Log system alarm information query method and device, equipment and medium

Abstract

The invention discloses a log system alarm information query method and device, equipment and a medium, and relates to the technical field of computers. Comprising the following steps: storing alarm information obtained from a target log system into a preset storage space; configuring indexes of different levels for the alarm information in the preset storage space based on different types of preset query conditions to obtain multi-level indexes; aggregating the corresponding alarm information in the preset storage space based on each level of index to obtain each alarm information aggregation result corresponding to each level of index; and when an alarm information query request for a target log system is obtained, determining a corresponding target alarm information aggregation result from each alarm information aggregation result based on a preset query condition of a type corresponding to the alarm information query request, and using the target alarm information aggregation result to respond to the alarm information query request. Therefore, the alarm query efficiency and response speed of the log system are improved, and the load of the database is reduced.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to a method, device, equipment and medium for querying alarm information of a log system. Background Art

[0002] Due to the complex production environment and ever-changing requirements, the log system will have various errors and exceptions, which are generally fed back to customers through alarms. Alarm query is crucial for the health status of the log system, debugging problems, security audits, etc.

[0003] Traditional alarm queries extract information directly from raw data, which means that every time there is a new query request, the system needs to scan the entire data set from scratch. As the amount of alarm data grows, this full-volume scan method will lead to a significant increase in query time, especially when the amount of data is very large. It may also lead to repeated calculations and waste of resources.

[0004] As can be seen from the above, how to improve the efficiency and response speed of the log system alarm query and reduce the database load is a problem that needs to be solved urgently. Summary of the invention

[0005] In view of this, the purpose of the present invention is to provide a method, device, equipment and medium for querying alarm information of a log system, which can improve the efficiency and response speed of querying alarms of a log system and reduce the load of a database. The specific scheme is as follows:

[0006] In a first aspect, the present application provides a method for querying alarm information of a log system, comprising:

[0007] The alarm information obtained from the target log system is stored in the preset storage space;

[0008] Configuring different levels of indexes for each alarm information in the preset storage space based on different types of preset query conditions to obtain a multi-level index;

[0009] Aggregating the corresponding alarm information in the preset storage space based on each level of index respectively, so as to obtain aggregation results of each alarm information corresponding to each level of index respectively;

[0010] When an alarm information query request for the target log system is obtained, the corresponding target alarm information aggregation result is determined from the various alarm information aggregation results based on the preset query conditions of the corresponding type of the alarm information query request, and the target alarm information aggregation result is used to respond to the alarm information query request.

[0011] Optionally, storing the alarm information obtained from the target log system into a preset storage space includes:

[0012] Use the preset data collection tool to obtain alarm information from the target log system in real time;

[0013] Preprocessing the alarm information based on a preset anomaly detection algorithm to obtain processed alarm information, and storing the processed alarm information in a preset storage space;

[0014] Among them, the preprocessing includes data cleaning of the alarm information and formatting the alarm information based on a preset standardized data format; the data cleaning includes eliminating redundant information in the alarm information and eliminating repeated alarm information and erroneously triggered alarm information.

[0015] Optionally, storing the alarm information obtained from the target log system into a preset storage space includes:

[0016] The alarm information obtained from the target log system is stored in the preset distributed database;

[0017] Accordingly, the method further includes:

[0018] While storing the alarm information in the preset distributed database, adjusting the resource allocation parameters of the preset distributed database using the trained reinforcement learning model;

[0019] Among them, the trained reinforcement learning model is a model obtained after training the preset reinforcement learning model using the historical data collected in advance; the resource allocation parameter is a parameter used to adjust the resource allocation of the preset distributed database in the process of storing the alarm information in the preset distributed database.

[0020] Optionally, after aggregating the corresponding alarm information in the preset storage space based on each level of index to obtain aggregation results of each alarm information corresponding to each level of index, the method further includes:

[0021] The preset stream processing framework is used to determine the incremental aggregation logic, and based on the incremental aggregation logic, the real-time alarm information aggregation result and the historical alarm information aggregation result are merged to obtain new alarm information aggregation results corresponding to the current indexes at each level.

[0022] Optionally, the log system alarm information query method further includes:

[0023] Determine a hotspot aggregation result from the aggregation results of each alarm information according to the historical query request, and store the hotspot aggregation result in a preset cache space;

[0024] Correspondingly, the using the target alarm information aggregation result to respond to the alarm information query request includes:

[0025] Determining whether the hotspot aggregation result includes the target alarm information aggregation result corresponding to the alarm information query request;

[0026] If the hotspot aggregation result includes the target alarm information aggregation result corresponding to the alarm information query request, the target alarm information aggregation result is obtained from the preset cache space, and the target alarm information aggregation result is used to respond to the alarm information query request.

[0027] Optionally, the log system alarm information query method further includes:

[0028] The aggregation results of each of the alarm information are analyzed to determine a target query pattern whose occurrence frequency is greater than a preset threshold, and the index construction strategy is updated based on the target query pattern.

[0029] Optionally, determining a corresponding target alarm information aggregation result from the alarm information aggregation results, and using the target alarm information aggregation result to respond to the alarm information query request includes:

[0030] Determine a first target alarm information aggregation result from the alarm information aggregation results, and respond to the alarm information query request using the first target alarm information aggregation result to return a coarse-grained query result to the client;

[0031] After the client obtains the coarse-grained query result, a second target alarm information aggregation result is determined from the alarm information aggregation results, and the second target alarm information aggregation result is used to respond to the alarm information query request to return a fine-grained query result to the client;

[0032] Among them, the query granularity corresponding to the first target alarm information aggregation result is greater than the query granularity corresponding to the second target alarm information aggregation result.

[0033] In a second aspect, the present application provides a log system alarm information query device, comprising:

[0034] An alarm information storage module is used to store the alarm information obtained from the target log system into a preset storage space;

[0035] A multi-level index generation module, used to configure different levels of indexes for each alarm information in the preset storage space based on different types of preset query conditions to obtain a multi-level index;

[0036] An alarm information aggregation module, used to aggregate the corresponding alarm information in the preset storage space based on each level of index, so as to obtain aggregation results of each alarm information corresponding to each level of index;

[0037] The alarm information query module is used to determine the corresponding target alarm information aggregation result from the various alarm information aggregation results based on the preset query conditions of the corresponding type of the alarm information query request when an alarm information query request for the target log system is obtained, and use the target alarm information aggregation result to respond to the alarm information query request.

[0038] In a third aspect, the present application provides an electronic device, including:

[0039] Memory, used to store computer programs;

[0040] The processor is used to execute the computer program to implement the aforementioned log system alarm information query method.

[0041] In a fourth aspect, the present application provides a computer-readable storage medium for storing a computer program, wherein the computer program implements the aforementioned log system alarm information query method when executed by a processor.

[0042] The present application provides a method for querying alarm information of a log system. The method comprises the following steps: firstly, storing the alarm information obtained from a target log system into a preset storage space; then configuring different levels of indexes for each alarm information in the preset storage space based on different types of preset query conditions to obtain a multi-level index; then respectively aggregating the corresponding alarm information in the preset storage space based on each level of index to obtain aggregation results of each alarm information corresponding to each level of index; finally, when an alarm information query request for the target log system is obtained, then, based on the preset query conditions of the corresponding type of the alarm information query request, determining a corresponding target alarm information aggregation result from the aggregation results of each alarm information, and using the target alarm information aggregation result to respond to the alarm information query request.

[0043] As can be seen from the above, after obtaining the alarm information from the target log system, the application stores the alarm information in a preset storage space, and configures different levels of indexes for each alarm information in the preset storage space based on different types of preset query conditions to obtain a multi-level index. During the query process, the query process of the alarm information can be refined by means of a multi-level index, the number of repeated information retrievals can be reduced, and the query efficiency can be improved. This can improve the efficiency and response speed of the log system alarm query and reduce the database load. BRIEF DESCRIPTION OF THE DRAWINGS

[0044] In order to more clearly illustrate the embodiments of the present invention or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings described below are only embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on the provided drawings without paying creative work.

[0045] Figure 1 A flow chart of a method for querying alarm information of a log system disclosed in this application;

[0046] Figure 2 A flowchart of a specific method for querying alarm information of a log system disclosed in this application;

[0047] Figure 3 This is another specific flow chart of a method for querying alarm information of a log system disclosed in this application;

[0048] Figure 4 A schematic diagram of a log system alarm information query device disclosed in this application;

[0049] Figure 5 This is a structural diagram of an electronic device disclosed in this application. DETAILED DESCRIPTION

[0050] The following will be combined with the drawings in the embodiments of the present invention to clearly and completely describe the technical solutions in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of the present invention.

[0051] In the context of big data, log systems are widely used, for example, in distributed systems, microservice architectures, and large-scale cloud computing environments. Due to the complex production environment and changing needs, these systems will have various errors and exceptions, and will be fed back to customers through alarms. Alarm data is crucial for the health status of the log system, debugging issues, security audits, etc. However, with the increase in data volume, traditional alarm query methods face challenges, mainly reflected in performance issues, resource consumption issues, and user experience issues. To this end, the present application provides a log system alarm information query solution that can improve the efficiency and response speed of log system alarm queries and reduce the load on the database.

[0052] See also Figure 1 As shown, the embodiment of the present application discloses a method for querying alarm information of a log system, including:

[0053] Step S11: storing the alarm information obtained from the target log system into a preset storage space.

[0054] In this embodiment, it is necessary to collect alarm information from the target log system and store the acquired alarm information in a preset storage space. Among them, the alarm information can be collected from the target log system in real time by a data collection tool, and the collected alarm information can be cleaned and formatted by integrating a preset anomaly detection algorithm. Specifically, the alarm information acquired from the target log system is stored in a preset storage space, which may include: acquiring the alarm information from the target log system in real time by using a preset data collection tool; performing data cleaning on the alarm information based on a preset anomaly detection algorithm and formatting the alarm information based on a preset standardized data format to obtain processed alarm information, and storing the processed alarm information in a preset storage space; wherein the data cleaning includes removing redundant information in the alarm information and removing duplicate alarm information and erroneously triggered alarm information. That is, alarm information is collected from the target log system in real time through data collection tools to ensure the integrity and timeliness of the alarm information data; and redundant information in the alarm information is removed through cleaning operations to improve the data quality of the alarm information; the data format of each alarm information is converted into a unified preset standardized data format through formatting operations to facilitate subsequent processing of the alarm information; and the alarm information repeatedly generated in the target log system and the alarm information triggered by system vulnerability anomalies are identified through an integrated anomaly detection algorithm, which can avoid additional alarm information query load and improve resource utilization of preset storage space.

[0055] It should be noted that, due to the large data flow and high concurrency required in the process of log system alarm query, the preset storage space needs to have certain stability and scalability. For example, in a specific implementation, a preset distributed database can be used as the above-mentioned preset storage space. Specifically, storing the alarm information obtained from the target log system in the preset storage space may include: storing the alarm information obtained from the target log system in the preset distributed database.

[0056] Furthermore, the system performance under different configurations can be predicted by the trained reinforcement learning model, and the database parameters and resource allocation can be automatically adjusted. Specifically, the log system alarm query method can also include: while storing the alarm information in the preset distributed database, adjusting the resource allocation parameters of the preset distributed database using the trained reinforcement learning model; wherein the trained reinforcement learning model is a model obtained by training the preset reinforcement learning model using the pre-collected historical data; the resource allocation parameters are parameters used to adjust the resource allocation of the preset distributed database in the process of storing the alarm information in the preset distributed database. That is, by adjusting the resource allocation parameters, the database parameters and resource allocation can be automatically adjusted to adapt to dynamic load changes. It can improve the stability of the system during the alarm information query process.

[0057] Step S12: configuring different levels of indexes for each alarm information in the preset storage space based on different types of preset query conditions to obtain a multi-level index.

[0058] In this embodiment, indexes of corresponding types are configured according to different types of preset query conditions, and the same type of index contains multiple indexes of different levels to obtain a multi-level index. Among them, the type of the preset query condition is a feature type that can represent the alarm information, and the corresponding alarm information can be queried by screening and querying the feature type. For example, the corresponding index can be configured according to the specific time information generated by the alarm information or according to the alarm level corresponding to the alarm information, and different levels of indexes can be configured according to the above time information and alarm level to obtain a multi-level index. It can be understood that the preset query conditions include but are not limited to the above-mentioned time information and alarm level used for examples, and the specific preset query conditions can be determined based on the needs of the actual application scenario, and are not specifically limited here.

[0059] Step S13: Aggregate the corresponding alarm information in the preset storage space based on each level of index to obtain aggregation results of each alarm information corresponding to each level of index.

[0060] In this embodiment, the corresponding alarm information in the preset storage space is aggregated based on each level of index to obtain the aggregation results of each alarm information corresponding to each level of index, and a materialized view is created to store the corresponding aggregation results. The materialized view is refreshed periodically or in real time to keep the data updated.

[0061] Further, a real-time data processing pipeline can be designed using a stream processing framework, and the acquired alarm information is cleaned, formatted, and aggregated through the data processing pipeline, and the incremental aggregation logic is implemented in the stream processing framework to merge the real-time aggregation results with the historical aggregation results. Specifically, the alarm information acquired from the target log system is stored in a preset storage space, which may include: using a preset data collection tool to acquire the alarm information from the target log system in real time; using a preset stream processing framework to pre-process the alarm information based on a preset anomaly detection algorithm to obtain processed alarm information, and storing the processed alarm information in a preset storage space. Correspondingly, after the corresponding alarm information in the preset storage space is aggregated based on each level of index to obtain the aggregation results of each alarm information corresponding to each level of index, it may also include: using a preset stream processing framework to determine the incremental aggregation logic, and merging the real-time alarm information aggregation results with the historical alarm information aggregation results based on the incremental aggregation logic to obtain new aggregation results of each alarm information corresponding to the current level of index, and saving the new aggregation results of each alarm information to the corresponding materialized view. That is, by using the stream processing framework to design a real-time data processing pipeline, the data processing efficiency of the alarm information can be accelerated, and by determining the incremental aggregation logic, the real-time aggregation results and the historical aggregation results can be quickly merged to achieve incremental aggregation.

[0062] Step S14: When an alarm information query request for the target log system is obtained, based on the preset query conditions of the corresponding type of the alarm information query request, the corresponding target alarm information aggregation result is determined from the various alarm information aggregation results, and the target alarm information aggregation result is used to respond to the alarm information query request.

[0063] In this embodiment, an alarm information query request for the target log system is obtained through a preset port, and a preset query condition of a type corresponding to the query request is determined, and based on the preset query condition, a corresponding target alarm information aggregation result is determined from the alarm information aggregation results, and the target alarm information aggregation result is used to obtain the corresponding alarm information from the preset storage space, so as to return the alarm information to the preset port to complete the response to the query request. Among them, the query can be refined according to different query granularities. Specifically, the determining of the corresponding target alarm information aggregation result from the alarm information aggregation results, and using the target alarm information aggregation result to respond to the alarm information query request, may include: determining the first target alarm information aggregation result from the alarm information aggregation results based on the first query granularity, and using the first target alarm information aggregation result to respond to the alarm information query request, so as to return a coarse-grained query result to the client; after the client obtains the coarse-grained query result, determining the second target alarm information aggregation result from the alarm information aggregation results based on the second query granularity, and using the second target alarm information aggregation result to respond to the alarm information query request, so as to return a fine-grained query result to the client; wherein the first query granularity is greater than the second query granularity. That is, by determining the first target alarm information aggregation result from the alarm information aggregation results based on the first query granularity, a preliminary query result can be quickly given, and the query can be gradually refined until a satisfactory accuracy is achieved, so that the contradiction between system performance and query requirements can be balanced, so that the system can run more efficiently.

[0064] As can be seen from the above, after the embodiment of the present application obtains the alarm information from the target log system in real time using the preset data collection tool, the alarm information is pre-processed based on the preset anomaly detection algorithm to obtain the processed alarm information, and the processed alarm information is stored in the preset storage space. And the resource allocation of the preset storage space is dynamically adjusted by the trained reinforcement learning model, which improves the resource utilization and reduces the difficulty of resource allocation. Based on different types of preset query conditions, different levels of indexes are configured for each alarm information in the preset storage space to obtain a multi-level index. In the query process, the query process of the alarm information can be refined by the multi-level index method, the number of repeated information retrievals can be reduced, and the query efficiency can be improved. Thus, the efficiency and response speed of the log system alarm query can be improved, and the load on the database can be reduced. At the same time, by determining the incremental aggregation logic, the real-time aggregation results and the historical aggregation results can be quickly merged to achieve incremental aggregation, and the aggregation of the newly added alarm information can be quickly completed, which can ensure that the newly added alarm information can be queried in time.

[0065] For further information, see Figure 2As shown, in order to reduce the number of times the alarm information is queried directly from the preset storage space and improve the alarm information query speed, the embodiment of the present application provides a specific log system alarm information query method, including:

[0066] Step S21: storing the alarm information obtained from the target log system into a preset storage space.

[0067] Step S22: configuring different levels of indexes for each alarm information in the preset storage space based on different types of preset query conditions to obtain a multi-level index.

[0068] Step S23: Aggregate the corresponding alarm information in the preset storage space based on each level of index to obtain aggregation results of each alarm information corresponding to each level of index.

[0069] Step S24: determining a hotspot aggregation result from the alarm information aggregation results according to the historical query request, and storing the hotspot aggregation result in a preset cache space.

[0070] In this embodiment, by analyzing the historical query requests for the target log system, the hotspot query conditions are determined, and the hotspot aggregation results are determined according to the hotspot query conditions, and the hotspot aggregation results are stored in a preset cache space. The preset cache space is used to store the hotspot aggregation results and the corresponding alarm information data.

[0071] Step S25: When an alarm information query request for the target log system is obtained, a corresponding target alarm information aggregation result is determined from the various alarm information aggregation results based on a preset query condition of a type corresponding to the alarm information query request.

[0072] Step S26: Determine whether the hotspot aggregation result includes the target alarm information aggregation result corresponding to the alarm information query request.

[0073] In this embodiment, by comparing the hotspot query condition corresponding to the hotspot aggregation result and the current query condition, it is determined whether the hotspot aggregation result includes the target alarm information aggregation result corresponding to the alarm information query request.

[0074] Step S27: If the hotspot aggregation result includes the target alarm information aggregation result corresponding to the alarm information query request, the target alarm information aggregation result is obtained from the preset cache space, and the target alarm information aggregation result is used to respond to the alarm information query request.

[0075] In this embodiment, if the hotspot aggregation result includes the target alarm information aggregation result corresponding to the alarm information query request, the target alarm information aggregation result is obtained from the preset cache space, and the alarm information corresponding to the target alarm information aggregation result is obtained from the preset cache space, so as to return the alarm information to the corresponding client to complete the response to the alarm information query request.

[0076] Among them, the specific implementation process of the above steps S21, S22, S23 and S25 can refer to the corresponding content in the previous embodiment, and will not be repeated here.

[0077] As can be seen from the above, the embodiment of the present application determines the hotspot query conditions by analyzing the historical query requests for the target log system, determines the hotspot aggregation results according to the hotspot query conditions, and stores the hotspot aggregation results in the preset cache space. And by comparing the hotspot query conditions corresponding to the hotspot aggregation results and the current query conditions, it is determined whether the hotspot aggregation results contain the target alarm information aggregation results corresponding to the alarm information query request. If the hotspot aggregation results contain the target alarm information aggregation results corresponding to the alarm information query request, the target alarm information aggregation results are obtained from the preset cache space, and the alarm information corresponding to the target alarm information aggregation results is obtained from the preset cache space, so as to return the alarm information to the corresponding client to complete the response to the alarm information query request. This can reduce the number of times the alarm information is directly queried from the preset storage space and improve the alarm information query speed.

[0078] For further information, see Figure 3 As shown, in order to optimize the index construction strategy and improve the alarm information query performance, the embodiment of the present application provides a specific log system alarm information query method, including:

[0079] Step S31: storing the alarm information obtained from the target log system into a preset storage space.

[0080] Step S32: configuring different levels of indexes for each alarm information in the preset storage space based on different types of preset query conditions to obtain a multi-level index.

[0081] Step S33: Aggregate the corresponding alarm information in the preset storage space based on each level of index to obtain aggregation results of each alarm information corresponding to each level of index.

[0082] Step S34: Analyze the aggregation results of each of the alarm information to determine a target query pattern whose occurrence frequency is greater than a preset threshold, and update the index construction strategy based on the target query pattern.

[0083] In this embodiment, the alarm information aggregation results are analyzed to determine the target query pattern with a frequency greater than a preset threshold, and the index construction strategy is updated based on the target query pattern. The preset threshold can be determined according to actual application conditions.

[0084] Furthermore, the aggregation results of each of the alarm information can be analyzed by an aggregation algorithm to determine the target query mode. Specifically, the log system alarm information query method can also include: analyzing the aggregation results of each of the alarm information by a clustering algorithm, analyzing the aggregation results of each of the alarm information to determine the target query mode, and updating the index construction strategy based on the target query mode. By using a clustering algorithm to mine the target query mode, the index construction strategy can be further optimized to improve the performance of alarm information query.

[0085] Step S35: When an alarm information query request for the target log system is obtained, based on the preset query conditions of the corresponding type of the alarm information query request, the corresponding target alarm information aggregation result is determined from the various alarm information aggregation results, and the target alarm information aggregation result is used to respond to the alarm information query request.

[0086] Among them, the specific implementation process of the above steps S31, S32, S33 and S35 can refer to the corresponding content in the previous embodiment, and will not be repeated here.

[0087] As can be seen from the above, the embodiment of the present application analyzes the aggregation results of each of the alarm information to determine the target query mode whose frequency of occurrence is greater than the preset threshold, and updates the index construction strategy based on the target query mode. It can enrich the diversity of multi-level indexes and improve the ability to respond to alarm information query requests. In this way, the index construction strategy can be optimized and the alarm information query performance can be improved.

[0088] Accordingly, see Figure 4 As shown, the present application also provides a log system alarm information query device, including:

[0089] The alarm information storage module 11 is used to store the alarm information obtained from the target log system into a preset storage space;

[0090] A multi-level index generation module 12, configured to configure different levels of indexes for each alarm information in the preset storage space based on different types of preset query conditions to obtain a multi-level index;

[0091] The alarm information aggregation module 13 is used to aggregate the corresponding alarm information in the preset storage space based on each level of index, so as to obtain aggregation results of each alarm information corresponding to each level of index;

[0092] The alarm information query module 14 is used to determine the corresponding target alarm information aggregation result from the various alarm information aggregation results based on the preset query conditions of the corresponding type of the alarm information query request when an alarm information query request for the target log system is obtained, and use the target alarm information aggregation result to respond to the alarm information query request.

[0093] As can be seen from the above, after the alarm information is obtained from the target log system, the embodiment of the present application stores the alarm information in a preset storage space, and configures different levels of indexes for each alarm information in the preset storage space based on different types of preset query conditions to obtain a multi-level index. During the query process, the query process of the alarm information can be refined by means of a multi-level index, the number of repeated information retrievals can be reduced, and the query efficiency can be improved. This can improve the efficiency and response speed of the log system alarm query and reduce the database load.

[0094] In some specific implementations, the alarm information storage module 11 may specifically include:

[0095] An alarm information collection unit, used to obtain alarm information from a target log system in real time using a preset data collection tool;

[0096] An alarm information preprocessing unit, used to preprocess the alarm information based on a preset anomaly detection algorithm to obtain processed alarm information, and store the processed alarm information in a preset storage space; wherein the preprocessing includes data cleaning of the alarm information and formatting the alarm information based on a preset standardized data format; the data cleaning includes removing redundant information in the alarm information and removing duplicate alarm information and erroneously triggered alarm information;

[0097] An alarm information storage unit, used to store the alarm information obtained from the target log system into a preset distributed database;

[0098] A storage space adjustment unit is used to adjust the resource allocation parameters of the preset distributed database using a trained reinforcement learning model while storing the alarm information in the preset distributed database; wherein the trained reinforcement learning model is a model obtained after training the preset reinforcement learning model using pre-collected historical data; and the resource allocation parameters are parameters used to adjust the resource allocation of the preset distributed database during the process of storing the alarm information in the preset distributed database.

[0099] In some specific implementations, the alarm information aggregation module 13 may specifically include:

[0100] The incremental aggregation unit is used to determine the incremental aggregation logic using a preset stream processing framework, and merge the real-time alarm information aggregation results with the historical alarm information aggregation results based on the incremental aggregation logic to obtain new alarm information aggregation results corresponding to the current indexes at each level.

[0101] In some specific implementations, the alarm information query module 14 may specifically include:

[0102] A first query request response unit, configured to determine a first target alarm information aggregation result from the alarm information aggregation results, and respond to the alarm information query request using the first target alarm information aggregation result to return a coarse-grained query result to the client;

[0103] The second query request corresponding unit is used to determine the second target alarm information aggregation result from the alarm information aggregation results after the client obtains the coarse-grained query result, and use the second target alarm information aggregation result to respond to the alarm information query request to return the fine-grained query result to the client.

[0104] In some specific implementations, the log system alarm information query device may further include:

[0105] A hotspot alarm information aggregation result caching module, used to determine a hotspot aggregation result from the alarm information aggregation results according to a historical query request, and store the hotspot aggregation result in a preset cache space;

[0106] A target alarm information aggregation result judgment module is used to judge whether the hotspot aggregation result includes the target alarm information aggregation result corresponding to the alarm information query request; if the hotspot aggregation result includes the target alarm information aggregation result corresponding to the alarm information query request, then obtain the target alarm information aggregation result from the preset cache space, and use the target alarm information aggregation result to respond to the alarm information query request;

[0107] The index construction strategy update module is used to analyze the aggregation results of each of the alarm information to determine the target query mode whose occurrence frequency is greater than a preset threshold, and update the index construction strategy based on the target query mode.

[0108] Furthermore, the present application also discloses an electronic device. Figure 5 It is a structural diagram of an electronic device 20 shown according to an exemplary embodiment, and the content in the figure cannot be regarded as any limitation on the scope of use of this application. The electronic device 20 may specifically include: at least one processor 21, at least one memory 22, a power supply 23, a communication interface 24, an input and output interface 25 and a communication bus 26. Among them, the memory 22 is used to store a computer program, and the computer program is loaded and executed by the processor 21 to implement the relevant steps in the log system alarm information query method disclosed in any of the aforementioned embodiments. In addition, the electronic device 20 in this embodiment can specifically be an electronic computer.

[0109] In this embodiment, the power supply 23 is used to provide working voltage for each hardware device on the electronic device 20; the communication interface 24 can create a data transmission channel between the electronic device 20 and the external device, and the communication protocol it follows is any communication protocol that can be applied to the technical solution of the present application, and is not specifically limited here; the input and output interface 25 is used to obtain external input data or output data to the outside world, and its specific interface type can be selected according to specific application needs and is not specifically limited here.

[0110] In addition, the memory 22, as a carrier for storing resources, can be a read-only memory, a random access memory, a disk or an optical disk, etc. The resources stored thereon can include an operating system 221, a computer program 222, etc., and the storage method can be temporary storage or permanent storage.

[0111] The operating system 221 is used to manage and control the hardware devices and computer program 222 on the electronic device 20, which can be Windows Server, Netware, Unix, Linux, etc. In addition to including a computer program that can be used to complete the log system alarm information query method performed by the electronic device 20 disclosed in any of the aforementioned embodiments, the computer program 222 can further include a computer program that can be used to complete other specific tasks.

[0112] Furthermore, the present application also discloses a computer-readable storage medium for storing a computer program; wherein, when the computer program is executed by a processor, the aforementioned disclosed log system alarm information query method is implemented. The specific steps of the method can refer to the corresponding contents disclosed in the aforementioned embodiments, and will not be repeated here.

[0113] In this specification, each embodiment is described in a progressive manner, and each embodiment focuses on the differences from other embodiments. The same or similar parts between the embodiments can be referred to each other. For the device disclosed in the embodiment, since it corresponds to the method disclosed in the embodiment, the description is relatively simple, and the relevant parts can be referred to the method part.

[0114] Professionals may further appreciate that the units and algorithm steps of each example described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware, computer software, or a combination of the two. In order to clearly illustrate the interchangeability of hardware and software, the composition and steps of each example have been generally described in the above description according to function. Whether these functions are performed in hardware or software depends on the specific application and design constraints of the technical solution. Professionals and technicians may use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0115] The steps of the method or algorithm described in conjunction with the embodiments disclosed herein may be implemented directly using hardware, a software module executed by a processor, or a combination of the two. The software module may be placed in a random access memory (RAM), a memory, a read-only memory (ROM), an electrically programmable ROM, an electrically erasable programmable ROM, a register, a hard disk, a removable disk, a CD-ROM, or any other form of storage medium known in the art.

[0116] Finally, it should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the presence of other identical elements in the process, method, article or device including the elements.

[0117] The technical solution provided by the present application is introduced in detail above. Specific examples are used in this article to illustrate the principles and implementation methods of the present application. The description of the above embodiments is only used to help understand the method of the present application and its core idea. At the same time, for general technicians in this field, according to the idea of ​​the present application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as a limitation on the present application.

Claims

1. A method for querying alarm information of a log system, characterized in that: include: The alarm information obtained from the target log system is stored in the preset storage space; Configuring different levels of indexes for each alarm information in the preset storage space based on different types of preset query conditions to obtain a multi-level index; Aggregating the corresponding alarm information in the preset storage space based on each level of index respectively, so as to obtain aggregation results of each alarm information corresponding to each level of index respectively; When an alarm information query request for the target log system is obtained, the corresponding target alarm information aggregation result is determined from the various alarm information aggregation results based on the preset query conditions of the corresponding type of the alarm information query request, and the target alarm information aggregation result is used to respond to the alarm information query request.

2. The method for querying alarm information of a log system according to claim 1, characterized in that: The step of storing the alarm information obtained from the target log system into a preset storage space includes: Use the preset data collection tool to obtain alarm information from the target log system in real time; Preprocessing the alarm information based on a preset anomaly detection algorithm to obtain processed alarm information, and storing the processed alarm information in a preset storage space; Among them, the preprocessing includes data cleaning of the alarm information and formatting the alarm information based on a preset standardized data format; the data cleaning includes eliminating redundant information in the alarm information and eliminating repeated alarm information and erroneously triggered alarm information.

3. The method for querying alarm information of a log system according to claim 1, characterized in that: The step of storing the alarm information obtained from the target log system into a preset storage space includes: The alarm information obtained from the target log system is stored in the preset distributed database; Accordingly, the method further includes: While storing the alarm information in the preset distributed database, adjusting the resource allocation parameters of the preset distributed database using the trained reinforcement learning model; Among them, the trained reinforcement learning model is a model obtained after training the preset reinforcement learning model using the historical data collected in advance; the resource allocation parameter is a parameter used to adjust the resource allocation of the preset distributed database in the process of storing the alarm information in the preset distributed database.

4. The method for querying alarm information of a log system according to claim 1, characterized in that: After the corresponding alarm information in the preset storage space is aggregated based on each level of index to obtain aggregation results of each alarm information corresponding to each level of index, the method further includes: The preset stream processing framework is used to determine the incremental aggregation logic, and based on the incremental aggregation logic, the real-time alarm information aggregation result and the historical alarm information aggregation result are merged to obtain new alarm information aggregation results corresponding to the current indexes at each level.

5. The method for querying alarm information of a log system according to claim 1, characterized in that: Also includes: Determine a hotspot aggregation result from the aggregation results of each alarm information according to the historical query request, and store the hotspot aggregation result in a preset cache space; Correspondingly, the using the target alarm information aggregation result to respond to the alarm information query request includes: Determining whether the hotspot aggregation result includes the target alarm information aggregation result corresponding to the alarm information query request; If the hotspot aggregation result includes the target alarm information aggregation result corresponding to the alarm information query request, the target alarm information aggregation result is obtained from the preset cache space, and the target alarm information aggregation result is used to respond to the alarm information query request.

6. The method for querying alarm information of a log system according to claim 1, characterized in that: Also includes: The aggregation results of each of the alarm information are analyzed to determine a target query pattern whose occurrence frequency is greater than a preset threshold, and the index construction strategy is updated based on the target query pattern.

7. The method for querying alarm information of a log system according to any one of claims 1 to 6, characterized in that: The determining a corresponding target alarm information aggregation result from the respective alarm information aggregation results, and using the target alarm information aggregation result to respond to the alarm information query request includes: Determine a first target alarm information aggregation result from the alarm information aggregation results, and respond to the alarm information query request using the first target alarm information aggregation result to return a coarse-grained query result to the client; After the client obtains the coarse-grained query result, a second target alarm information aggregation result is determined from the alarm information aggregation results, and the second target alarm information aggregation result is used to respond to the alarm information query request to return a fine-grained query result to the client; Among them, the query granularity corresponding to the first target alarm information aggregation result is greater than the query granularity corresponding to the second target alarm information aggregation result.

8. A log system alarm information query device, characterized in that: include: An alarm information storage module is used to store the alarm information obtained from the target log system into a preset storage space; A multi-level index generation module, used to configure different levels of indexes for each alarm information in the preset storage space based on different types of preset query conditions to obtain a multi-level index; An alarm information aggregation module, used to aggregate the corresponding alarm information in the preset storage space based on each level of index, so as to obtain aggregation results of each alarm information corresponding to each level of index; The alarm information query module is used to determine the corresponding target alarm information aggregation result from the various alarm information aggregation results based on the preset query conditions of the corresponding type of the alarm information query request when an alarm information query request for the target log system is obtained, and use the target alarm information aggregation result to respond to the alarm information query request.

9. An electronic device, characterized in that: include: Memory, used to store computer programs; A processor is used to execute the computer program to implement the log system alarm information query method as described in any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: Used to store a computer program, wherein when the computer program is executed by a processor, the log system alarm information query method according to any one of claims 1 to 7 is implemented.

Images