitoring period, the log management method further includes:

[0081] Determining whether the first parameters acquired in a continuous preset number of second monitoring cycles are all within their corresponding normal threshold ranges; the continuous preset number of second monitoring cycles includes the first second monitoring cycle;

[0082] If so, multiple parameters affecting the health status of the client server are obtained according to the first monitoring period.

[0083] In this embodiment, if the parameter monitoring period is adjusted from the first monitoring period to the second monitoring period, and the parameters obtained in multiple consecutive second monitoring periods are all within the normal threshold range, it means that the parameters obtained previously are affected by other factors, and there is no fault in the server itself. At this time, the server monitoring period is adjusted from the second monitoring period back to the first monitoring period.

[0084] Combination Figure 2 For illustration, assume that at every time interval T, various parameters of the client server are regularly triggered to obtain, such as CPU occupancy, CPU temperature, important system dmesg keywords (such as ECC), etc., to monitor various parameters such as status and performance in the server. If the first parameter such as CPU temperature exceeds threshold 1, that is, it is within the risk warning threshold range, then the time interval T is adjusted. If the first parameter exceeds threshold 2, that is, it is within the fault alarm threshold range, or the second parameter appears within the recent time T, then logs are collected and forwarded. Assuming that the initial value of the time interval T is 10S, if the first parameter exceeds threshold 1, it is adjusted to 3S. If the first parameter is normal for multiple consecutive times (such as 3 times), then T is adjusted back to 10S.

[0085] In an exemplary embodiment, the log management method further includes:

[0086] Determine whether there are no alarm parameters during the aging test of the client server;

[0087] If yes, when the aging test is completed, obtain the associated log of the client server and upload the associated log to the service server.

[0088] In this embodiment, if there are no abnormal parameters in the client server during the aging test, the associated logs are uploaded to the service server after the aging test is completed for subsequent analysis.

[0089] In an exemplary embodiment, the process of obtaining the correlation log of the client server and uploading the correlation log to the service server includes:

[0090] Obtain the client server's kernel message log, system message log, security event log, and aging test log;

[0091] Identify kernel message logs, system message logs, security event logs, and aging test logs as related logs;

[0092] Rename the associated logs with the current time, package them into a compressed file, and upload them to the client server.

[0093] In this embodiment, the kernel message log, system message log, security event log and aging test log of the client server are obtained, and they are placed in the same folder collect_logs, and are packaged with zip and renamed with time to collect_logs_YYYYMMDDHHMMSS.zip, and finally the compressed file is transferred to the server through SCP or SFTP protocol. The compressed file obtained after the time renaming is convenient to improve the efficiency of subsequent fault location, where the naming method of zip and the folder name are only examples.

[0094] In an exemplary embodiment, the client server includes a storage space for storing the associated logs, and the process of uploading the associated logs to the service server includes:

[0095] When the storage capacity of the storage space meets the upload conditions, the associated logs are uploaded to the client server;

[0096] When the storage capacity of the storage space does not meet the upload condition, the client server is triggered to clear the associated logs in the storage space, and then re-upload the associated logs to the client server at a preset interval.

[0097] In this embodiment, the service-side server may retain only the latest multiple correlation logs to improve the effectiveness of the correlation logs, facilitate analysis and location of the cause of the server downtime, and thus reduce the storage space occupied by the service-side server.

[0098] In summary, the present invention provides a method for pre-downtime log storage of a diskless operating system of a server, which can monitor the status performance indicators of a Client server regularly. When a potential downtime risk is detected, an early warning is triggered, and various logs are collected and forwarded to the Server. The present invention dynamically adjusts the time interval of scheduled monitoring according to the monitored performance indicators, which is convenient for more accurate monitoring of the server status and adjustment of the time for capturing logs, thereby more accurately capturing the server pre-downtime logs and relatively reducing system overhead and bandwidth.

[0099] Second, please refer to Figure 3 , the present application also provides a log management system, including:

[0100] A first acquisition module 11 is used to acquire multiple parameters affecting the health status of the client server according to a first monitoring period when performing an aging test on the client server using the diskless operating system;

[0101] The first determination module 12 is used to determine the alarm state of the client server based on the alarm condition satisfied by the alarm parameter when there is an alarm parameter satisfying any alarm condition among the multiple parameters; the alarm state is a risk warning state or a fault alarm state;

[0102] The warning processing module 13 is used to obtain multiple parameters affecting the health status of the client server according to a second monitoring period if the alarm state is a risk warning state, and the duration of the second monitoring period is determined based on the alarm parameters and is less than the duration of the first monitoring period;

[0103] The alarm processing module 14 is used to obtain the associated log of the client server if the alarm state is a fault alarm state, and upload the associated log to the service server.

[0104] It can be seen that in this embodiment, when performing an aging test on a client server using a diskless operating system, the first monitoring cycle is first used to obtain multiple parameters that affect the health status of the client server. If any parameter satisfies the alarm condition, the alarm state of the server is determined to be a risk warning state or a fault alarm state according to the alarm condition satisfied by the alarm parameter. If it is a risk warning state, the second monitoring cycle is selected according to the alarm parameter. The duration of the second monitoring cycle is less than the duration of the first monitoring cycle, so that possible risks can be monitored more frequently. If the alarm state is a fault alarm state, the associated log is uploaded to the server-side server so that fault analysis and positioning can be performed based on the associated log in the server-side server. The duration of the monitoring cycle in this application is dynamically adjustable, which helps to adjust the time for capturing the associated log, and the associated log is captured only after the server meets the fault alarm state, ensuring that the time when the associated log is captured is not much different from the time when the server crashes, thereby improving the accuracy of capturing the log before the server crashes, and relatively reducing system overhead and bandwidth.

[0105] In an exemplary embodiment, the plurality of parameters include at least one first parameter, the first parameter is a parameter having a numerical range, and the alarm condition includes a first alarm condition, a second alarm condition, and a third alarm condition;

[0106] The log management system also includes:

[0107] A second determination module is used to determine, for each first parameter, a risk warning threshold range and a fault alarm threshold range corresponding to the first parameter; the upper limit threshold of the risk warning threshold range is less than the lower limit threshold of the fault alarm threshold range;

[0108] The log management system also includes:

[0109] A first condition determination module is used to determine, for each first parameter among the multiple parameters, whether the first parameter is within its corresponding risk warning threshold range or fault alarm threshold range, and if the first parameter is within its corresponding risk warning threshold range, determine that the first parameter is an alarm parameter that meets the first alarm condition; if the first parameter is within its corresponding fault alarm threshold range, determine that the first parameter is an alarm parameter that meets the second alarm condition;

[0110] The second condition determination module is used to determine the second parameter as an alarm parameter that meets the third alarm condition when any second parameter exists among the multiple parameters; the second parameter is a parameter that does not have a numerical range.

[0111] In an exemplary embodiment, the process of determining the alarm status of the client server based on the alarm condition satisfied by the alarm parameter includes:

[0112] When the alarm condition satisfied by the alarm parameter is the first alarm condition, determining that the alarm state of the client server is a risk warning state;

[0113] When the alarm condition satisfied by the alarm parameter is the second alarm condition or the third alarm condition, it is determined that the alarm state of the client server is a fault alarm state.

[0114] In an exemplary embodiment, the log management system further includes:

[0115] A first judgment module is used to judge whether the first parameters acquired in a continuous preset number of second monitoring cycles are all within the corresponding normal threshold range; the continuous preset number of second monitoring cycles includes the first second monitoring cycle;

[0116] If so, multiple parameters affecting the health status of the client server are obtained according to the first monitoring period.

[0117] In an exemplary embodiment, the log management system further includes:

[0118] The second judgment module is used to judge whether there is no alarm parameter during the aging test of the client server;

[0119] If yes, when the aging test is completed, obtain the associated log of the client server and upload the associated log to the service server.

[0120] In an exemplary embodiment, the process of obtaining the correlation log of the client server and uploading the correlation log to the service server includes:

[0121] Obtain the client server's kernel message log, system message log, security event log, and aging test log;

[0122] Identify kernel message logs, system message logs, security event logs, and aging test logs as related logs;

[0123] Rename the associated logs with the current time, package them into a compressed file, and upload them to the client server.

[0124] In an exemplary embodiment, the client server includes a storage space for storing the associated logs, and the process of uploading the associated logs to the service server includes:

[0125] When the storage capacity of the storage space meets the upload conditions, the associated logs are uploaded to the client server;

[0126] When the storage capacity of the storage space does not meet the upload condition, the client server is triggered to clear the associated logs in the storage space, and then re-upload the associated logs to the client server at a preset interval.

[0127] Third, please refer to Figure 4 , the present application also provides an electronic device, including:

[0128] A memory 21, used for storing computer programs;

[0129] The processor 22 is used to implement the steps of the log management method described in any one of the above embodiments when executing a computer program.

[0130] The electronic device also includes:

[0131] The input interface 23 is connected to the processor 22 via the communication bus 26, and is used to obtain the computer programs, parameters and instructions imported from the outside, and save them in the memory 21 under the control of the processor 22. The input interface can be connected to an input device to receive parameters or instructions manually input by the user. The input device can be a touch layer covered on the display screen, or a key, trackball or touchpad set on the terminal housing.

[0132] The display unit 24 is connected to the processor 22 via the communication bus 26 and is used to display the data sent by the processor 22. The display unit can be a liquid crystal display or an electronic ink display.

[0133] The network port 25 is connected to the processor 22 via the communication bus 26, and is used to communicate with various external terminal devices. The communication technology used in the communication connection can be a wired communication technology or a wireless communication technology, such as mobile high-definition link technology, universal serial bus, high-definition multimedia interface, wireless fidelity technology, Bluetooth communication technology, low-power Bluetooth communication technology, communication technology based on IEEE802.11s, etc.

[0134] For an introduction to an electronic device provided in the present application, please refer to the above-mentioned embodiments, and the present application will not go into details here.

[0135] The electronic device provided in the present application has the same beneficial effects as the above-mentioned log management method.

[0136] Fourth, please refer to Figure 5 The present application also provides a computer-readable storage medium 30, on which a computer program 31 is stored. When the computer program 31 is executed by a processor, the steps of the log management method described in any of the above embodiments are implemented.

[0137] The computer-readable storage medium 30 may include: a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, and other media that can store the program 31 code.

[0138] For an introduction to a computer-readable storage medium provided in the present application, please refer to the above-mentioned embodiments, and the present application will not go into details here.

[0139] The computer-readable storage medium provided in the present application has the same beneficial effects as the above-mentioned log management method.

[0140] In a fifth aspect, the present application also provides a computer program product, including a computer program / instruction, which, when executed by a processor, implements the steps of the log management method described in any one of the embodiments above.

[0141] For an introduction to a computer program product provided by the present application, please refer to the above embodiments, and the present application will not go into details here.

[0142] A computer program product provided in this application has the same beneficial effects as the above-mentioned log management method.

[0143] It should also be noted that, in this specification, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "comprises", "comprising" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, an element defined by the statement "comprising a ..." does not exclude the presence of other identical elements in the process, method, article or device including the element.

[0144] The above description of the disclosed embodiments enables those skilled in the art to implement or use the present invention. Various modifications to these embodiments will be apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Therefore, the present invention will not be limited to the embodiments shown herein, but rather to the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A log management method, characterized in that: include: When performing an aging test on a client server using a diskless operating system, obtaining multiple parameters affecting the health status of the client server according to a first monitoring period; When there is an alarm parameter satisfying any alarm condition among the multiple parameters, determining the alarm state of the client server based on the alarm condition satisfied by the alarm parameter; The alarm state is a risk warning state or a fault alarm state; If the alarm state is the risk warning state, obtaining multiple parameters affecting the health state of the client server according to a second monitoring period, wherein the duration of the second monitoring period is determined based on the alarm parameters and is shorter than the duration of the first monitoring period; If the alarm state is the fault alarm state, obtain the associated log of the client server, and upload the associated log to the service server.

2. The log management method according to claim 1, characterized in that: The plurality of parameters include at least one first parameter, the first parameter is a parameter having a numerical range, and the alarm condition includes a first alarm condition, a second alarm condition and a third alarm condition; The log management method further includes: For each of the first parameters, determining a risk warning threshold range and a fault alarm threshold range corresponding to the first parameter; an upper limit threshold of the risk warning threshold range is less than a lower limit threshold of the fault alarm threshold range; After acquiring multiple parameters affecting the health status of the client server according to the first monitoring cycle, the log management method further includes: For each of the first parameters among the multiple parameters, determine whether the first parameter is within the corresponding risk warning threshold range or the fault alarm threshold range; if the first parameter is within the corresponding risk warning threshold range, determine that the first parameter is an alarm parameter that meets the first alarm condition; if the first parameter is within the corresponding fault alarm threshold range, determine that the first parameter is an alarm parameter that meets the second alarm condition; When any second parameter exists among the multiple parameters, the second parameter is determined as an alarm parameter that meets the third alarm condition; the second parameter is a parameter that does not have a numerical range.

3. The log management method according to claim 2, characterized in that: The process of determining the alarm state of the client server based on the alarm condition satisfied by the alarm parameter includes: When the alarm condition satisfied by the alarm parameter is the first alarm condition, determining that the alarm state of the client server is the risk warning state; When the alarm condition satisfied by the alarm parameter is the second alarm condition or the third alarm condition, it is determined that the alarm state of the client server is the fault alarm state.

4. The log management method according to claim 2, characterized in that: After acquiring multiple parameters affecting the health status of the client server according to the second monitoring cycle, the log management method further includes: Determining whether the first parameters acquired in a continuous preset number of second monitoring cycles are all within their corresponding normal threshold ranges; the continuous preset number of second monitoring cycles includes a first second monitoring cycle; If so, multiple parameters affecting the health status of the client server are obtained according to the first monitoring period.

5. The log management method according to claim 1, characterized in that: The log management method further includes: Determining whether the alarm parameter does not exist during the aging test on the client server; If yes, when the aging test is completed, the associated log of the client server is obtained, and the associated log is uploaded to the service server.

6. The log management method according to any one of claims 1 to 5, characterized in that: The process of obtaining the associated log of the client server and uploading the associated log to the service server includes: Obtaining the kernel message log, system message log, security event log and aging test log of the client server; Determine the kernel message log, the system message log, the security event log, and the aging test log as associated logs; The associated log is renamed with the current time and packaged into a compressed file, and then uploaded to the client server.

7. The log management method according to claim 6, characterized in that: The client server includes a storage space for storing the associated log, and the process of uploading the associated log to the service server includes: When the storage capacity of the storage space meets the uploading condition, uploading the associated log to the client server; When the storage capacity of the storage space does not meet the uploading condition, the client server is triggered to clear the associated logs in the storage space, and then the associated logs are re-uploaded to the client server at a preset interval.

8. A log management system, characterized in that: include: A first acquisition module, configured to acquire, during an aging test of a client server using a diskless operating system, a plurality of parameters affecting a health status of the client server according to a first monitoring period; A first determination module, configured to determine the alarm state of the client server based on the alarm condition satisfied by the alarm parameter when there is an alarm parameter satisfying any alarm condition among the plurality of parameters; The alarm state is a risk warning state or a fault alarm state; an early warning processing module, configured to obtain, if the alarm state is the risk early warning state, a plurality of parameters affecting the health state of the client server according to a second monitoring period, wherein the duration of the second monitoring period is determined based on the alarm parameters and is less than the duration of the first monitoring period; The alarm processing module is used to obtain the associated log of the client server if the alarm state is the fault alarm state, and upload the associated log to the service server.

9. An electronic device, characterized in that: include: Memory for storing computer programs; A processor, configured to implement the steps of the log management method according to any one of claims 1 to 7 when executing the computer program.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the log management method according to any one of claims 1 to 7 are implemented.

Images