Log analysis method and device, electronic equipment and storage medium

Abstract

The invention provides a log analysis method and device, electronic equipment and a storage medium, and the method comprises the steps: generating a monitoring address rule, a log comparison rule, a data extraction rule and a log output rule according to an analysis service demand and system attributes of each subsystem; monitoring the operation condition of each subsystem in real time, and determining a query log from each subsystem according to a monitoring address rule; comparing the query logs according to a log comparison rule; when the query log is matched with the log comparison rule, extracting target data from the query log according to a data extraction rule; and outputting the target data as a display log according to a log output rule. According to the method, the computer integrated manufacturing system serves as an object, the logs generated by the subsystems in the computer integrated manufacturing system are stored and processed in a centralized mode, formats are unified, analysis and management of the logs are facilitated, and the working efficiency is improved.

Description

Technical Field

[0001] The present application relates to the technical field of log analysis, and in particular to a method, device, electronic device and storage medium for log analysis. Background Art

[0002] Log analysis is the process of examining log data generated by the entire network. Log data is generated from a variety of sources, including peripherals, workstations, servers, applications, and other hardware and software components. Collecting and analyzing this information centrally can help better understand network operations, troubleshoot problems, and maintain network security.

[0003] In a smart factory environment, different devices and systems often use multiple communication protocols, such as HSMS protocol and CC-Link IE protocol. These protocols bring many challenges in log recording and management. When analyzing the smart factory environment, the existing technology can only analyze each subsystem as the object, which is time-consuming, labor-intensive and inefficient. Summary of the invention

[0004] In view of this, the purpose of the present application is to provide a log analysis method, device, electronic device and storage medium to overcome the problems in the prior art.

[0005] In a first aspect, an embodiment of the present application provides a log analysis method, which is applied to a computer integrated manufacturing system, wherein the computer integrated manufacturing system includes a plurality of subsystems arranged according to processes, and each subsystem uses a different communication protocol, and the method includes:

[0006] Generate analysis rules based on the analysis of business requirements and system properties of each of the subsystems; wherein the analysis rules include monitoring address rules, log comparison rules, data extraction rules and log output rules;

[0007] Monitor the operation status of each of the subsystems in real time, and determine the query log from each of the subsystems according to the monitoring address rule;

[0008] Comparing the query logs according to the log comparison rule;

[0009] When the query log matches the log comparison rule, extracting target data from the query log according to the data extraction rule;

[0010] According to the log output rule, the target data is output as a display log.

[0011] In some technical solutions of the present application, the above-mentioned analysis rules are generated according to the analysis of business requirements and system properties of each of the subsystems; wherein the analysis rules include monitoring address rules, log comparison rules, data extraction rules and log output rules, including:

[0012] Generating the monitoring address rules according to the storage attributes of each of the subsystems;

[0013] Generating the log comparison rules according to the configuration specification files of each of the subsystems;

[0014] Generating the data extraction rules according to the analysis business requirements and the configuration specification files of each of the subsystems;

[0015] The log output rules are generated according to the analyzed business requirements.

[0016] In some technical solutions of the present application, the real-time monitoring of the operation of each of the subsystems and determining the query log from each of the subsystems according to the monitoring address rule include:

[0017] Monitor the operation status of each of the subsystems in real time, and when any of the subsystems generates a new log, determine the new log from each of the subsystems according to the monitoring address rule;

[0018] The new log is used as the query log.

[0019] In some technical solutions of the present application, the real-time monitoring of the operation of each of the subsystems and determining the query log from each of the subsystems according to the monitoring address rule include:

[0020] The operation status of each of the subsystems is monitored in real time. When a log query operation is detected, the query log is determined from the historical logs of each of the subsystems according to the query conditions corresponding to the log query operation and the monitoring address rules.

[0021] In some technical solutions of the present application, the above method further includes:

[0022] When the query log does not match the log comparison rule, an error prompt message is output according to the log output rule.

[0023] In some technical solutions of the present application, when the query log matches the log comparison rule, extracting the target data from the query log according to the data extraction rule includes:

[0024] When the query log matches the log comparison rule, extracting all or part of the data from the query log according to the data extraction rule;

[0025] The whole data or the part of the data is used as the target data.

[0026] In some technical solutions of the present application, the above-mentioned log output rules include address storage rules and format output rules;

[0027] Outputting the target data as a display log according to the log output rule includes:

[0028] Performing format conversion on the target data according to the format output rule to obtain target data in a target format corresponding to the format output rule;

[0029] The target data in the target format is stored and displayed according to the address storage rule.

[0030] In a second aspect, an embodiment of the present application provides a log analysis device, which is applied to a computer integrated manufacturing system, wherein the computer integrated manufacturing system includes a plurality of subsystems arranged according to processes, and each subsystem uses a different communication protocol, and the device includes:

[0031] A generation module, used to generate analysis rules according to the analysis business requirements and the system properties of each of the subsystems; wherein the analysis rules include monitoring address rules, log comparison rules, data extraction rules and log output rules;

[0032] A monitoring module, used to monitor the operation of each of the subsystems in real time, and determine the query log from each of the subsystems according to the monitoring address rule;

[0033] A comparison module, used to compare the query logs according to the log comparison rules;

[0034] A matching module, configured to extract target data from the query log according to the data extraction rule when the query log matches the log comparison rule;

[0035] The output module is used to output the target data as a display log according to the log output rule.

[0036] In a third aspect, an embodiment of the present application provides an electronic device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the above-mentioned log analysis method when executing the computer program.

[0037] In a fourth aspect, an embodiment of the present application provides a computer-readable storage medium, on which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned log analysis method are executed.

[0038] The technical solution provided by the embodiments of the present application may have the following beneficial effects:

[0039] The method of the present application includes generating analysis rules according to analyzing business requirements and system properties of each of the subsystems; wherein the analysis rules include monitoring address rules, log comparison rules, data extraction rules and log output rules; real-time monitoring of the operation status of each of the subsystems, and determining query logs from each of the subsystems according to the monitoring address rules; comparing the query logs according to the log comparison rules; extracting target data from the query log according to the data extraction rules when the query log matches the log comparison rules; and outputting the target data as a display log according to the log output rules.

[0040] This application takes a computer integrated manufacturing system as the object, centrally stores, centrally processes, and unifies the format of logs generated by various subsystems in the computer integrated manufacturing system, facilitates the analysis and management of the logs, and improves work efficiency.

[0041] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, preferred embodiments are specifically cited below and described in detail with reference to the attached drawings. BRIEF DESCRIPTION OF THE DRAWINGS

[0042] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0043] Figure 1 A flow chart of a log analysis method provided in an embodiment of the present application is shown;

[0044] Figure 2 A schematic diagram showing another log analysis method provided by an embodiment of the present application is shown;

[0045] Figure 3 A schematic diagram of a log analysis device provided in an embodiment of the present application is shown;

[0046] Figure 4 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0047] To make the purpose, technical scheme and advantages of the embodiments of the present application clearer, the technical scheme in the embodiments of the present application will be clearly and completely described below in conjunction with the drawings in the embodiments of the present application. It should be understood that the drawings in the present application only serve the purpose of explanation and description and are not used to limit the scope of protection of the present application. In addition, it should be understood that the schematic drawings are not drawn in real proportion. The flowchart used in this application shows the operations implemented according to some embodiments of the present application. It should be understood that the operations of the flowchart can be implemented out of sequence, and the steps without logical context can be reversed in order or implemented simultaneously. In addition, those skilled in the art can add one or more other operations to the flowchart under the guidance of the content of the present application, or remove one or more operations from the flowchart.

[0048] In addition, the described embodiments are only a part of the embodiments of the present application, rather than all the embodiments. The components of the embodiments of the present application described and shown in the drawings here can be arranged and designed in various configurations. Therefore, the following detailed description of the embodiments of the present application provided in the drawings is not intended to limit the scope of the application claimed for protection, but merely represents the selected embodiments of the present application. Based on the embodiments of the present application, all other embodiments obtained by those skilled in the art without making creative work belong to the scope of protection of the present application.

[0049] It should be noted that the term "comprising" will be used in the embodiments of the present application to indicate the existence of the features declared thereafter, but does not exclude the addition of other features.

[0050] Log analysis is the process of examining log data generated by the entire network. Log data is generated from a variety of sources, including peripherals, workstations, servers, applications, and other hardware and software components. Collecting and analyzing this information centrally can help better understand network operations, troubleshoot problems, and maintain network security.

[0051] In a smart factory environment, different devices and systems often use multiple communication protocols, such as HSMS protocol and CC-Link IE protocol. These protocols bring many challenges in log recording and management. The existing technical solutions have the following problems when processing these log information:

[0052] Decentralized log management: When devices and systems in smart factories use different communication protocols, each protocol has its own independent log recording method and format. This causes CIM (computer integrated manufacturing) maintenance personnel to log in to multiple different log management systems or view multiple log files to obtain complete log information. This decentralized management method not only increases the complexity of maintenance, but also greatly increases the workload of maintenance personnel.

[0053] Manual log analysis: Due to the huge differences in log formats and structures between different protocols, CIM maintenance personnel usually need to manually analyze these logs to extract key information for troubleshooting and performance monitoring. Manual analysis is not only inefficient, but also prone to errors or omissions of key information when processing a large number of logs in different formats, which seriously affects the stability of smart factory operations and the timeliness of maintenance.

[0054] High maintenance cost: Due to the differences in log recording formats and structures among different communication protocols, CIM maintenance personnel need to have extensive expertise and experience when viewing and analyzing these logs. This not only increases the training cost of maintenance personnel, but may also lead to the inability to solve problems in a timely manner in an emergency due to the lack of relevant knowledge by maintenance personnel, further increasing maintenance costs.

[0055] Based on this, the embodiments of the present application provide a log analysis method, device, electronic device and storage medium, which are described below through embodiments.

[0056] Figure 1 A flow chart of a log analysis method provided in an embodiment of the present application is shown, which is applied to a computer integrated manufacturing system, wherein the computer integrated manufacturing system includes a plurality of subsystems arranged according to processes, and each subsystem uses a different communication protocol, wherein the method includes steps S101-S105; specifically:

[0057] S101, generating analysis rules according to the analysis of business requirements and system properties of each of the subsystems; wherein the analysis rules include monitoring address rules, log comparison rules, data extraction rules and log output rules;

[0058] S102, monitoring the operation status of each of the subsystems in real time, and determining a query log from each of the subsystems according to the monitoring address rule;

[0059] S103, comparing the query logs according to the log comparison rule;

[0060] S104, when the query log matches the log comparison rule, extracting target data from the query log according to the data extraction rule;

[0061] S105: Output the target data as a display log according to the log output rule.

[0062] This application takes a computer integrated manufacturing system as the object, centrally stores, centrally processes, and unifies the format of logs generated by various subsystems in the computer integrated manufacturing system, facilitates the analysis and management of the logs, and improves work efficiency.

[0063] Some embodiments of the present application are described in detail below. In the absence of conflict, the following embodiments and features in the embodiments can be combined with each other.

[0064] The present application takes the computer integrated manufacturing system as the object and performs centralized analysis and processing on the logs generated by each subsystem under the computer integrated manufacturing system. Due to the difference in the protocols in different subsystems, in order to realize the process of centralized analysis and processing, it is necessary to use a unified analysis rule. Therefore, the embodiment of the present application needs to take the computer integrated manufacturing system as the object to determine the analysis business demand of the computer integrated manufacturing system. After determining the analysis business demand of the computer integrated manufacturing system, combined with the system data of each subsystem in the computer integrated manufacturing system, a unified analysis rule is generated. The analysis business demand here includes the log format, storage location, etc. that the user wants. The system attributes of the subsystem here include configuration specification files (Spec documents), etc.

[0065] When specifically generating the analysis rules, it includes generating the monitoring address rules according to the storage attributes of each of the subsystems; generating the log comparison rules according to the configuration specification files of each of the subsystems; generating the data extraction rules according to the analysis business requirements and the configuration specification files of each of the subsystems; and generating the log output rules according to the analysis business requirements. Among them, the monitoring address rules are used to determine the extraction monitoring addresses of different protocol logs and the protocol names used under the addresses; the log comparison rules are used to determine whether the monitored logs have anomalies; the data extraction rules are used to extract the required data from the monitoring logs; and the log output rules are used to obtain logs in the required format.

[0066] After generating the above analysis rules, monitor the operation status of each subsystem in real time, and according to the monitoring address rules, go to the corresponding monitoring address to determine the query log. Then match and compare the query log according to the log comparison rules to obtain the result that the query log matches the log comparison rules or the query log does not match the log comparison rules. When the query log does not match the log comparison rules, output an error prompt message according to the log output rules. When the query log matches the log comparison rules, extract the target data from the query log according to the data extraction rules; output the target data as a display log according to the log output rules.

[0067] In an optional implementation, when monitoring the operation of each system, there are multiple ways to obtain query logs. The first is to use the new logs generated in each subsystem as query logs; the second is to use the logs that the user wants to query as query logs.

[0068] For the first method: monitor the operation of each subsystem and check whether there are logs generated by new operations or modification operations in each subsystem. If there are logs generated by new operations or modification operations, use them as query logs.

[0069] For the second method: monitor the operation of each subsystem to check whether a user's query operation is detected. When a user query operation is detected, determine the query condition corresponding to the query operation. In the monitoring address corresponding to the monitoring address rule, determine the query log that meets the query condition.

[0070] After the query log is obtained and matches the log comparison rule, data is extracted from the query log according to specific business needs. When extracting specifically, it is necessary to follow the data extraction rules. The data extraction rules are determined based on the analysis of business needs, so when extracting, there are situations where all the data in the query log is extracted, and there are also situations where part of the data in the query log is extracted. Therefore, the target data obtained by extracting the query log includes all or part of the data in the query log.

[0071] After obtaining the target data, the target data needs to be converted. The specific conversion includes format conversion and address storage. In order to facilitate overall management, the log output rules in the embodiment of the present application include address storage rules and format output rules; according to the log output rules, the target data is output as a display log, including: format conversion of the target data according to the format output rules to obtain target data in the target format corresponding to the format output rules; storage and display of the target data in the target format according to the address storage rules.

[0072] The embodiment of the present application can achieve the effect of displaying the logs of multiple subsystems in the same format through the above method, which is convenient for personnel management. When displaying specifically, since there are two ways to obtain the query log in the embodiment of the present application, in order to facilitate viewing, the embodiment of the present application uses different display methods when displaying the display log. Specifically, the display method includes a first display method and a second display method, wherein the display level of the first display method is lower than the display level of the second display method.

[0073] When displaying, the first display method is used to display the conversion results of the new logs generated by the system; the second display method is used to display the conversion results corresponding to the user query operation. The specific display level differences can be reflected in the display area, display color, text size, etc. For example, the second display method is displayed in the middle of the screen, and the first display method is displayed on the side of the screen. The second display method uses red display, and the first display method uses black display. The second display method uses size 4 font, and the first display method uses size 4 font, etc.

[0074] This application implements unified log management, requiring personnel to configure standard Spec documents for different protocols in advance and store these documents in a designated directory for system extraction and analysis. This ensures that the system can automatically convert log data from different protocols into a unified format.

[0075] Effects: Simplified data processing: Log data in a unified format simplifies the subsequent data processing and analysis process, reducing the workload of maintenance personnel. Improved data readability: The unified log format makes data easier to understand and analyze, improving work efficiency. Enhanced data consistency: The unified format ensures data consistency and accuracy, reducing the risk of data errors.

[0076] This application requires personnel to configure the extraction monitoring addresses of different protocol logs that need to be converted, and monitor the log data under these addresses in real time. Once a log is added or modified, the system will immediately start the log verification and conversion function.

[0077] Effects: Improved real-time performance: Real-time monitoring ensures that the system can detect and process changes in log data in a timely manner, improving response speed. Fast fault location: Real-time response helps to quickly locate and solve potential problems, reducing the possibility of production interruptions. Improved production continuity: Fast response ensures the continuity and stability of production and improves production efficiency.

[0078] This application conducts real-time comparative analysis of newly added log content based on real-time monitoring. The system will analyze key data according to the configured unified protocol standardization Spec and output error logs when non-compliant data is found.

[0079] Effects: Improve analysis efficiency: Real-time comparative analysis reduces the need for manual intervention and improves the efficiency and accuracy of data analysis. Reduce error rates: Automated analysis reduces the possibility of human error and improves data reliability. Optimize decision support: Accurate data analysis provides strong support for decision-making and helps optimize production and management.

[0080] This application converts the newly added log content in real time based on real-time monitoring and comparative analysis. The system will convert the log data into a unified format configured by the user according to the standard Spec document and output it to the specified address.

[0081] Effects: Improve data availability: Real-time conversion ensures that data can be quickly accessed and used when needed, improving data availability. Optimize data storage: Log data in a unified format simplifies data storage and management, reducing storage costs. Support multi-protocol environment: The real-time conversion function enables the system to support complex environments where multiple communication protocols coexist, improving the flexibility and scalability of the system.

[0082] In an optional implementation, the present application embodiment can be implemented as follows: Figure 2 Execute in the manner shown: The system needs to configure information in advance, including: configuring the log directory addresses of different protocols that need to be analyzed and converted, configuring the standardized Spec document formats and addresses of different protocols, configuring the log formats of different protocols for the system to extract key data, and configuring a unified output log format template (including normal log templates and error log templates). Monitor in real time whether new logs are generated, and extract key information from logs according to different protocols. Query the standardized Spec document of the protocol to confirm whether the data exists as specified in the standardized document. When there is a mismatch, record the error information and output it to the error log directory according to the unified log format template. When there is a match, output the extracted key information to the configured standard log template and record the converted log in a unified path.

[0083] Figure 3 A schematic diagram of the structure of a log analysis device provided in an embodiment of the present application is shown, which is applied to a computer integrated manufacturing system. The computer integrated manufacturing system includes a plurality of subsystems arranged according to processes, and each subsystem uses a different communication protocol. The device includes:

[0084] A generation module, used to generate analysis rules according to the analysis business requirements and the system properties of each of the subsystems; wherein the analysis rules include monitoring address rules, log comparison rules, data extraction rules and log output rules;

[0085] A monitoring module, used to monitor the operation of each of the subsystems in real time, and determine the query log from each of the subsystems according to the monitoring address rule;

[0086] A comparison module, used to compare the query logs according to the log comparison rules;

[0087] A matching module, configured to extract target data from the query log according to the data extraction rule when the query log matches the log comparison rule;

[0088] The output module is used to output the target data as a display log according to the log output rule.

[0089] The analysis rules are generated according to the analysis of business requirements and system properties of each of the subsystems; wherein the analysis rules include monitoring address rules, log comparison rules, data extraction rules and log output rules, including:

[0090] Generating the monitoring address rules according to the storage attributes of each of the subsystems;

[0091] Generating the log comparison rules according to the configuration specification files of each of the subsystems;

[0092] Generating the data extraction rules according to the analysis business requirements and the configuration specification files of each of the subsystems;

[0093] The log output rules are generated according to the analyzed business requirements.

[0094] The real-time monitoring of the operation status of each of the subsystems and determining the query log from each of the subsystems according to the monitoring address rule include:

[0095] Monitor the operation status of each of the subsystems in real time, and when any of the subsystems generates a new log, determine the new log from each of the subsystems according to the monitoring address rule;

[0096] The new log is used as the query log.

[0097] The real-time monitoring of the operation status of each of the subsystems and determining the query log from each of the subsystems according to the monitoring address rule include:

[0098] The operation status of each of the subsystems is monitored in real time. When a log query operation is detected, the query log is determined from the historical logs of each of the subsystems according to the query conditions corresponding to the log query operation and the monitoring address rules.

[0099] The matching module is used to output error prompt information according to the log output rule when the query log does not match the log comparison rule.

[0100] When the query log matches the log comparison rule, extracting target data from the query log according to the data extraction rule includes:

[0101] When the query log matches the log comparison rule, extracting all or part of the data from the query log according to the data extraction rule;

[0102] The whole data or the part of the data is used as the target data.

[0103] The log output rules include address storage rules and format output rules;

[0104] Outputting the target data as a display log according to the log output rule includes:

[0105] Performing format conversion on the target data according to the format output rule to obtain target data in a target format corresponding to the format output rule;

[0106] The target data in the target format is stored and displayed according to the address storage rule.

[0107] like Figure 4 As shown, an embodiment of the present application provides an electronic device for executing the log analysis method in the present application, the device includes a memory, a processor, a bus, and a computer program stored in the memory and executable on the processor, wherein the processor implements the steps of the log analysis method when executing the computer program.

[0108] Specifically, the above-mentioned memory and processor may be general-purpose memory and processor, which are not specifically limited here. When the processor runs the computer program stored in the memory, the above-mentioned log analysis method can be executed.

[0109] Corresponding to the log analysis method in the present application, an embodiment of the present application further provides a computer-readable storage medium, on which a computer program is stored, and when the computer program is executed by a processor, the steps of the above-mentioned log analysis method are executed.

[0110] Specifically, the storage medium can be a general storage medium, such as a mobile disk, a hard disk, etc. When the computer program on the storage medium is run, the above-mentioned log analysis method can be executed.

[0111] In the embodiments provided in the present application, it should be understood that the disclosed systems and methods can be implemented in other ways. The system embodiments described above are merely schematic. For example, the division of the units is only a logical function division. There may be other division methods in actual implementation. For example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some communication interfaces, indirect coupling or communication connection of systems or units, which can be electrical, mechanical or other forms.

[0112] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, and may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0113] In addition, each functional unit in the embodiments provided in the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit.

[0114] If the functions are implemented in the form of software functional units and sold or used as independent products, they can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present application can be essentially or partly embodied in the form of a software product that contributes to the prior art. The computer software product is stored in a storage medium and includes several instructions for a computer device (which can be a personal computer, a server, or a network device, etc.) to perform all or part of the steps of the methods described in each embodiment of the present application. The aforementioned storage medium includes: various media that can store program codes, such as a USB flash drive, a mobile hard disk, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk.

[0115] It should be noted that similar numbers and letters represent similar items in the following figures. Therefore, once an item is defined in one figure, it does not need to be further defined and explained in subsequent figures. In addition, the terms "first", "second", "third", etc. are only used to distinguish the description and are not to be understood as indicating or implying relative importance.

[0116] Finally, it should be noted that the above-described embodiments are only specific implementation methods of the present application, which are used to illustrate the technical solutions of the present application, rather than to limit them. The protection scope of the present application is not limited thereto. Although the present application is described in detail with reference to the above-mentioned embodiments, ordinary technicians in the field should understand that any technician familiar with the technical field can still modify the technical solutions recorded in the above-mentioned embodiments within the technical scope disclosed in the present application, or can easily think of changes, or make equivalent replacements for some of the technical features therein; and these modifications, changes or replacements do not make the essence of the corresponding technical solutions deviate from the spirit and scope of the technical solutions of the embodiments of the present application. They should all be included in the protection scope of the present application. Therefore, the protection scope of the present application shall be subject to the protection scope of the claims.

Claims

1. A log analysis method, characterized in that: Applied to a computer integrated manufacturing system, the computer integrated manufacturing system includes a plurality of subsystems arranged according to processes, each subsystem using a different communication protocol, the method includes: Generate analysis rules based on the analysis of business requirements and system properties of each of the subsystems; wherein the analysis rules include monitoring address rules, log comparison rules, data extraction rules and log output rules; Monitor the operation status of each of the subsystems in real time, and determine the query log from each of the subsystems according to the monitoring address rule; Comparing the query logs according to the log comparison rule; When the query log matches the log comparison rule, extracting target data from the query log according to the data extraction rule; According to the log output rule, the target data is output as a display log.

2. The method according to claim 1, characterized in that The analysis rules are generated according to the analysis of business requirements and system properties of each of the subsystems; wherein the analysis rules include monitoring address rules, log comparison rules, data extraction rules and log output rules, including: Generating the monitoring address rules according to the storage attributes of each of the subsystems; Generating the log comparison rules according to the configuration specification files of each of the subsystems; Generating the data extraction rules according to the analysis business requirements and the configuration specification files of each of the subsystems; The log output rules are generated according to the analyzed business requirements.

3. The method according to claim 1, characterized in that The real-time monitoring of the operation status of each of the subsystems and determining the query log from each of the subsystems according to the monitoring address rule include: Monitor the operation status of each of the subsystems in real time, and when any of the subsystems generates a new log, determine the new log from each of the subsystems according to the monitoring address rule; The new log is used as the query log.

4. The method according to claim 1, characterized in that: The real-time monitoring of the operation status of each of the subsystems and determining the query log from each of the subsystems according to the monitoring address rule include: The operation status of each of the subsystems is monitored in real time. When a log query operation is detected, the query log is determined from the historical logs of each of the subsystems according to the query conditions corresponding to the log query operation and the monitoring address rules.

5. The method according to claim 1, characterized in that The method further comprises: When the query log does not match the log comparison rule, an error prompt message is output according to the log output rule.

6. The method according to claim 1, characterized in that When the query log matches the log comparison rule, extracting target data from the query log according to the data extraction rule includes: When the query log matches the log comparison rule, extracting all or part of the data from the query log according to the data extraction rule; The whole data or the part of the data is used as the target data.

7. The method according to claim 1, characterized in that The log output rules include address storage rules and format output rules; Outputting the target data as a display log according to the log output rule includes: Performing format conversion on the target data according to the format output rule to obtain target data in a target format corresponding to the format output rule; The target data in the target format is stored and displayed according to the address storage rule.

8. A log analysis device, characterized in that: Applied to a computer integrated manufacturing system, the computer integrated manufacturing system includes a plurality of subsystems arranged according to processes, each subsystem using a different communication protocol, the device includes: A generation module, used to generate analysis rules according to the analysis business requirements and the system properties of each of the subsystems; wherein the analysis rules include monitoring address rules, log comparison rules, data extraction rules and log output rules; A monitoring module, used to monitor the operation of each of the subsystems in real time, and determine the query log from each of the subsystems according to the monitoring address rule; A comparison module, used to compare the query logs according to the log comparison rules; A matching module, configured to extract target data from the query log according to the data extraction rule when the query log matches the log comparison rule; The output module is used to output the target data as a display log according to the log output rule.

9. An electronic device, characterized in that: include: A processor, a memory and a bus, wherein the memory stores machine-readable instructions executable by the processor, and when the electronic device is running, the processor and the memory communicate via the bus, and when the machine-readable instructions are executed by the processor, the steps of the log analysis method as described in any one of claims 1 to 7 are performed.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of the log analysis method according to any one of claims 1 to 7 are executed.

Images