Application program exception analysis method and device, equipment and storage medium

Abstract

The invention belongs to the technical field of computers, and particularly relates to an application program exception analysis method and device, equipment and a storage medium. The method comprises the steps of obtaining abnormal event feedback information and a running log of a target application program; determining a log screening time period based on the time of acquiring the abnormal event image data; screening the burying point operation logs based on the log screening time period to obtain target burying point operation logs; based on the abnormal event description information, determining a target abnormal scene corresponding to the abnormal event; based on preset mapping information, determining target anomaly analysis information corresponding to the target anomaly scene in a pre-constructed anomaly analysis information base; and analyzing the target burying point operation log based on the target exception analysis information to obtain an exception analysis result corresponding to the exception event. According to the invention, automatic analysis of fault time is realized, system resource consumption in an anomaly analysis process is reduced, and anomaly analysis efficiency is improved.

Description

Technical Field

[0001] The present application belongs to the field of computer technology, and specifically relates to an application exception analysis method, device, equipment and storage medium. Background Art

[0002] With the continuous development of computer technology, applications (APP) have become an indispensable part of people's lives. In order to provide users with a better experience, most APPs will provide users with channels to feedback abnormal problems.

[0003] At present, when users encounter abnormal problems while using an APP, the APP usually guides users to record relevant information in the form of text, screenshots, or screen recordings, and then feeds it back to the APP background. The APP background then performs abnormal analysis based on the relevant information fed back, combined with the APP source files and the APP's operation logs. However, for an APP, its operation log is generally very large, and even hundreds or thousands of lines of operation logs are generated every second. Therefore, when performing abnormal analysis, the background operation and maintenance personnel often need to find the log embedding code corresponding to the abnormal problem based on experience in order to continuously reduce the scope of investigation. This abnormal analysis method consumes more system resources during the analysis process, and the analysis efficiency is low. Summary of the invention

[0004] In order to solve the above technical problems, the present application provides an application exception analysis method, device, equipment and storage medium, which realizes the automated analysis of failure time, reduces the system resource consumption during the exception analysis process, and improves the efficiency of exception analysis.

[0005] On the one hand, an embodiment of the present application provides a method for analyzing application exceptions, the method comprising:

[0006] Obtain the abnormal event feedback information fed back by the target account when an abnormality occurs in the target application and the operation log of the target application; the abnormal event feedback information includes the abnormal event image data corresponding to the abnormal event and the abnormal event description information of the target account describing the abnormal event; the operation log includes the image data acquisition log and the tracking point operation log; the image data acquisition log is used to record the time when the target application obtains the abnormal event image data; the tracking point operation log is used to record the preset operation data generated by the target application during the operation;

[0007] Determine a log screening period based on the time when the abnormal event image data is acquired;

[0008] Filter the tracking point operation log based on the log filtering period to obtain the target tracking point operation log;

[0009] Based on the abnormal event description information, determine the target abnormal scenario corresponding to the abnormal event;

[0010] Based on the preset mapping information, the target abnormality analysis information corresponding to the target abnormality scenario is determined in the pre-built abnormality analysis information library; the preset mapping information is used to characterize the mapping relationship between the abnormal scenario and the abnormality analysis information;

[0011] Analyze the target tracking point operation log based on the target abnormality analysis information to obtain the abnormality analysis results corresponding to the abnormal event.

[0012] On the other hand, an embodiment of the present application further provides an application exception analysis device, the device comprising:

[0013] The acquisition module is used to obtain the abnormal event feedback information fed back by the target account when the target application encounters an abnormality and the operation log of the target application; the abnormal event feedback information includes the abnormal event image data corresponding to the abnormal event and the abnormal event description information of the target account describing the abnormal event; the operation log includes the image data acquisition log and the tracking point operation log; the image data acquisition log is used to record the time when the target application obtains the abnormal event image data; the tracking point operation log is used to record the preset operation data generated by the target application during the operation;

[0014] A log screening period determination module, used to determine the log screening period based on the time when the abnormal event image data is acquired;

[0015] A target tracking point operation log determination module is used to filter the tracking point operation log based on the log filtering period to obtain the target tracking point operation log;

[0016] A target abnormal scenario determination module is used to determine a target abnormal scenario corresponding to an abnormal event based on abnormal event description information;

[0017] A target abnormality analysis information determination module is used to determine the target abnormality analysis information corresponding to the target abnormality scenario in a pre-built abnormality analysis information library based on preset mapping information; the preset mapping information is used to characterize the mapping relationship between the abnormal scenario and the abnormality analysis information;

[0018] The abnormal analysis result determination module is used to analyze the target tracking point operation log based on the target abnormal analysis information to obtain the abnormal analysis result corresponding to the abnormal event.

[0019] On the other hand, an embodiment of the present application also provides an electronic device for application anomaly analysis, the electronic device comprising a processor and a memory, the memory storing at least one instruction or at least one program, the at least one instruction or at least one program being loaded and executed by the processor to implement the application anomaly analysis method as described above.

[0020] On the other hand, an embodiment of the present application also provides a computer-readable storage medium, in which at least one instruction or at least one program is stored, and the at least one instruction or the at least one program is loaded and executed by a processor to implement the application exception analysis method as described above.

[0021] On the other hand, an embodiment of the present application further provides a computer program product, which, when executed by a processor, implements the application exception analysis method as described above.

[0022] The application exception analysis method, device, electronic device and storage medium proposed in the embodiment of the present application obtain the abnormal event feedback information fed back by the target account when the target application is abnormal and the operation log of the target application, and obtain the time when the target application obtains the abnormal event image data, and determines the log screening period based on the time of obtaining the abnormal event image data, so that the buried point operation log can be screened based on the log screening period to obtain the target buried point operation log, which greatly reduces the number of logs for abnormal analysis. Then, based on the abnormal event description information, the target abnormal scenario corresponding to the abnormal event is determined, and based on the preset mapping information, the target abnormal analysis information corresponding to the target abnormal scenario is determined in the pre-built abnormal analysis information library, so that the target buried point operation log is analyzed based on the target abnormal analysis information, and the abnormal analysis result corresponding to the abnormal event is obtained, which realizes the automatic analysis of the fault time, reduces the system resource consumption in the abnormal analysis process, and improves the efficiency of abnormal analysis. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions and advantages in the embodiments of the present application or the prior art, the drawings required for use in the embodiments or the prior art descriptions are briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 The present invention is a schematic diagram of an implementation environment of an application exception analysis method according to an exemplary embodiment.

[0025] Figure 2 The following is a flow chart of a method for analyzing an application exception according to an exemplary embodiment. Figure 1 .

[0026] Figure 3 The figure is a schematic diagram of a flow chart of generating an image data acquisition log according to an exemplary embodiment.

[0027] Figure 4 The present invention is a block diagram of components for constructing an abnormality analysis information base according to an exemplary embodiment.

[0028] Figure 5 The figure is a functional schematic diagram of a context extractor according to an exemplary embodiment.

[0029] Figure 6 The present invention is a schematic diagram of a process of generating abnormal analysis information according to an exemplary embodiment.

[0030] Figure 7 It is a flowchart showing a process of analyzing a target tracking point operation log based on target abnormality analysis information according to an exemplary embodiment.

[0031] Figure 8 The following is a flow chart of a method for analyzing an application exception according to an exemplary embodiment. Figure 2 .

[0032] Fig. 9 The figure is a block diagram of an application exception analysis system according to an exemplary embodiment.

[0033] Fig.10 The present invention is a block diagram of a device for analyzing application exceptions according to an exemplary embodiment.

[0034] Fig.11 The present invention is a hardware structure block diagram of a server of a method for analyzing anomalies of an application program provided according to an exemplary embodiment. DETAILED DESCRIPTION

[0035] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without making creative work are within the scope of protection of this application.

[0036] It should be noted that the terms "first", "second", etc. in the specification and claims of the embodiment of the present application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the embodiment of the present application described here can be implemented in an order other than those illustrated or described here. Thus, the features defined as "first" and "second" can expressly or implicitly include one or more of the features. In the description of the present embodiment, unless otherwise specified, the meaning of "multiple" is two or more. In addition, the terms "including" and "having" and any of their variations are intended to cover non-exclusive inclusions, for example, a process, method, system, product or server comprising a series of steps or units is not necessarily limited to those steps or units clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0037] In order to make the purpose, technical solution and advantages disclosed in the embodiments of the present application more clearly understood, the embodiments of the present application are further described in detail below in conjunction with the accompanying drawings and embodiments. It should be understood that the specific embodiments described herein are only used to explain the embodiments of the present application and are not used to limit the embodiments of the present application.

[0038] The APP used by users is the result of the developer's code being packaged into an application package or a format installation package and installed on the user's terminal. The APP already contains some log codes, which will be output to the log file during runtime. In the process of using the APP, in addition to the APP experience logic, the user will also record some contextual information during the code running process and output it to the log file. Once a problem is encountered during use, the APP will guide the user to record relevant information in the form of text, screenshots or screen recordings, and then send this information to the APP background for processing.

[0039] At present, the APP backend usually handles these abnormal information by feeding it back to the operator for processing. When the operator receives the user feedback information, it will analyze it in combination with the context information recorded in the source file and log file of the APP. However, this solution has several problems. On the one hand, due to the large volume of logs, the time point of the application exception is specified to a certain moment based on the feedback information. For APP, the log file is generally very large, and even hundreds or thousands of lines of user logs are generated every second. However, the text, images and other information in the abnormal feedback information can often only display the time with the "hour: minute" accuracy displayed by the terminal device, which will affect the context division of the log file. On the other hand, the abnormal analysis efficiency is low and common problems cannot be clustered. When the application encounters an abnormal problem, the operator often needs to use experience or find the corresponding log embedding code to continuously reduce the scope of investigation and finally find the cause in the log file. Once it recurs, this process still needs to be repeated. In addition, the abnormal analysis method has relatively high requirements for operators. Log analysis and APP code are highly correlated, so operators need to be familiar with the code business logic.

[0040] In view of this, the present application provides an application exception analysis method, device, electronic device and storage medium, by obtaining the abnormal event feedback information fed back by the target account when the target application is abnormal and the operation log of the target application, the time when the target application obtains the abnormal event image data is obtained, and the log screening period is determined based on the time of obtaining the abnormal event image data, so that the buried point operation log can be screened based on the log screening period to obtain the target buried point operation log, which greatly reduces the number of logs for abnormal analysis. Then, based on the abnormal event description information, the target abnormal scene corresponding to the abnormal event is determined, and based on the preset mapping information, the target abnormal analysis information corresponding to the target abnormal scene is determined in the pre-built abnormal analysis information library, so that the target buried point operation log is analyzed based on the target abnormal analysis information, and the abnormal analysis result corresponding to the abnormal event is obtained, which realizes the automatic analysis of the fault time, reduces the system resource consumption in the abnormal analysis process, and improves the efficiency of abnormal analysis.

[0041] Figure 1 FIG. 1 is a schematic diagram showing an implementation environment of an application exception analysis method according to an exemplary embodiment. Figure 1 As shown, the implementation environment may include at least a client 01 and a server 02. The client 01 and the server 02 may be directly or indirectly connected via wired or wireless communication, and this application does not impose any limitation thereto.

[0042] In the embodiment of the present application, the target application is installed in the client 01, and optionally, the target application may be a social application, a shopping application, a payment application, a group purchase application, a game application, a sharing application, a live broadcast application, a music application or a video application, etc. When the user uses the target application, in the event of an abnormality in the target application, the feedback information of the abnormal event and the operation log of the target application may be collected and sent to the server 02 for processing. Optionally, the client 01 may be a smart phone, a tablet computer, a laptop computer, a desktop computer, a smart speaker, an intelligent voice interaction device, a smart home appliance, a smart watch, a vehicle-mounted terminal, an aircraft, etc., but is not limited thereto. The embodiment of the present application may be applied to various scenarios, including but not limited to rendering and displaying interactive information involved in various scenarios such as cloud technology, artificial intelligence, smart transportation, and assisted driving.

[0043] In the embodiment of the present application, the server 02 can be used to obtain the abnormal event feedback information and the operation log of the target application fed back by the target account when the target application is abnormal, and determine the log screening period based on the time of obtaining the abnormal event image data, and screen the tracking point operation log based on the log screening period to obtain the target tracking point operation log, and determine the target abnormal scene corresponding to the abnormal event based on the abnormal event description information, and determine the target abnormal analysis information corresponding to the target abnormal scene in the pre-built abnormal analysis information base based on the preset mapping information, and analyze the target tracking point operation log based on the target abnormal analysis information to obtain the abnormal analysis result corresponding to the abnormal event. Optionally, the server 02 can be an independent physical server, or a server cluster or distributed system composed of multiple physical servers, or a cloud server that provides basic cloud computing services such as cloud services, cloud databases, cloud computing, cloud functions, cloud storage, network services, cloud communications, middleware services, domain name services, security services, content delivery networks (Content Delivery Network, CDN), and big data and artificial intelligence platforms.

[0044] It should be noted that Figure 1 This is just an example. In other scenarios, other implementation environments may also be included.

[0045] Figure 2 is a flowchart of a method for analyzing application exceptions according to an exemplary embodiment. The method can be used Figure 1In the implementation environment of. This specification provides the operating steps of the application exception analysis method as described in the embodiment or flowchart, but may include more or fewer operating steps based on routine or non-creative labor. The order of steps listed in the embodiment is only one way of executing the steps among many orders, and does not represent the only execution order. When the actual system or server product is executed, it can be executed in sequence or in parallel (for example, in a parallel processor or multi-threaded processing environment) according to the method shown in the embodiment or the accompanying drawings. Specific examples Figure 2 As shown, the method may include:

[0046] S101: Acquire abnormal event feedback information fed back by a target account when an abnormality occurs in a target application and an operation log of the target application.

[0047] In an embodiment of the present application, when the target account uses the target application in the client, if an abnormal event is encountered, such as failure to update data, flash back, etc., the abnormal event encountered can be fed back to the background server of the target application through the abnormal feedback service provided by the target application. When the abnormal event encountered by the target account is fed back to the background server, the abnormal feedback service provided by the target application can send abnormal event feedback information and the operation log of the target application to the background server for abnormal feedback. Specifically, the target account can provide abnormal feedback through a Hypertext Markup Language 5 (HTML5) page. Afterwards, the client of the target application can actively record the details of the abnormal event, and use methods such as uploading the operation log of the target application to feed back the abnormal event to the background server.

[0048] In an embodiment of the present application, the abnormal event feedback information may include abnormal event image data corresponding to the abnormal event and abnormal event description information of the target account describing the abnormal event. When the target account performs abnormal feedback, it can obtain the abnormal event image data corresponding to the abnormal event, such as calling the image data acquisition process through the abnormal feedback service provided by the target application to obtain the abnormal event image data. Optionally, the abnormal event image data can be a screenshot of the interface of the abnormal event, or it can be video image data corresponding to the abnormal event, such as recording the abnormal event through the image data acquisition process to obtain the video image corresponding to the abnormal event. In general, in order to describe the abnormal event more clearly, the target account can also describe the abnormal event in words when performing abnormal feedback, so as to obtain abnormal event description information.

[0049] In the embodiment of the present application, the operation log of the target application refers to the key context information recorded in the client by the target account during the use of the target application. Context information refers to the operating environment information of the target application at a certain point in time, as well as various related information summaries. The operation log of the target application can be used to assist in locating and analyzing abnormal events that occur during the use of the target application by the target account. Optionally, the operation log of the target application may include an image data acquisition log and a point-of-use operation log. The image data acquisition log is used to record the time when the target application acquires the image data of the abnormal event. In an optional implementation, the event notification of screenshot or screen recording is registered through the application programming interface (application programming interface, API) of the system in the client. If a screenshot or screen recording event occurs, the system will notify the target application. After the target application receives the notification of the system, the time when the screenshot or screen recording event occurs is written into the image data acquisition log. In another optional implementation, an image data acquisition process call detection service can be registered in the target application. When it is detected that the image data acquisition process is called, the time when the image data acquisition process is called can be recorded, and then the time when the image data acquisition process is called can be written into the image data acquisition log. Figure 3 is a schematic diagram of a flow chart of generating an image data acquisition log according to an exemplary embodiment. Figure 3 As shown, when the target application is started, the start time of the target application can be recorded. In some embodiments, when entering a page in the target application, the start time of the page can also be recorded. Register event notifications for screenshots or screen recordings through the system API. When a screenshot or screen recording event occurs, determine whether the system is performing a screenshot operation. If so, record the screenshot time. If not, further determine whether the system starts screen recording. If so, record the screen recording start time. If not, further determine whether the system ends screen recording. If so, record the screen recording start time, or record the screen recording start time and screen recording end time at the same time. The recorded screenshot time, screen recording start time or screen recording end time is written to the image data acquisition log.

[0050] In an embodiment of the present application, the embedded point operation log is used to record the preset operation data generated by the target application during operation. The source file (i.e., source code) corresponding to the target application includes some log embedded point source files, and the embedded point operation log can be generated by running these log embedded point source files. During the application development process, sometimes you need to know the execution of a certain source file (code), or the input / output value of a function, or some error information. Using the log embedded point source file, this information can be recorded and written into the embedded point operation log.

[0051] In an embodiment of the present application, when the background server corresponding to the target application receives the abnormal feedback from the client, it can first pre-process the acquired abnormal event feedback information and the operation log of the target application to eliminate invalid feedback information, thereby reducing the space occupied by the abnormal event feedback, and reducing the system resource consumption during subsequent abnormal analysis, thereby improving the efficiency of abnormal analysis. As an example, Table 1 is a table of abnormal feedback preprocessing results shown according to an exemplary embodiment. After receiving the abnormal feedback sent by the client, the background server can unify the feedback abnormal events into the following format as shown in Table 1 through abnormal feedback preprocessing:

[0052] Table 1. Result table of abnormal feedback preprocessing

[0053]

[0054] As shown in Table 1, after receiving the abnormal feedback from the client, the background server corresponding to the target application can record the time when the client makes feedback, and determine the feedback content, abnormal event screenshot, abnormal event screen recording, target account and contact information of the target account from the information fed back by the client. Among them, the feedback content can be the abnormal event description information fed back by the target account. The abnormal event image data fed back by the target account can be a screenshot of the abnormal event, or a screen recording of the abnormal event, or both can exist at the same time. When the background server performs preprocessing, it can record the file name of the screenshot of the abnormal event (such as screenshot.png in Table 1) and the file name of the screen recording of the abnormal event (such as screen_record.mp4 in Table 1) to facilitate subsequent search. In addition, the abnormal occurrence time refers to the time when the abnormal event occurs, which can be used to screen the operation log of the target application, thereby reducing the amount of investigation of the operation log during abnormal analysis, thereby improving the efficiency of abnormal analysis. Optionally, the abnormal occurrence time can be obtained by feedback from the target account, that is, the target account can fill in the abnormal occurrence time in the feedback information at the same time when performing abnormal feedback. In general, the time displayed in the client is "hour; minute", and the target account feedback obtains the abnormal occurrence time in "minutes". However, the recording method of the operation log is usually recorded in units of "seconds", "milliseconds", etc., so the time span in "minutes" is large, and it is not possible to effectively filter the operation log. In some embodiments, the abnormal occurrence time can also be determined according to the time of obtaining the abnormal event image data. Since the time of obtaining the abnormal event image data is the event notification of registering the screenshot or screen recording through the system API, the target application writes the occurrence time of the screenshot or screen recording event into the image data acquisition log according to the event notification. The recording method of this time is not affected by the time displayed by the client, such as the network clock with an accuracy of "seconds" and "milliseconds" can be used for recording. Therefore, determining the abnormal occurrence time according to the time of obtaining the abnormal event image data can improve the accuracy of the abnormal occurrence time. To determine the abnormal occurrence time according to the time of obtaining the abnormal event image data, specifically, if the abnormal event image data is an abnormal event screenshot, because the interface recorded by the abnormal event screenshot is the interface where the abnormal event occurs, the acquisition time of the abnormal event screenshot can be used as the abnormal event occurrence time.If the abnormal event image data is an abnormal event screen recording, the start time or end time of the abnormal time screen recording can be determined based on the image data acquisition log, and then the abnormal event screen recording is analyzed frame by frame. With the help of image recognition technology, such as optical character recognition (OCR), the image frame where the abnormal event occurred is determined. The time when the abnormal event occurred can be calculated based on the time difference between the image frame where the abnormal event occurs and the first frame image or last frame image of the abnormal event screen recording, as well as the start time or end time of the screen recording.

[0055] S103: Determine a log screening period based on the time when the abnormal event image data is acquired.

[0056] In an embodiment of the present application, the time for acquiring the abnormal event image data is to register an event notification of a screenshot or screen recording through a system API, and the target application writes the occurrence time of the screenshot or screen recording event into the image data acquisition log according to the event notification, and the time has a high degree of accuracy. Therefore, it can be used to determine the log screening period, so that the buried point operation log can be filtered according to the log screening period. Specifically, based on the time of acquiring the abnormal event image data, determining the log screening period can include: acquiring a preset screening time interval, and then determining the log screening period based on the time of acquiring the abnormal event image data and the preset screening time interval. By determining the log screening period based on the time of acquiring the abnormal event image data and the preset screening time interval, the accuracy of the obtained log screening period is improved, so that the log screening period can be used to accurately filter the point record log, reducing the number of logs analyzed during abnormal analysis.

[0057] In an embodiment of the present application, when determining the log screening period based on the time of acquiring the abnormal event image data and the preset screening time interval, the abnormal occurrence time can be first determined based on the time of acquiring the abnormal event image data. Optionally, the preset screening time interval can be a time period obtained based on experience, such as 3 minutes. Optionally, the preset screening time interval can also be a time period from the startup time of the page where the abnormal event occurs to the abnormal occurrence time. After obtaining the abnormal occurrence time and the preset screening time interval, the log screening period can be determined based on the abnormal occurrence time and the preset screening time interval.

[0058] S105: Filter the tracking point operation log based on the log screening period to obtain the target tracking point operation log.

[0059] In an embodiment of the present application, after obtaining the log screening period, the tracking point operation log can be screened based on the log screening period. For example, if the log screening period is a time period within 3 minutes before the abnormality occurs, the tracking point operation log can be screened according to the abnormality occurrence time to filter out the tracking point operation log within these 3 minutes and obtain the target tracking point operation log. For another example, if the log screening period is a time period from the startup time of the page where the abnormal event occurs to the abnormality occurrence time, the tracking point operation log can be screened from the startup time of the page where the abnormal event occurs to the abnormality occurrence time to obtain the target tracking point operation log.

[0060] S107: Determine a target abnormal scenario corresponding to the abnormal event based on the abnormal event description information.

[0061] In an embodiment of the present application, when performing an abnormal analysis, the background server of the target application can first determine the target abnormal scene corresponding to the abnormal event according to the abnormal event description information fed back by the client, so as to quickly determine the target abnormal analysis information for analyzing the abnormal event. When determining the target abnormal scene corresponding to the abnormal event, the abnormal event description information can be first segmented based on a preset segmentation method to obtain at least one abnormal description segmentation. Then, based on a pre-built preset abnormal scene library, each abnormal description segmentation is matched to obtain a segmentation scene matching result, so that the target abnormal scene corresponding to the abnormal event can be determined according to the segmentation scene matching result. By segmenting the abnormal event description information, and then using the obtained segmentation to match in the preset abnormal scene library, the target abnormal scene corresponding to the abnormal event can be quickly determined, thereby improving the efficiency of determining the target abnormal scene, and then improving the efficiency of abnormal event analysis.

[0062] In the embodiment of the present application, whether it is a log point source file or a point operation log, generally speaking, a string of multiple character combinations will be used for output. If you are not familiar with the application writing rules, it is difficult to read the log point source file and the point operation log. Moreover, there are a lot of log contents in the point operation log, and even after obtaining the target point operation log, it is still difficult to quickly find the line of log related to the problem. Therefore, by determining the target abnormal scenario corresponding to the abnormal event, the log corresponding to the target abnormal scenario can be quickly found, and the target abnormal scenario can be used to determine the target abnormal analysis information to analyze these logs, thereby realizing the rapid analysis of the abnormal event. For example, the target abnormal scenario is "the target account cannot hear others talking when using the audio and video sub-channel", and the target abnormal scenario can be used to quickly determine the target abnormal analysis information corresponding to the target abnormal scenario: "client version number", "user enters the audio and video sub-channel", "turn off the microphone", "unsubscribe from other people's voices", etc. These target abnormal analysis information can be used to perform abnormal analysis on the target point operation log. If the target abnormal analysis information of "unsubscribe from other people's voices" is finally hit, it can be quickly known that the target account cannot hear other people's voices because "unsubscribe from other people's voices.

[0063] In an embodiment of the present application, when performing word segmentation processing on the abnormal event description information, it can be implemented by means of a word segmentation algorithm, a word segmentation model, and other methods. As an example, Table 2 is an abnormal description word segmentation table shown according to an exemplary embodiment. The backend server can perform word segmentation on the abnormal event description information based on the word segmentation algorithm.

[0064] Table 2 An abnormal description word segmentation table

[0065]

[0066] As shown in Table 2, when performing word segmentation processing on the description information of abnormal events, the description information of abnormal events can be firstly segmented according to the part of speech or the content represented to obtain the word segmentation results. Then, the keywords in the word segmentation results are extracted, and the word segmentation results that have no actual meaning or are unimportant can be ignored, and finally the abnormal description word segmentation is obtained.

[0067] In an embodiment of the present application, a preset abnormal scenario library is configured in the background server of the target application, and the preset abnormal scenario library is configured with relevant information of the preset abnormal scenario. As an example, Table 3 is a preset abnormal scenario library shown according to an exemplary embodiment. The background server can match the preset abnormal scenario library based on the abnormal description segmentation, thereby obtaining the segmentation scene matching result.

[0068] Table 3 is a preset abnormal scenario library

[0069]

[0070] As shown in Table 3, the preset abnormal scene library includes scene identification, preset abnormal scene title, preset abnormal scene description, scene responsibility object and other information. When the background server uses the abnormal description segmentation to match in the preset abnormal scene library, the abnormal description segmentation can be matched with the preset abnormal scene description, or the abnormal description segmentation can be matched with the preset abnormal scene description and the preset scene title, so as to obtain the segmentation scene matching result. Optionally, the above matching process can be judged whether it matches according to whether the preset abnormal scene description or the preset scene title contains the corresponding abnormal description segmentation. If it is included, it indicates a match, and if it is not included, it does not match. In some embodiments, the above matching process can also be implemented by a similarity estimation model. For example, the preset abnormal scene description or the preset scene title and the abnormal description segmentation are input into the similarity estimation model for prediction, so as to obtain the corresponding prediction result. According to the prediction result, it is determined whether the abnormal description segmentation matches the preset abnormal scene, so as to obtain the segmentation scene matching result.

[0071] In an embodiment of the present application, according to the word segmentation scene matching result, the target abnormal scene corresponding to the abnormal event can be determined, and a mapping relationship between the abnormal description word segmentation and the scene identifier can be established. As an example, Table 4 is a mapping relationship table between an abnormal description word segmentation and a scene identifier according to an exemplary embodiment. As shown in Table 4, by establishing a mapping relationship between the abnormal description word segmentation and the scene identifier, the target abnormal scene corresponding to the abnormal event can be quickly determined, so that abnormal analysis can be performed based on the target abnormal scene.

[0072] Table 4 is a mapping table between abnormal description word segmentation and scene identification

[0073] Abnormal description segmentation Scene Identification renew 112 Information Card 115、116

[0074] S109: Based on the preset mapping information, determine the target abnormality analysis information corresponding to the target abnormality scenario in the pre-built abnormality analysis information library.

[0075] In an embodiment of the present application, the abnormal analysis information is described using a string and is used to match a series of strings that conform to a certain syntactic rule. Through the abnormal analysis information, a specific string that matches it can be quickly found. The abnormal analysis information can be composed of predefined strings and annotation information. The preset mapping information is used to characterize the mapping relationship between the abnormal scenario and the abnormal analysis information. Through the preset mapping information, the target abnormal analysis information corresponding to the target abnormal scenario can be quickly determined in the abnormal analysis information library, so that the target abnormal analysis information can be used to analyze the target point-of-sale operation log. The abnormal analysis information library can be constructed based on the log point-of-sale source file. Specifically, at least one log point-of-sale source file in the source file corresponding to the target application is obtained, and the log point-of-sale source file is used to obtain the point-of-sale operation log. By performing context extraction on each log point-of-sale source file, the context extraction result of each log point-of-sale source file is obtained, and then based on the context extraction result of each log point-of-sale source file, the abnormal analysis information corresponding to each log point-of-sale source file is determined, so that the abnormal analysis information corresponding to each log point-of-sale source file is classified based on the preset abnormal scenario to obtain the abnormal analysis information library. Since the constructed exception analysis information library is obtained based on the log tracking source file corresponding to the target application, the exception analysis information in the exception analysis information library can match the syntactic rules in the tracking operation log, so that the exception analysis information can be used to analyze the filtered target tracking operation log to determine the exception analysis result corresponding to the abnormal event.

[0076] In the embodiment of the present application, Figure 4 is a block diagram of a component for constructing an abnormal analysis information base according to an exemplary embodiment. Figure 4 As shown, the source files corresponding to the target application may include business logic source files, interactive interface source files, log point source files, and some other source files. When performing exception analysis, the point-of-use operation logs generated by the log point-of-use source files are usually analyzed. Therefore, the log point-of-use source files corresponding to the target application can be processed to build an exception analysis information library. Figure 4 As shown, there may be multiple log embedding source files corresponding to the target application. For each log embedding source file, context extraction can be performed through the context extractor to obtain the context extraction result, and then the exception analysis information generator can generate exception analysis information based on the context extraction result. Finally, the generated exception analysis information is classified through the exception analysis information classifier, thereby completing the construction of the exception analysis information library.

[0077] In an embodiment of the present application, when the context extractor performs context extraction on the log embedding source file, context extraction is performed on the class, function method and each line of source file in each log embedding source file respectively, and the class context extraction result, function method context extraction result and source file line context extraction result corresponding to each log embedding source file are obtained, and then the context extraction result of each log embedding source file is determined based on the class context extraction result, function method context extraction result and source file line context extraction result corresponding to each log embedding source file. By performing context extraction on the class, function method and source file line of the log embedding source file respectively, comprehensive log embedding source file context information can be obtained, so that the abnormal analysis information finally generated can accurately analyze the target embedding operation log.

[0078] In the embodiment of the present application, Figure 5 is a functional schematic diagram of a context extractor according to an exemplary embodiment. Figure 5 As shown, for any log embedding source file, when the context extractor performs context extraction on it, it can extract the context class annotation information of the class to which it belongs. Optionally, the class annotation information includes the functional description of the class, the file responsibility object, etc. The context extractor can also extract the context of the function method referenced by the log embedding source file, so as to obtain the annotation of the function method. In addition, the context extractor can also perform context extraction on the log embedding source file line by line, so as to obtain the log level, log body message, etc. contained in each line of the source file. Among them, the log level refers to the level of the embedding operation log generated by the log embedding source file. As an example, the level of the embedding operation log can be divided into several levels such as Verbose, Debug, Info, Warning, Fatal, and Silent according to the priority from low to high. The log body message can include a variable list and a log body splicing order. The log embedding source file may contain multiple variables in the body, and by extracting these variables, a variable list is formed. The log text splicing order refers to the point-of-use running log generated when the log point-of-use source file is run. It is usually organized in a certain splicing order, such as the following splicing order: time|process number|thread number|log level|text, and the text can be expressed as follows: string[variable]string[variable][variable]string[variable]..., that is, the variable is interspersed in the string. The above log text splicing order can be extracted by extracting the context of the log point-of-use source file line by line.

[0079] In an embodiment of the present application, the context extraction result corresponding to each log embedding source file includes the variable extraction result of each log embedding source file and the source file annotation information of each log embedding source file. When the abnormal analysis information generator generates abnormal analysis information based on the context extraction result, the non-variable characters in each log embedding source file can be determined based on the variable extraction result of each log embedding source file. Then, the characters that need to be escaped in the non-variable characters of each log embedding source file are escaped to obtain the escape processing result corresponding to each log embedding source file, and the escape processing result contains at least one variable of a preset variable type. By determining the replacement character corresponding to the variable of each preset variable type based on each preset variable type, and replacing the variable of each preset variable type based on each replacement character, the variable replacement result is obtained, so that the abnormal analysis information corresponding to each log embedding source file can be generated based on the variable replacement result corresponding to each log embedding source file and the source file annotation information corresponding to each log embedding source file. Based on the context extraction results extracted by the context extractor, by escaping the escape characters in the log embedding source file and replacing the variables in the log embedding source file, and then combining the source file annotation information in the context extraction results, the exception analysis information corresponding to the log embedding source file can be obtained. In this way, the abnormal analysis information finally obtained can match the syntactic rules in the embedding operation log, so that the abnormal analysis information can be used to analyze the selected target embedding operation log, so as to determine the abnormal analysis result corresponding to the abnormal event.

[0080] In an embodiment of the present application, for any log point source file, when the exception analysis information generator processes it, it can use some pre-defined specific characters and combinations of these specific characters to form a "regular string", and then combine the context extraction result obtained by the context extractor with this "regular string" to obtain the exception analysis information corresponding to the log point source file. Figure 6 is a schematic diagram of a process for generating abnormal analysis information according to an exemplary embodiment. Figure 6As shown, for any log point source file, when generating its corresponding exception analysis information, it is necessary to first regularize it. Specifically, the non-variable content in the log point source file can be replaced first. Non-variable content can be divided into escape characters and non-escape characters. If a character is a character that needs to be escaped in a regular expression, such as "[", "(", ".", "*", etc., you can add "\" as a prefix in front of this character when performing regular expression, such as "\[". If a character does not need to be escaped, then directly add the character to the escape processing result. In the escape processing result obtained after escaping the log point source file, the variable is not processed, so the variable needs to be replaced. When replacing the variable in the escape processing result, different preset replacement characters can be used for replacement according to different variable types. As an example, Table 5 is a variable type and preset replacement character comparison table shown according to an exemplary embodiment. As shown in Table 5, predefined strings can be used to replace variables of different variable types respectively.

[0081] Table 5 Comparison table of variable types and preset replacement characters

[0082] Variable Types Default replacement characters Integer Types (？<$11>\d*) String Type (？<$16>.*)

[0083] In the present application embodiment, Figure 6 As shown, all variables in the escape processing result are traversed, and each variable in the escape processing result is replaced to obtain the variable replacement result, that is, the regularized expression of the log buried source file. Then the source file annotations extracted by the context extractor are supplemented to the regularized expression of the log buried source file to obtain the abnormal analysis information of the log buried source file. In some embodiments, the regularized expression of the log buried source file can also be supplemented with rule description content based on experience, such as possible abnormalities, so as to make the obtained abnormal analysis information more complete. For the abnormal analysis information finally obtained, a preset storage format can be used for storage, such as json format.

[0084] In the embodiment of the present application, generally speaking, each log embedding source file is usually configured with scene description information. When the context of the log embedding source file is extracted, the scene information corresponding to each log embedding source file can also be obtained. Therefore, the abnormal analysis information finally generated can also contain the corresponding scene information. The scene information in the abnormal analysis information can include a scene identifier and a scene description. For example, the scene identifier is "112" and the scene description is "data update module". Each preset scene can correspond to one or more log embedding source files. Similarly, a preset scene can also include one or more abnormal analysis information. Different abnormal analysis information under the same preset scene can be identified by different information identifiers, such as "112_A" and "112_B". Each abnormal analysis information can correspond to different information descriptions. For example, the information description corresponding to the information identifier "112_A" can be "replace part of the content (Feed) in the information stream (Feed stream), and the replacement condition is that the content identifier (feed Id) matches, the current index is -1, and the data is abnormal", and the information description corresponding to the information identifier "112_B" can be "data update timeout". Similarly, different exception analysis information is generated by different log tracking source files, and their corresponding regular expressions are also different.

[0085] S111: Analyze the target tracking point operation log based on the target abnormality analysis information to obtain the abnormality analysis result corresponding to the abnormal event.

[0086] In an embodiment of the present application, after obtaining the target tracking point operation log and determining the target abnormal analysis information corresponding to the target abnormal scenario, the target tracking point operation log can be analyzed based on the target abnormal analysis information. Specifically, the target tracking point operation log is matched line by line based on the target abnormal analysis information, and when the target abnormal analysis information matches the preset single-line log in the target tracking point operation log, an information matching result is obtained; the preset single-line log is any single-line log in the target tracking point operation log, so that the abnormal analysis result corresponding to the abnormal event is determined based on the information matching result. By using the target abnormal analysis information to match the target tracking point log line by line, the abnormal analysis result corresponding to the abnormal event is obtained, which realizes the automated analysis of abnormal events, saves the system resources consumed by abnormal analysis, and improves the efficiency of abnormal analysis.

[0087] In the embodiment of the present application, the process of analyzing the target tracking point operation log based on the target abnormal analysis information is to use the target abnormal analysis information to analyze each line of the target tracking point operation log and parse the log output result. When a line of log can match a certain target abnormal analysis information, the target abnormal analysis information description will be displayed, thereby obtaining the abnormal analysis result corresponding to the abnormal event. Figure 7is a flow chart showing a process of analyzing a target tracking point operation log based on target abnormal analysis information according to an exemplary embodiment. Figure 7 As shown, when performing analysis, first obtain the target tracking point operation log, then read the single-line log in the target tracking point operation log, and use all the target abnormal analysis information to match the target tracking point operation log line by line. After the single-line log traversal in the target tracking point operation log is completed, the abnormal analysis result corresponding to the abnormal event is obtained according to the matching result of each line of the target tracking point operation log and all the target abnormal analysis information. For example, if a certain target abnormal analysis information matched by a certain line of log is "replace part of the content (Feed) in the information stream (Feed stream), the replacement condition is that the content identifier (feed Id) matches, the current index is -1, and the data is abnormal", the information description of the target abnormal analysis information can be used as the abnormal analysis result corresponding to the abnormal event. If the target tracking point operation log matches more than one target abnormal analysis information, these target abnormal description analysis information can be combined as the abnormal analysis result corresponding to the abnormal event. After obtaining the abnormal analysis result corresponding to the abnormal event, the abnormal analysis result corresponding to the abnormal event can also be saved. If the single-line log traversal in the target tracking point operation log is not completed, all the target abnormal analysis information continues to be used to match the single-line log in the target tracking point operation log.

[0088] In the embodiment of the present application, since the amount of information of the abnormal analysis result corresponding to the abnormal event finally obtained may be large, in order to enable the background operation and maintenance object of the target application to more conveniently query the abnormal analysis result corresponding to the abnormal event, after obtaining the abnormal analysis result, the abnormal analysis result can also be processed to generate an abnormal analysis output result for the background operation and maintenance object to consult. Specifically, based on the abnormal event feedback information and the abnormal analysis result, the abnormal analysis output result is generated; the abnormal analysis output result includes a query link of the abnormal analysis result, and the query link is used to characterize the query path of the abnormal analysis result.

[0089] In the embodiment of the present application, the abnormal analysis output result can be obtained by extracting key information in the abnormal event feedback and analysis process. As an example, Table 6 is an abnormal analysis output result table shown according to an exemplary embodiment. As shown in Table 6, the abnormal analysis output result can include an abnormal analysis conclusion.

[0090] Table 6 An abnormal analysis output result table

[0091]

[0092]

[0093]

[0094] As shown in Table 6, this part is a description of some key information supplemented to the abnormal events of the target application reported by the target account, such as combining the above-mentioned existing abnormal analysis results and the target tracking operation log to give a conclusion. The abnormal analysis conclusion in the abnormal analysis output result can be obtained by classifying the abnormal event feedback information and integrating it with the key information in the abnormal analysis process, such as the matched target abnormal scenario, abnormal analysis results, etc. in a fixed format. The analysis link of the abnormal event and the abnormal analysis result link in the abnormal analysis conclusion are to scan all logs in the target tracking operation log, match all existing target abnormal analysis information and logs, and form corresponding file links for all the hit target abnormal analysis information and the generated information output.

[0095] In the embodiment of the present application, Figure 8 The following is a flow chart of a method for analyzing an application exception according to an exemplary embodiment. Figure 2 ,like Figure 8 As shown, after the background server receives the abnormal feedback sent by the target account, it first extracts the abnormal event feedback information and the target application's running log and other information, and then extracts key information based on the abnormal event feedback information and the running log, such as extracting the target application version number, target account and other information. Then, the abnormal occurrence time is determined based on the abnormal event image data in the abnormal event feedback information. On the one hand, the abnormal event description information in the abnormal event feedback information can be segmented to obtain the abnormal description segmentation. Then, the abnormal description segmentation is matched with the preset abnormal scene to obtain the target abnormal scene corresponding to the abnormal event. Then, the target buried point record log is analyzed by using the target abnormal analysis information to obtain the abnormal analysis result corresponding to the abnormal event. On the other hand, the abnormal analysis output result is generated according to the key information extraction result and the abnormal analysis result. Finally, the abnormal analysis result and the abnormal analysis output result analysis result can be summarized and output, that is, the abnormal event feedback information, the running log of the target application are combined, and the abnormal analysis result obtained by matching the abnormal analysis information is summarized and processed and then output.

[0096] In the embodiment of the present application, in order to enable the target business management object to manage the possible exceptions of the target application, an alarm message can be generated when the abnormal analysis result meets the preset conditions. The alarm message is used to feedback the abnormal situation of the target application to the target business management object. By generating the alarm message, the risk management of the target application can be realized, and the occurrence of major system abnormalities can be avoided, thereby ensuring the security of the system and improving the efficiency of the background operation and maintenance.

[0097] In an embodiment of the present application, alarm information can be generated by an alarm detection module. A variety of alarm services are set in the alarm detection module, and alarm information is generated when the abnormal analysis results meet the preset conditions. The preset condition may be that the number of occurrences of a certain abnormal scenario is greater than a threshold, or the number of hits of the preset abnormal analysis information exceeds the threshold. As an example, Table 7 is an alarm service information table shown according to an exemplary embodiment. As shown in Table 7, the alarm detection module sets different alarm service identifiers for different alarm services, and defines the triggering conditions for each alarm service. The alarm detection module also sets different business management objects for each alarm service, and configures the distribution method of the corresponding alarm information, such as pushing the target front end (webhook), email, etc.

[0098] Table 7: Alarm service information table

[0099]

[0100] Fig. 9 is a block diagram of an application exception analysis system according to an exemplary embodiment. Fig. 9As shown, the application exception analysis system may include an exception occurrence time determination module, a log point module, an exception analysis module and an alarm detection module. The exception occurrence time determination module can realize the exception event occurrence time corresponding to the exception event screenshot and the exception event occurrence time corresponding to the exception event screen recording. The log point module is mainly aimed at the target application developer and the exception analysis object. The log point module can provide a set of log point interpretation solutions for the integrated development environment (IDE) in the form of a plug-in, so that the log itself is easier to understand, and then assist the subsequent exception analysis module. The log point module can realize the automatic generation of exception analysis information from the log point source file, and realize the import and export of log points in a visual way. The log point module has the characteristics of scalability, reusability and convenience. The log point module can support regular rule analysis of multiple programming languages, and can easily add exception analysis information. At the same time, the log point module can run in IDE and independent third-party software at the same time, taking into account the exception analysis of the application version development stage and the external network release stage. In addition, the log tracking module can conveniently generate exception analysis information in the form of an IDE plug-in by combining the variable type, comment content, etc. of the variables in the code. The exception analysis module is a central module used to connect other modules in series to form an application exception analysis system. The input of the exception analysis module is the abnormal event feedback information fed back by the target account when the target application is abnormal and the operation log of the target application, and outputs the abnormal analysis result. The exception analysis module can also provide some auxiliary information when there is no abnormal analysis result, and notify the associated module of the result. Among them, the abnormal time interval extraction submodule is used to determine the log screening period using the abnormal occurrence time determined by the abnormal occurrence time determination module. The abnormal classification linkage submodule is used to realize automatic clustering according to abnormal scenarios. The automatic analysis submodule can use the abnormal analysis information library built by the log tracking module for abnormal analysis. The new scenario reverse update submodule can, after receiving the feedback from the target account, supplement the new abnormal analysis information for the feedback that lacks the corresponding abnormal analysis information in combination with the tracking operation log. The notification submodule can notify the alarm detection module to generate alarm information. The alarm detection module can actively push the background alarm information to the target front end through business decoupling, such as webhook. In addition, the alarm detection module associates the abnormal analysis results with the alarm business, feeds back the abnormal conditions of the target application to the business management object, and provides support for the display of the results of the abnormal analysis.

[0101] The present application also provides an application exception analysis device. Fig.10 FIG. 1 is a block diagram of an application exception analysis device according to an exemplary embodiment. Fig.10As shown, the device may include at least:

[0102] The acquisition module 201 is used to acquire the abnormal event feedback information fed back by the target account when the target application has an abnormality and the operation log of the target application; the abnormal event feedback information includes the abnormal event image data corresponding to the abnormal event and the abnormal event description information of the target account describing the abnormal event; the operation log includes the image data acquisition log and the tracking point operation log; the image data acquisition log is used to record the time when the target application acquires the abnormal event image data; the tracking point operation log is used to record the preset operation data generated by the target application during the operation;

[0103] The log screening period determination module 203 is used to determine the log screening period based on the time when the abnormal event image data is acquired;

[0104] The target tracking point operation log determination module 205 is used to filter the tracking point operation log based on the log filtering period to obtain the target tracking point operation log;

[0105] A target abnormal scenario determination module 207 is used to determine a target abnormal scenario corresponding to the abnormal event based on the abnormal event description information;

[0106] The target abnormality analysis information determination module 209 is used to determine the target abnormality analysis information corresponding to the target abnormality scenario in the pre-built abnormality analysis information library based on the preset mapping information; the preset mapping information is used to characterize the mapping relationship between the abnormal scenario and the abnormality analysis information;

[0107] The abnormal analysis result determination module 211 is used to analyze the target tracking point operation log based on the target abnormal analysis information to obtain the abnormal analysis result corresponding to the abnormal event.

[0108] In some optional embodiments, the log screening period determination module includes:

[0109] A preset screening time interval obtaining unit, used to obtain a preset screening time interval;

[0110] The log screening period determination unit is used to determine the log screening period based on the time when the abnormal event image data is acquired and the preset screening time interval.

[0111] In some optional embodiments, the target abnormal scene determination module includes:

[0112] An abnormal description segmentation determination unit is used to perform segmentation processing on the abnormal event description information based on a preset segmentation method to obtain at least one abnormal description segmentation;

[0113] A word segmentation scene matching result determination unit is used to match each abnormal description word segmentation based on a pre-built preset abnormal scene library to obtain a word segmentation scene matching result;

[0114] The target abnormal scene determination unit is used to determine the target abnormal scene corresponding to the abnormal event according to the word segmentation scene matching result.

[0115] In some optional embodiments, the device further includes a construction module of an abnormality analysis information library, and the construction module of the abnormality analysis information library includes:

[0116] The log tracking point source file acquisition submodule is used to obtain at least one log tracking point source file in the source files corresponding to the target application; the log tracking point source file is used to obtain the tracking point operation log;

[0117] The context extraction result determination submodule is used to perform context extraction on each log embedding source file to obtain the context extraction result of each log embedding source file;

[0118] The abnormal analysis information determination submodule is used to determine the abnormal analysis information corresponding to each log embedding source file based on the context extraction result of each log embedding source file;

[0119] The exception analysis information library determines a submodule, which is used to classify the exception analysis information corresponding to each log embedding source file based on a preset exception scenario to obtain an exception analysis information library.

[0120] In some optional embodiments, the context extraction result determination submodule includes:

[0121] The context extraction unit is used to perform context extraction on the class, function method and each line of source file in each log embedding source file, and obtain the class context extraction result, function method context extraction result and source file line context extraction result corresponding to each log embedding source file;

[0122] The context extraction result determination unit is used to determine the context extraction result of each log embedding source file based on the class context extraction result, function method context extraction result and source file line context extraction result corresponding to each log embedding source file.

[0123] In some optional embodiments, the context extraction result corresponding to each log embedding source file includes the variable extraction result of each log embedding source file and the source file annotation information of each log embedding source file; the abnormal analysis information determination submodule includes:

[0124] A non-variable character determination unit, used to determine the non-variable characters in each log embedding source file based on the variable extraction result of each log embedding source file;

[0125] The escape processing result determination unit is used to perform escape processing on the characters that need to be escaped in the non-variable characters of each log embedding source file to obtain the escape processing result corresponding to each log embedding source file; the escape processing result includes at least one variable of a preset variable type;

[0126] A replacement character determination unit, used for determining, based on each preset variable type, a replacement character corresponding to a variable of each preset variable type;

[0127] A variable replacement result determination unit, used to replace a variable of each preset variable type based on each replacement character to obtain a variable replacement result;

[0128] The exception analysis information determination unit is used to generate exception analysis information corresponding to each log embedding source file based on the variable replacement result corresponding to each log embedding source file and the source file annotation information corresponding to each log embedding source file.

[0129] In some optional embodiments, the abnormal analysis result determination module includes:

[0130] An information matching result determination unit is used to match the target embedding point operation log line by line based on the target abnormality analysis information, and obtain an information matching result when the target abnormality analysis information matches a preset single-line log in the target embedding point operation log; the preset single-line log is any single-line log in the target embedding point operation log;

[0131] The abnormal analysis result determination unit is used to determine the abnormal analysis result corresponding to the abnormal event based on the information matching result.

[0132] In some optional embodiments, the device further comprises:

[0133] The abnormal analysis output result generation module is used to generate the abnormal analysis output result based on the abnormal event feedback information and the abnormal analysis result; the abnormal analysis output result includes a query link of the abnormal analysis result; the query link is used to represent the query path of the abnormal analysis result.

[0134] In some optional embodiments, the device further comprises:

[0135] The alarm information generation module is used to generate alarm information when the abnormal analysis result meets the preset conditions; the alarm information is used to feedback the abnormal situation of the target application to the target business management object.

[0136] It should be noted that the application anomaly analysis device embodiment provided in the present application embodiment and the above-mentioned application anomaly analysis method embodiment are based on the same inventive concept.

[0137] An embodiment of the present application also provides an electronic device for application anomaly analysis, the electronic device comprising a processor and a memory, the memory storing at least one instruction or at least one program, the at least one instruction or at least one program being loaded and executed by the processor to implement an application anomaly analysis method as provided in any of the above embodiments.

[0138] An embodiment of the present application also provides a computer-readable storage medium, which can be set in a terminal to store at least one instruction or at least one program for implementing a method in a method embodiment, and the at least one instruction or at least one program is loaded and executed by a processor to implement the application exception analysis method provided in the above method embodiment.

[0139] Optionally, in the embodiment of this specification, the storage medium may be located in at least one of the multiple network servers of the computer network. Optionally, in this embodiment, the above storage medium may include but is not limited to: a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk, and other media that can store program codes.

[0140] The memory of the embodiment of this specification can be used to store software programs and modules, and the processor executes various functional applications and data processing by running the software programs and modules stored in the memory. The memory may mainly include a program storage area and a data storage area, wherein the program storage area may store an operating system, applications required for functions, etc.; the data storage area may store data created according to the use of the device, etc. In addition, the memory may include a high-speed random access memory, and may also include a non-volatile memory, such as at least one disk storage device, a flash memory device, or other volatile solid-state storage device. Accordingly, the memory may also include a memory controller to provide the processor with access to the memory.

[0141] The embodiment of the present application also provides a computer program product or a computer program, which includes a computer instruction stored in a computer-readable storage medium. The processor of the computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the application exception analysis method provided by the above method embodiment.

[0142] The application exception analysis method provided in the embodiment of the present application can be executed in a terminal, a computer terminal, a server or a similar computing device. Taking running on a server as an example, Fig.11FIG. 1 is a hardware structure diagram of a server of an application exception analysis method provided according to an exemplary embodiment. Fig.10 As shown, the server 300 may have relatively large differences due to different configurations or performances, and may include one or more central processing units (CPU) 310 (the central processing unit 310 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA), a memory 330 for storing data, and one or more storage media 320 (such as one or more mass storage devices) for storing application programs 323 or data 322. Among them, the memory 330 and the storage medium 320 can be short-term storage or permanent storage. The program stored in the storage medium 320 may include one or more modules, each of which may include a series of instruction operations on the server. Furthermore, the central processing unit 310 can be configured to communicate with the storage medium 320 and execute a series of instruction operations in the storage medium 320 on the server 300. The server 300 may also include one or more power supplies 360, one or more wired or wireless network interfaces 350, one or more input and output interfaces 340, and / or one or more operating systems 321, such as Windows ServerTM, Mac OS XTM, UnixTM, LinuxTM, FreeBSDTM, etc.

[0143] The input / output interface 340 may be used to receive or send data via a network. The specific example of the network may include a wireless network provided by a communication provider of the server 300. In one example, the input / output interface 340 includes a network adapter (Network Interface Controller, NIC), which may be connected to other network devices via a base station so as to communicate with the Internet. In one example, the input / output interface 340 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0144] It can be understood by those skilled in the art that Fig.11 The structure shown is only for illustration and does not limit the structure of the above electronic device. Fig.11 More or fewer components as shown, or with Fig.11 Different configurations are shown.

[0145] It should be noted that the above-mentioned sequence of the embodiments of the present application is for description only and does not represent the advantages and disadvantages of the embodiments. The above-mentioned specific embodiments of this specification are described. Other embodiments are within the scope of the attached claims. In some cases, the actions or steps recorded in the claims can be performed in an order different from that in the embodiments and still achieve the desired results. In addition, the processes depicted in the drawings do not necessarily require the specific order or continuous order shown to achieve the desired results. In some embodiments, multitasking and parallel processing are also possible or may be advantageous.

[0146] Each embodiment in this specification is described in a progressive manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the device and server embodiments, since they are basically similar to the method embodiments, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiments.

[0147] A person skilled in the art will understand that all or part of the steps to implement the above embodiments may be accomplished by hardware, or by a program to instruct the relevant hardware, and the program may be stored in a computer-readable storage medium, and the above-mentioned storage medium may be a read-only memory, a disk or an optical disk, etc.

[0148] The above are only preferred embodiments of the present application and are not intended to limit the present application. Any modifications, equivalent substitutions, improvements, etc. made within the spirit and principles of the present application should be included in the protection scope of the present application.

Claims

1. A method for analyzing application exceptions, characterized in that: The method comprises: Acquire abnormal event feedback information fed back by the target account when an abnormality occurs in the target application and the operation log of the target application; the abnormal event feedback information includes abnormal event image data corresponding to the abnormal event and abnormal event description information of the target account describing the abnormal event; the operation log includes an image data acquisition log and a point-of-use operation log; the image data acquisition log is used to record the time when the target application acquires the abnormal event image data; the point-of-use operation log is used to record the preset operation data generated by the target application during operation; Determining a log screening period based on the time when the abnormal event image data is acquired; Filter the tracking point operation log based on the log screening period to obtain the target tracking point operation log; Based on the abnormal event description information, determining a target abnormal scenario corresponding to the abnormal event; Based on preset mapping information, determining the target abnormality analysis information corresponding to the target abnormality scenario in a pre-built abnormality analysis information library; the preset mapping information is used to characterize the mapping relationship between the abnormal scenario and the abnormality analysis information; The target tracking point operation log is analyzed based on the target abnormality analysis information to obtain an abnormality analysis result corresponding to the abnormal event.

2. The method according to claim 1, characterized in that The step of determining the log screening period based on the time of acquiring the abnormal event image data comprises: Get the preset filtering time interval; The log screening period is determined based on the time when the abnormal event image data is acquired and the preset screening time interval.

3. The method according to claim 1, characterized in that The determining, based on the abnormal event description information, a target abnormal scenario corresponding to the abnormal event includes: Performing word segmentation processing on the abnormal event description information based on a preset word segmentation method to obtain at least one abnormal description word segmentation; Based on the pre-built preset abnormal scenario library, each abnormal description word segmentation is matched to obtain a word segmentation scenario matching result; According to the word segmentation scene matching result, a target abnormal scene corresponding to the abnormal event is determined.

4. The method according to any one of claims 1 to 3, characterized in that: The method for constructing the abnormal analysis information database includes: Obtain at least one log embedding source file in the source files corresponding to the target application; the log embedding source file is used to obtain the embedding operation log; Performing context extraction on each of the log embedding source files to obtain context extraction results for each of the log embedding source files; Based on the context extraction result of each of the log embedding source files, determine the exception analysis information corresponding to each of the log embedding source files; Based on the preset abnormal scenario, the abnormal analysis information corresponding to each of the log embedding source files is classified to obtain the abnormal analysis information library.

5. The method according to claim 4, characterized in that The performing context extraction on each of the log embedding source files to obtain the context extraction result of each of the log embedding source files includes: Perform context extraction on the classes, function methods and each line of source files in each of the log embedding source files, and obtain the class context extraction result, function method context extraction result and source file line context extraction result corresponding to each of the log embedding source files; Based on the class context extraction result, function method context extraction result and source file line context extraction result corresponding to each of the log embedding source files, the context extraction result of each of the log embedding source files is determined.

6. The method according to claim 4, characterized in that The context extraction result corresponding to each of the log embedding source files includes the variable extraction result of each of the log embedding source files and the source file annotation information of each of the log embedding source files; The determining, based on the context extraction result of each of the log embedding source files, the exception analysis information corresponding to each of the log embedding source files includes: Based on the variable extraction result of each of the log embedding source files, determine the non-variable characters in each of the log embedding source files; Performing escape processing on the characters that need to be escaped in the non-variable characters of each of the log embedding source files to obtain an escape processing result corresponding to each of the log embedding source files; the escape processing result includes at least one variable of a preset variable type; Based on each of the preset variable types, determining a replacement character corresponding to each variable of the preset variable type; Based on each of the replacement characters, replace each variable of the preset variable type to obtain a variable replacement result; Based on the variable replacement result corresponding to each of the log embedding source files and the source file annotation information corresponding to each of the log embedding source files, the exception analysis information corresponding to each of the log embedding source files is generated.

7. The method according to claim 1, characterized in that The analyzing the target tracking point operation log based on the target abnormality analysis information to obtain the abnormality analysis result corresponding to the abnormal event includes: Based on the target abnormality analysis information, the target tracking point operation log is matched line by line, and when the target abnormality analysis information matches a preset single-line log in the target tracking point operation log, an information matching result is obtained; the preset single-line log is any single-line log in the target tracking point operation log; Based on the information matching result, an abnormality analysis result corresponding to the abnormal event is determined.

8. The method according to claim 1, characterized in that After analyzing the target tracking point operation log based on the target abnormality analysis information to obtain the abnormality analysis result corresponding to the abnormal event, the method further includes: Based on the abnormal event feedback information and the abnormal analysis result, an abnormal analysis output result is generated; the abnormal analysis output result includes a query link of the abnormal analysis result; the query link is used to represent a query path of the abnormal analysis result.

9. The method according to claim 7 or 8, characterized in that: After analyzing the target tracking point operation log based on the target abnormality analysis information to obtain the abnormality analysis result corresponding to the abnormal event, the method further includes: When the abnormal analysis result meets the preset conditions, an alarm message is generated; the alarm message is used to feedback the abnormal situation of the target application to the target business management object.

10. An application anomaly analysis device, characterized in that: The device comprises: An acquisition module is used to acquire abnormal event feedback information fed back by a target account when an abnormality occurs in a target application and an operation log of the target application; the abnormal event feedback information includes abnormal event image data corresponding to the abnormal event and abnormal event description information describing the abnormal event by the target account; the operation log includes an image data acquisition log and a point-of-use operation log; the image data acquisition log is used to record the time when the target application acquires the abnormal event image data; the point-of-use operation log is used to record preset operation data generated by the target application during operation; A log screening period determination module, used to determine the log screening period based on the time when the abnormal event image data is acquired; A target tracking point operation log determination module is used to filter the tracking point operation log based on the log filtering period to obtain the target tracking point operation log; A target abnormal scenario determination module, used to determine a target abnormal scenario corresponding to the abnormal event based on the abnormal event description information; A target abnormality analysis information determination module is used to determine the target abnormality analysis information corresponding to the target abnormality scenario in a pre-built abnormality analysis information library based on preset mapping information; the preset mapping information is used to characterize the mapping relationship between the abnormal scenario and the abnormality analysis information; The abnormal analysis result determination module is used to analyze the target embedding point operation log based on the target abnormal analysis information to obtain the abnormal analysis result corresponding to the abnormal event.

11. An electronic device for analyzing application anomalies, characterized in that: The device includes a processor and a memory, wherein the memory stores at least one instruction or at least one program, and the at least one instruction or at least one program is loaded by the processor and executes the application exception analysis method as described in any one of claims 1-9.

12. A computer-readable storage medium, characterized in that: The storage medium stores at least one instruction or at least one program, and the at least one instruction or at least one program is loaded and executed by the processor to implement the application exception analysis method according to any one of claims 1-9.

13. A computer program product, comprising a computer program, characterized in that When the computer program is executed by a processor, the application exception analysis method according to any one of claims 1 to 9 is implemented.

Images