Multi-task log data analysis method and device, equipment, storage medium and product

Abstract

The invention discloses a multi-task log data analysis method and device, equipment, a storage medium and a product, and relates to the technical field of log analysis. The method comprises the steps that a preset multi-task log analysis data set and a preset dialogue template are fused; performing multi-task hybrid tuning on the large language model based on the processed log data set and a quantized low-rank adaptive technology; and inputting to-be-analyzed multi-task log data into the adjusted and optimized large language model to obtain a log analysis result. According to the method, the log data set containing multiple tasks is subjected to template processing, then multi-task mixed tuning is performed on the large language model according to the processed log data set, and efficient tuning is performed by using a quantized low-rank adaptive technology. By means of the dependency between the tasks, the performance of a single task can be improved, correlation analysis between multiple tasks can be carried out, therefore, complex problems can be accurately solved and processed, and the troubleshooting efficiency is improved.

Description

Technical Field

[0001] The present application relates to the field of log analysis technology, and in particular to a multi-task log data analysis method, device, equipment, storage medium and product. Background Art

[0002] Log analysis is a well-known technology widely recognized in the field of information technology. It is essential for monitoring system health, diagnosing problems, security auditing, and optimizing performance by systematically collecting, storing, parsing, and visualizing log data from systems, applications, or devices. Key technologies include automated log collection tools to aggregate log information to a central location; structured databases or distributed storage systems to efficiently store and index log data; scripting languages ​​and tools to convert unstructured log information into a usable format; and powerful search and filtering capabilities to help users understand complex data in a graphical way. With the advancement of machine learning and artificial intelligence technologies, automated log analysis methods are emerging, which improve the accuracy and efficiency of analysis by learning normal and abnormal patterns. Despite challenges such as large data volumes, diverse log formats, and real-time requirements, log analysis technology continues to evolve and move towards a more intelligent and automated direction to meet the needs of modern IT infrastructure.

[0003] Existing log analysis methods include machine learning-based log analysis methods and deep learning-based log analysis methods. Machine learning-based log analysis methods usually use traditional algorithms, such as logistic regression, support vector machines, decision trees, etc., which perform well in processing structured data and scenarios that require model interpretability. Deep learning-based log analysis methods are usually able to handle more complex log data patterns and automatically learn features in logs, which are suitable for large-scale and high-dimensional log analysis tasks. These methods can provide more sophisticated anomaly detection and diagnosis capabilities, especially when dealing with large and diverse log data. However, the above-mentioned log analysis methods can usually only solve a single task and cannot perform deep mining and correlation analysis between multiple tasks, which makes it difficult to deal with complex problems and troubleshoot, resulting in low log analysis efficiency and accuracy. Summary of the invention

[0004] The main purpose of this application is to provide a multi-task log data analysis method, device, equipment, storage medium and product, aiming to solve the technical problem that correlation analysis between multiple tasks cannot be performed when facing complex problems, resulting in low log analysis efficiency and accuracy.

[0005] To achieve the above objectives, the present application proposes a multi-task log data analysis method, the method comprising:

[0006] The preset log analysis data set and the preset dialogue template are merged to obtain a processed log data set, wherein the processed log data set includes a log parsing task data set, a log anomaly detection task data set, a log question-and-answer task data set, and a log summary task data set;

[0007] Based on the processed log data set and the quantized low-rank adaptive technology, multi-task hybrid tuning is performed on the large language model to obtain a tuned large language model;

[0008] The multi-task log data to be analyzed is input into the tuned large language model to obtain the log analysis results.

[0009] In one embodiment, the step of performing multi-task hybrid tuning on the large language model based on the processed log data set and the quantized low-rank adaptive technology to obtain the tuned large language model includes:

[0010] Set the mixed proportions corresponding to the log parsing task data set, the log anomaly detection task data set, the log question-and-answer task data set, and the log summary task data set respectively;

[0011] Adjust the value of the mixed ratio to determine the best mixed ratio combination that minimizes the target loss function corresponding to the large language model;

[0012] The large language model is subjected to multi-task hybrid tuning according to the optimal hybrid ratio combination and the quantized low-rank adaptive technology to obtain a tuned large language model.

[0013] In one embodiment, the step of performing multi-task hybrid tuning on the large language model according to the optimal hybrid ratio combination and quantized low-rank adaptive technology to obtain the tuned large language model includes:

[0014] Quantize the large language model into a preset low-precision storage data type and a preset calculation data type through the quantized low-rank adaptive technology, and set the low-rank adapter weight;

[0015] quantizing the back propagation gradient of the low-rank adapter weight according to a preset low-precision storage data type and a preset calculation data type to obtain an adjusted low-rank adapter parameter;

[0016] The large language model is subjected to multi-task hybrid tuning according to the optimal hybrid ratio combination and the adjusted low-rank adapter parameters to obtain a tuned large language model.

[0017] In one embodiment, the step of performing multi-task hybrid tuning on the large language model according to the optimal hybrid ratio combination and the adjusted low-rank adapter parameters to obtain a tuned large language model includes:

[0018] Fusing the adjusted low-rank adapter parameters with the parameters of the large language model to obtain a fused large language model;

[0019] The fused large language model is subjected to multi-task hybrid tuning according to the optimal hybrid ratio combination to obtain a tuned large language model.

[0020] In one embodiment, the step of inputting the multi-task log data to be analyzed into the tuned large language model to obtain the log analysis result includes:

[0021] Input the multi-task log data to be analyzed into the tuned large language model to obtain the initial log analysis results;

[0022] The initial log analysis result is formatted according to a preset format checker to obtain a final log analysis result.

[0023] In one embodiment, the step of formatting the initial log analysis result according to a preset format checker to obtain the final log analysis result includes:

[0024] Performing format check on the initial log analysis result according to a preset instruction template in a preset format checker;

[0025] When the format check fails, the format of the initial log analysis result is corrected according to the preset instruction template to obtain a final log analysis result.

[0026] In addition, to achieve the above purpose, the present application also proposes a multi-task log data analysis device, the multi-task log data analysis device comprising:

[0027] A log data processing module, used to fuse a preset log analysis data set with a preset dialogue template to obtain a processed log data set, wherein the processed log data set includes a log parsing task data set, a log anomaly detection task data set, a log question-and-answer task data set, and a log summary task data set;

[0028] A multi-task hybrid tuning module, used to perform multi-task hybrid tuning on the large language model based on the processed log data set and the quantized low-rank adaptive technology to obtain a tuned large language model;

[0029] The multi-task log analysis module is used to input the multi-task log data to be analyzed into the tuned large language model to obtain the log analysis results.

[0030] In addition, to achieve the above-mentioned purpose, the present application also proposes a multi-task log data analysis device, which includes: a memory, a processor, and a computer program stored in the memory and executable on the processor, and the computer program is configured to implement the steps of the multi-task log data analysis method described above.

[0031] In addition, to achieve the above-mentioned purpose, the present application also proposes a storage medium, which is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by the processor, the steps of the multi-task log data analysis method described above are implemented.

[0032] In addition, to achieve the above-mentioned purpose, the present application also provides a computer program product, which includes a computer program, and when the computer program is executed by a processor, the steps of the multi-task log data analysis method described above are implemented.

[0033] The present application provides a multi-task log data analysis method, by fusing a preset log analysis data set with a preset dialogue template, obtaining a processed log data set, including a task data set of log parsing, log anomaly detection, log question and answer, and log summary; based on the processed log data set and the quantized low-rank adaptive technology, a large language model is subjected to multi-task hybrid tuning to obtain a tuned large language model; the multi-task log data to be analyzed is input into the tuned large language model to obtain the log analysis result. The present application performs template processing on a log data set containing multiple tasks, and then performs multi-task hybrid tuning on the large language model according to the processed log data set, and uses the quantized low-rank adaptive technology for efficient tuning. By utilizing the dependencies between tasks, not only can the performance of a single task be improved, but also correlation analysis between multiple tasks can be performed, so that complex problems can be accurately responded to and handled, and the efficiency of troubleshooting can be improved. BRIEF DESCRIPTION OF THE DRAWINGS

[0034] The accompanying drawings, which are incorporated in and constitute a part of this specification, illustrate embodiments consistent with the present application and, together with the description, serve to explain the principles of the present application.

[0035] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, for ordinary technicians in this field, other drawings can be obtained based on these drawings without paying any creative labor.

[0036] Figure 1 A flowchart of the first embodiment of the multi-task log data analysis method of the present application is provided;

[0037] Figure 2 A schematic diagram showing the correlation between different log analysis tasks;

[0038] Figure 3 A flowchart of the second embodiment of the multi-task log data analysis method of the present application is provided;

[0039] Figure 4 A flowchart of the third embodiment of the multi-task log data analysis method of the present application is provided;

[0040] Figure 5 This is a schematic diagram of the workflow of the format checker in the third embodiment of the present application;

[0041] Figure 6 This is a schematic diagram of the overall process of the multi-task log data analysis method of this application;

[0042] Figure 7 This is a schematic diagram of the module structure of the multi-task log data analysis device according to an embodiment of the present application;

[0043] Figure 8 Schematic diagram of the device structure of the hardware operating environment involved in the multi-task log data analysis method in the embodiment of the present application.

[0044] The purpose, features and advantages of this application will be further described in conjunction with the embodiments and with reference to the accompanying drawings. DETAILED DESCRIPTION

[0045] It should be understood that the specific embodiments described herein are only used to explain the technical solutions of the present application and are not used to limit the present application.

[0046] In order to better understand the technical solution of the present application, a detailed description will be given below in conjunction with the accompanying drawings and specific implementation methods.

[0047] The main solution of the embodiment of the present application is: fusing a preset log analysis data set and a preset dialogue template to obtain a processed log data set, wherein the processed log data set includes a log parsing task data set, a log anomaly detection task data set, a log question and answer task data set, and a log summary task data set; performing multi-task hybrid tuning on a large language model based on the processed log data set and quantized low-rank adaptive technology to obtain a tuned large language model; inputting the multi-task log data to be analyzed into the tuned large language model to obtain a log analysis result.

[0048] The existing log analysis methods include machine learning-based log analysis methods and deep learning-based log analysis methods. Machine learning-based log analysis methods usually use traditional algorithms, such as logistic regression, support vector machines, decision trees, etc., which perform well in processing structured data and scenarios that require model interpretability. Deep learning-based log analysis methods are usually able to handle more complex log data patterns and automatically learn features in logs, which are suitable for large-scale and high-dimensional log analysis tasks. These methods can provide more sophisticated anomaly detection and diagnosis capabilities, especially when dealing with large and diverse log data. However, the above-mentioned log analysis methods can usually only solve a single task and cannot perform deep mining and correlation analysis between multiple tasks, which makes it difficult to deal with complex problems and troubleshoot, resulting in low log analysis efficiency and accuracy.

[0049] The present application provides a solution, by fusing a preset log analysis data set with a preset dialogue template, a processed log data set is obtained, including a task data set of log parsing, log anomaly detection, log question and answer, and log summary; based on the processed log data set and the quantized low-rank adaptive technology, a large language model is tuned for multi-task hybrid to obtain a tuned large language model; the multi-task log data to be analyzed is input into the tuned large language model to obtain the log analysis result. The present application performs template processing on a log data set containing multiple tasks, and then performs multi-task hybrid tuning on the large language model according to the processed log data set, and uses the quantized low-rank adaptive technology for efficient tuning. By utilizing the dependencies between tasks, not only can the performance of a single task be improved, but also correlation analysis between multiple tasks can be performed, so that complex problems can be accurately responded to and handled, and the efficiency of troubleshooting can be improved.

[0050] It should be noted that the execution subject of the method of this embodiment can be a computing service device with multi-task log data analysis, network communication and program running functions, such as a tablet computer, a personal computer, a mobile phone, etc.; it can also be a multi-task log data analysis device with the same or similar functions. This embodiment and the following embodiments will be described by taking a multi-task log data analysis device as an example.

[0051] Based on this, the present application embodiment provides a multi-task log data analysis method, referring to Figure 1 , Figure 1 This is a flowchart of the first embodiment of the multi-task log data analysis method of the present application. In this embodiment, the multi-task log data analysis method includes steps S10 to S30:

[0052] Step S10, fusing the preset log analysis data set and the preset dialogue template to obtain a processed log data set, wherein the processed log data set includes a log parsing task data set, a log anomaly detection task data set, a log question-and-answer task data set, and a log summary task data set.

[0053] It should be noted that log analysis tasks usually include the following four types: log parsing (LogParse), log anomaly detection (LogAD), log question and answer (LogQA) and log summary (LogSumm). Figure 2 Analyze the correlation between the four log analysis tasks, and use this correlation to help users extract key information and manage log data efficiently. LogAD uses structured log data generated through LogParse to identify abnormal behavior of systems or applications. The structured format enables anomaly detection algorithms to effectively analyze log entries and detect anomalies, which may then trigger further investigation or questions in LogQA. In turn, LogQA relies on structured log data to provide natural language interaction with log entries. Administrators can ask questions about log data, and the LogQA system uses structured log data to generate contextually relevant responses. LogQA promotes efficient interaction with log data and supports troubleshooting, query, and attribution analysis. LogSumm compresses large-scale log data by creating concise log data summaries. These summaries generated from structured logs provide a bird's-eye view of system behavior and provide rich contextual information for users and downstream analysis tasks. As log analysis continues to evolve, the collaboration and integration of different tasks play a key role in unleashing the full potential of log data, making it an indispensable part of modern system and application management.

[0054] It is understandable that a log analysis data set including the above four log analysis tasks can be prepared as an instruction tuning data set and preprocessed. The log data is combined with a predefined dialogue template to form a prompt data set suitable for LLMs input, and a processed log data set is obtained.

[0055] Step S20, performing multi-task hybrid tuning on the large language model based on the processed log data set and the quantized low-rank adaptive technology to obtain a tuned large language model.

[0056] It is understandable that existing machine learning-based methods and deep learning-based methods can usually only solve a single task, and cannot perform deep mining and correlation analysis between multiple tasks, which makes it difficult to deal with complex problems and troubleshoot. Therefore, in this embodiment, the large language model (LLMs) is tuned for multi-task hybrid tuning through the processed log data set containing multiple log tasks. In order to improve the efficiency of model tuning, the quantized low-rank adaptation (QLoRA) technology is used in this embodiment for efficient tuning.

[0057] Step S30: input the multi-task log data to be analyzed into the tuned large language model to obtain the log analysis result.

[0058] It is understandable that the tuned large language model obtained by multi-task hybrid tuning of LLMs can use the powerful text understanding ability of LLMs to parse and understand complex log data. By performing multi-task hybrid tuning on LLMs, multiple log analysis tasks can be handled at the same time. By inputting the multi-task log data to be analyzed into the tuned large language model, the log analysis results can be obtained quickly and more accurately, which is convenient for staff to make quantitative and qualitative evaluations based on the log analysis results.

[0059] This embodiment provides a multi-task log data analysis method, by fusing a preset log analysis data set and a preset dialogue template, to obtain a processed log data set, including a task data set of log parsing, log anomaly detection, log question and answer, and log summary; based on the processed log data set and the quantized low-rank adaptive technology, a large language model is subjected to multi-task hybrid tuning to obtain a tuned large language model; the multi-task log data to be analyzed is input into the tuned large language model to obtain the log analysis result. This embodiment performs template processing on a log data set containing multiple tasks, and then performs multi-task hybrid tuning on the large language model according to the processed log data set, and uses the quantized low-rank adaptive technology for efficient tuning. By utilizing the dependencies between tasks, not only can the performance of a single task be improved, but also correlation analysis between multiple tasks can be performed, so that complex problems can be accurately dealt with and handled, and the efficiency of troubleshooting can be improved.

[0060] Based on the first embodiment of the present application, in the second embodiment of the present application, the same or similar contents as those in the above-mentioned embodiment 1 can refer to the above introduction, and will not be repeated later. Figure 3 , step S20, the multi-task log data analysis method further includes steps S201 to S203:

[0061] Step S201, setting the mixed proportions corresponding to the log parsing task data set, the log anomaly detection task data set, the log question and answer task data set and the log summary task data set respectively.

[0062] It should be noted that in this embodiment, the high-precision hybrid tuning strategy and QLoRA technology are used to fine-tune the open source LLMs with high precision, while reducing the demand for video memory required for fine-tuning large models. In this process, the parameters of the LLMs themselves are frozen, and only the parameters of the low-rank adapter are updated.

[0063] Understandably, pre-training of LLMs on large-scale corpora equips the models with rich foundational knowledge and language understanding capabilities, enabling the models to perform well in a variety of application scenarios. However, in order to fully realize the potential of LLMs in specialized fields such as log analysis, it is often necessary to fine-tune these models to effectively perform specific tasks. In this case, it becomes crucial to fine-tune LLMs through supervised fine-tuning (SFT), where pre-trained LLMs are further trained on task-specific datasets. This fine-tuning process is able to adjust the parameters of the model according to the nuances of the target task, thereby adapting LLMs to specific log analysis tasks. The advantages of tailoring LLMs to log analysis tasks through supervised fine-tuning include 1. Improved task performance: Compared with using general off-the-shelf models, supervised fine-tuning enables LLMs to adapt to complex log data and achieve better performance. 2. Task relevance: By fine-tuning on task-specific log data, LLMs become more adaptable to specific log analysis tasks, ensuring that they effectively understand the context and semantics of the logs.

[0064] It is worth noting that an innovative hybrid instruction adjustment strategy is adopted in this embodiment, so that the log analysis system LogReader in this application can adapt to multiple log analysis tasks. Specifically, the basic model π0 is used, which represents the probability distribution π0(y|x) of given instructions and prior knowledge. Consider four instruction tuning data sets related to log analysis tasks: log parsing data set Log Question Answering Dataset Log summary dataset and log anomaly detection dataset The mixed proportion of the four data sets is defined as α i , where 1≤i≤4 and 0≤α i ≤1.

[0065] Step S202, adjusting the value of the mixed ratio to determine the best mixed ratio combination that minimizes the target loss function corresponding to the large language model.

[0066] It should be noted that the value of the mixture ratio can be adjusted to determine the optimal mixture ratio combination that minimizes the target loss function corresponding to the large language model. The goal of the adjustment is to find the optimal mixture ratio combination π that minimizes the target loss function J(θ) θ (y|x), as shown in the following formula:

[0067]

[0068] Larger α i It should mean that the model is more inclined to the function of specific tasks. Since adjusting only the task performs worse on unseen tasks compared with mixed training, it shows that task relevance has an important impact on general ability. Therefore, according to the specific application scenario, all combinations of these four tasks can be tried, so α i The range is 0 to 1. Based on the final performance on different tasks, users can conduct multiple experiments and select the α with the best performance on the test set. i In addition, users can adjust α i The size of controls the preference of LLMs for tasks, α i As it increases, LLMs tend to optimize the performance of the corresponding task.

[0069] Step S203, performing multi-task hybrid tuning on the large language model according to the optimal hybrid ratio combination and quantized low-rank adaptive technology to obtain a tuned large language model.

[0070] It can be understood that in this embodiment, the hybrid instruction adjustment strategy for obtaining the optimal hybrid ratio combination and the quantized low-rank adaptive QLoRA technology are combined to perform multi-task hybrid tuning on the large language model LLMs to obtain the tuned large language model.

[0071] In a feasible implementation, step S203 may include steps S2031 to S2033:

[0072] Step S2031, quantize the large language model into a preset low-precision storage data type and a preset calculation data type through a quantized low-rank adaptive technology, and set a low-rank adapter weight.

[0073] It should be understood that QLoRA contains a low-precision storage data type (usually 4-bit) and a calculation data type (usually BrainFloat16). You can use 4-bit NormalFloat as the storage data type and 16-bit BrainFloat as the calculation data type, quantize the large language model to 4-bit, and add a small set of learnable low-rank adapter weights (Low-rank Adapter weights, LoRA)

[0074] Step S2032, quantizing the back propagation gradient of the low-rank adapter weight according to the preset low-precision storage data type and the preset calculation data type to obtain adjusted low-rank adapter parameters.

[0075] It can be understood that by presetting the low-precision storage data type and the preset calculation data type to quantize the back-propagation gradient of the low-rank adapter weights for tuning, only the gradient of the LoRA parameters is calculated when calculating the gradient. The computational complexity is reduced by low-rank matrix decomposition and adaptive adjustment. Instead of fine-tuning the entire pre-trained model, QLoRA only applies low-rank matrices to specific parts of the model. This allows the model to adapt to new tasks by adjusting a small number of parameters while keeping most of the parameters unchanged.

[0076] Step S2033: Perform multi-task hybrid tuning on the large language model according to the optimal hybrid ratio combination and the adjusted low-rank adapter parameters to obtain a tuned large language model.

[0077] It is understandable that in order to prevent out-of-memory errors caused by memory fluctuations caused by gradient checkpoints, QLoRA uses Paged Optimizers technology. This technology uses the characteristics of NVIDIA unified memory to achieve automatic page conversion between CPU and GPU, and automatically transfers the optimizer state to CPU memory when GPU memory is insufficient. The large language model is multi-task mixed tuning is performed based on the optimal mixed ratio combination and the adjusted low-rank adapter parameters to obtain the tuned large language model.

[0078] It should be noted that the difference between QLoRA and LoRA is that LoRA reduces storage requirements and computing costs by using low-precision weights, but sacrifices accuracy. QLoRA uses high-precision weights and learnable low-rank adapters to reduce fine-tuning costs and improve the accuracy of LLMs. QLoRA is superior in performance and is suitable for scenarios with higher requirements for network performance. While maintaining the fine-tuning accuracy of LLMs parameters, it greatly reduces the GPU memory requirements.

[0079] In a feasible implementation manner, step S2033 may include steps S2034 to S2035:

[0080] Step S2034, fusing the adjusted low-rank adapter parameters with the parameters of the large language model to obtain a fused large language model.

[0081] It is understandable that the parameters of the low-rank adapter can be fused with the parameters of the LLMs themselves to obtain the final LLMs. Specifically, after the low-rank adapter parameters are trained, the following steps are used to fuse them with the LLM parameters. The parameters are fused by adding the original LLM parameters to the updated LoRA parameters. The fused parameters can be merged back into the LLM to form a unified model that can be inferred like the original model without additional computational overhead. That is, in the inference stage, the merged model can be used directly without distinguishing which parameters are the original LLM parameters and which are the low-rank adapter parameters, because they have been fused into a unified model.

[0082] Step S2035, performing multi-task hybrid tuning on the fused large language model according to the optimal hybrid ratio combination to obtain a tuned large language model.

[0083] It is understandable that the fused large language model can be subjected to multi-task hybrid tuning according to the optimal mixed ratio combination to obtain a tuned large language model.

[0084] In this embodiment, a hybrid tuning strategy and QLoRA technology are used to fine-tune open source LLMs with high precision while reducing the demand for video memory required to fine-tune large models. It is critical to supervise fine-tune (SFT) LLMs so that pre-trained LLMs can be further trained on task-specific datasets. This fine-tuning process can adjust the parameters of the model according to the nuances of the target task, so that the LLMs can adapt to specific log analysis tasks. Tuning is performed through a hybrid instruction adjustment strategy so that the model can adapt to multiple log analysis tasks.

[0085] Based on the first embodiment of the present application, in the third embodiment of the present application, the same or similar contents as those in the first embodiment can be referred to the above description, and will not be described in detail later. Figure 4 , step S30, the multi-task log data analysis method further includes steps S301-S302:

[0086] Step S301 : input the multi-task log data to be analyzed into the tuned large language model to obtain the initial log analysis result.

[0087] Step S302: formatting the initial log analysis result according to a preset format checker to obtain a final log analysis result.

[0088] It should be noted that in this embodiment, after the multi-task log data to be analyzed is input into the tuned large language model and the initial log analysis results are obtained, a format checker is also set to correct the final output results of the LLM to ensure the readability of the results and facilitate subsequent evaluation. The workflow of the format checker can be referred to Figure 5 In order to ensure the quality of the generated response, the existing methods are all manually formatted, which is difficult to apply in practice. Therefore, this embodiment designs a format checker, which can automatically detect and correct the response format to ensure that the output results meet the expected structure. The format checker is crucial for maintaining the consistency and standardization of task outputs and for efficient log analysis.

[0089] In a feasible implementation, step S302 may include steps S3021 to S3022:

[0090] Step S3021: Perform a format check on the initial log analysis result according to a preset instruction template in a preset format checker.

[0091] It is understandable that relevant instruction templates can be designed based on domain knowledge to guide the Chat Generative Pre-trained Transformer (ChatGPT) to reformat the output results. The instruction template is: "Please check that whether the return back satisfies the followingjson format, include keys: is_anomaly, reports, preventive_measures". The format of json is pre-defined, and the initial log analysis results can be format checked according to the preset instruction template in the preset format checker. If the output meets the format requirements, the results are saved directly, otherwise they are formatted into the specified format.

[0092] It should be noted that when designing this format checker, its accuracy and efficiency were taken into consideration. The checker can automatically detect and correct the format of LLMs output to ensure that the output results conform to the expected structure. This design aims to improve the quality and consistency of the output while reducing the possibility of manual intervention and errors. Using ChatGPT for reformatting makes the responses generated by the model more natural and fluent. ChatGPT's powerful language generation capabilities can ensure the accuracy of the syntax and semantics of the responses, while being able to make appropriate adjustments and corrections based on the needs of specific tasks. This reformatting method using ChatGPT can improve the readability and comprehension of the responses, allowing analysts to understand the log data more quickly and accurately. In specific situations, such as when it is necessary to maintain a consistent and standardized format for task output, the value of the format checker is more prominent. The format checker can ensure that all generated responses conform to the expected format and content, thereby improving the efficiency and accuracy of the analysis. It can make it easier for analysts to compare and analyze the differences between different responses, so as to better understand and solve potential problems.

[0093] The format checker has the following advantages:

[0094] 1. Improve response quality and consistency: By automatically detecting and correcting the output format, you can ensure that all outputs conform to the expected structure, thereby improving the quality and consistency of the output;

[0095] 2. Reduce manual intervention: By using ChatGPT for reformatting, the possibility of manual intervention and errors can be reduced, and work efficiency can be improved;

[0096] 3. Improve readability and comprehension: Through ChatGPT's powerful language generation capabilities, the grammatical and semantic accuracy of the output can be ensured, improving the readability and comprehension of the output;

[0097] 4. Improve analysis efficiency: By maintaining a consistent and standardized format for task outputs, analysts can more easily compare and analyze different output results, thereby better understanding and solving potential problems in the system.

[0098] Step S3022: When the format check fails, the format of the initial log analysis result is corrected according to the preset instruction template to obtain a final log analysis result.

[0099] In this embodiment, the output results of the model are formatted through the format checker, and the response format is automatically detected and corrected to ensure that the output results conform to the expected structure. The format checker is essential for maintaining the consistency and standardization of task outputs and for efficient log analysis. ChatGPT is used for reformatting to make the responses generated by the model more natural and fluent. The reformatting method can improve the readability and comprehension of the responses, allowing analysts to understand log data more quickly and accurately.

[0100] For example, to help understand the implementation process of the multi-task log data analysis method obtained by combining this embodiment with the above-mentioned embodiment 1, please refer to Figure 6 , Figure 6 This is a schematic diagram of the overall process of the multi-task log data analysis method of this application; specifically:

[0101] The multi-task log data analysis method in this application adopts a multi-task hybrid optimization strategy, so that the large language model can adapt to multiple log analysis tasks at the same time, and learn the relationship between multiple tasks, so as to improve the performance and efficiency of the task. A general log analysis system LogReader supported by open source large language models (LLMs) is designed. Since different log analysis tasks are interrelated, a hybrid tuning strategy is adopted to fine-tune the large language model to improve the performance on each task. First, the log is preprocessed and integrated into a dialogue template suitable for LLM input. Then, based on the processed log data, QLoRA technology is used to efficiently fine-tune the LLM. Finally, the format checker is used to correct the final output of the LLM to ensure the readability of the results and facilitate subsequent evaluation.

[0102] It should be noted that the above examples are only used to understand the present application and do not constitute a limitation on the multi-task log data analysis method of the present application. More simple transformations based on this technical concept are all within the scope of protection of the present application.

[0103] This application also provides a multi-task log data analysis device, please refer to Figure 7 , the multi-task log data analysis device comprises:

[0104] The log data processing module 10 is used to merge the preset log analysis data set and the preset dialogue template to obtain a processed log data set, wherein the processed log data set includes a log parsing task data set, a log anomaly detection task data set, a log question-and-answer task data set, and a log summary task data set;

[0105] A multi-task hybrid tuning module 20 is used to perform multi-task hybrid tuning on the large language model based on the processed log data set and the quantized low-rank adaptive technology to obtain a tuned large language model;

[0106] The multi-task log analysis module 30 is used to input the multi-task log data to be analyzed into the tuned large language model to obtain the log analysis result.

[0107] The multi-task log data analysis device provided by the present application adopts the multi-task log data analysis method in the above embodiment to solve the technical problem. Compared with the prior art, the beneficial effects of the multi-task log data analysis device provided by the present application are the same as the beneficial effects of the multi-task log data analysis method provided by the above embodiment, and the other technical features in the multi-task log data analysis device are the same as the features disclosed in the above embodiment method, which will not be repeated here.

[0108] The present application provides a multi-task log data analysis device, which includes: at least one processor; and a memory that is communicatively connected to the at least one processor; wherein the memory stores instructions that can be executed by the at least one processor, and the instructions are executed by the at least one processor so that the at least one processor can execute the multi-task log data analysis method in the above-mentioned embodiment one.

[0109] Reference below Figure 8 , which shows a schematic diagram of the structure of a multi-task log data analysis device suitable for implementing an embodiment of the present application. The multi-task log data analysis device in the embodiment of the present application may include but is not limited to mobile terminals such as mobile phones, laptop computers, digital broadcast receivers, PDAs (Personal Digital Assistants), PADs (Portable Application Descriptions), PMPs (Portable Media Players), vehicle-mounted terminals (such as vehicle-mounted navigation terminals), etc., and fixed terminals such as digital TVs, desktop computers, etc. Figure 8 The multi-task log data analysis device shown is only an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0110] like Figure 8As shown, the multi-task log data analysis device may include a processing device 1001 (such as a central processing unit, a graphics processor, etc.), which can perform various appropriate actions and processes according to a program stored in a read-only memory (ROM: Read Only Memory) 1002 or a program loaded from a storage device 1003 to a random access memory (RAM: Random Access Memory) 1004. In RAM1004, various programs and data required for the operation of the multi-task log data analysis device are also stored. The processing device 1001, ROM1002 and RAM1004 are connected to each other through a bus 1005. An input / output (I / O) interface 1006 is also connected to the bus. Generally, the following systems can be connected to the I / O interface 1006: an input device 1007 including, for example, a touch screen, a touchpad, a keyboard, a mouse, an image sensor, a microphone, an accelerometer, a gyroscope, etc.; an output device 1008 including, for example, a liquid crystal display (LCD: Liquid Crystal Display), a speaker, a vibrator, etc.; a storage device 1003 including, for example, a magnetic tape, a hard disk, etc.; and a communication device 1009. The communication device 1009 can allow the multi-task log data analysis device to communicate wirelessly or wired with other devices to exchange data. Although the figure shows a multi-task log data analysis device with various systems, it should be understood that it is not required to implement or have all the systems shown. More or fewer systems can be implemented or provided instead.

[0111] In particular, according to the embodiments disclosed in the present application, the process described above with reference to the flowchart can be implemented as a computer software program. For example, the embodiments disclosed in the present application include a computer program product, which includes a computer program carried on a computer-readable medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program can be downloaded and installed from a network through a communication device, or installed from a storage device 1003, or installed from a ROM 1002. When the computer program is executed by the processing device 1001, the above-mentioned functions defined in the method of the embodiment disclosed in the present application are executed.

[0112] The multi-task log data analysis device provided by the present application adopts the multi-task log data analysis method in the above embodiment, which can solve the technical problems of multi-task log data analysis. Compared with the prior art, the beneficial effects of the multi-task log data analysis device provided by the present application are the same as the beneficial effects of the multi-task log data analysis method provided by the above embodiment, and the other technical features in the multi-task log data analysis device are the same as the features disclosed in the method of the previous embodiment, which will not be repeated here.

[0113] It should be understood that the various parts disclosed in this application can be implemented by hardware, software, firmware or a combination thereof. In the description of the above embodiments, specific features, structures, materials or characteristics can be combined in any one or more embodiments or examples in a suitable manner.

[0114] The above is only a specific implementation of the present application, but the protection scope of the present application is not limited thereto. Any person skilled in the art who is familiar with the present technical field can easily think of changes or substitutions within the technical scope disclosed in the present application, which should be included in the protection scope of the present application. Therefore, the protection scope of the present application should be based on the protection scope of the claims.

[0115] The present application provides a computer-readable storage medium having computer-readable program instructions (ie, computer programs) stored thereon, wherein the computer-readable program instructions are used to execute the multi-task log data analysis method in the above-mentioned embodiment.

[0116] The computer-readable storage medium provided in the present application may be, for example, a USB flash drive, but is not limited to electrical, magnetic, optical, electromagnetic, infrared, or semiconductor systems, systems or devices, or any combination of the above. More specific examples of computer-readable storage media may include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In this embodiment, the computer-readable storage medium may be any tangible medium containing or storing a program that can be used by or in combination with an instruction execution system, system or device. The program code contained on the computer-readable storage medium may be transmitted using any appropriate medium, including but not limited to: wires, optical cables, RF (Radio Frequency), etc., or any suitable combination of the above.

[0117] The computer-readable storage medium may be included in the multi-task log data analysis device; or may exist independently without being assembled into the multi-task log data analysis device.

[0118] The computer-readable storage medium carries one or more programs. When the one or more programs are executed by a multi-task log data analysis device, the multi-task log data analysis device: fuses a preset log analysis data set and a preset dialogue template to obtain a processed log data set, wherein the processed log data set includes a log parsing task data set, a log anomaly detection task data set, a log question-and-answer task data set, and a log summary task data set; performs multi-task hybrid tuning on a large language model based on the processed log data set and a quantized low-rank adaptive technology to obtain a tuned large language model; and inputs the multi-task log data to be analyzed into the tuned large language model to obtain a log analysis result.

[0119] Computer program code for performing the operations of the present application may be written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code may be executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., via the Internet using an Internet service provider).

[0120] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each square box in the flow chart or block diagram can represent a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some alternative implementations, the functions marked in the square box can also occur in a sequence different from that marked in the accompanying drawings. For example, two square boxes represented in succession can actually be executed substantially in parallel, and they can sometimes be executed in the opposite order, depending on the functions involved. It should also be noted that each square box in the block diagram and / or flow chart, and the combination of the square boxes in the block diagram and / or flow chart can be implemented with a dedicated hardware-based system that performs a specified function or operation, or can be implemented with a combination of dedicated hardware and computer instructions.

[0121] The modules involved in the embodiments described in this application may be implemented by software or hardware, wherein the name of the module does not constitute a limitation on the unit itself in some cases.

[0122] The readable storage medium provided by the present application is a computer-readable storage medium, which stores computer-readable program instructions (i.e., computer programs) for executing the above-mentioned multi-task log data analysis method, and can solve technical problems. Compared with the prior art, the beneficial effects of the computer-readable storage medium provided by the present application are the same as the beneficial effects of the multi-task log data analysis method provided by the above-mentioned embodiment, and will not be repeated here.

[0123] The present application also provides a computer program product, including a computer program, which implements the steps of the multi-task log data analysis method as described above when executed by a processor.

[0124] The computer program product provided by the present application can solve the technical problem. Compared with the prior art, the beneficial effects of the computer program product provided by the present application are the same as the beneficial effects of the multi-task log data analysis method provided by the above embodiment, which will not be described in detail here.

[0125] The above descriptions are only some embodiments of the present application, and are not intended to limit the patent scope of the present application. All equivalent structural changes made using the contents of the present application specification and drawings under the technical concept of the present application, or direct / indirect applications in other related technical fields are included in the patent protection scope of the present application.

Claims

1. A multi-task log data analysis method, characterized in that: The method includes: The preset log analysis data set and the preset dialogue template are merged to obtain a processed log data set, wherein the processed log data set includes a log parsing task data set, a log anomaly detection task data set, a log question-and-answer task data set, and a log summary task data set; Based on the processed log data set and the quantized low-rank adaptive technology, multi-task hybrid tuning is performed on the large language model to obtain a tuned large language model; The multi-task log data to be analyzed is input into the tuned large language model to obtain the log analysis results.

2. The method according to claim 1, characterized in that The step of performing multi-task hybrid tuning on the large language model based on the processed log data set and the quantized low-rank adaptive technology to obtain the tuned large language model includes: Set the mixed proportions corresponding to the log parsing task data set, the log anomaly detection task data set, the log question-and-answer task data set, and the log summary task data set respectively; Adjust the value of the mixed ratio to determine the best mixed ratio combination that minimizes the target loss function corresponding to the large language model; The large language model is subjected to multi-task hybrid tuning according to the optimal hybrid ratio combination and the quantized low-rank adaptive technology to obtain a tuned large language model.

3. The method according to claim 2, characterized in that The step of performing multi-task hybrid tuning on the large language model according to the optimal hybrid ratio combination and the quantized low-rank adaptive technology to obtain the tuned large language model includes: Quantize the large language model into a preset low-precision storage data type and a preset calculation data type through the quantized low-rank adaptive technology, and set the low-rank adapter weight; quantizing the back propagation gradient of the low-rank adapter weight according to a preset low-precision storage data type and a preset calculation data type to obtain an adjusted low-rank adapter parameter; The large language model is subjected to multi-task hybrid tuning according to the optimal hybrid ratio combination and the adjusted low-rank adapter parameters to obtain a tuned large language model.

4. The method according to claim 3, characterized in that The step of performing multi-task hybrid tuning on the large language model according to the optimal hybrid ratio combination and the adjusted low-rank adapter parameters to obtain a tuned large language model includes: Fusing the adjusted low-rank adapter parameters with the parameters of the large language model to obtain a fused large language model; The fused large language model is subjected to multi-task hybrid tuning according to the optimal hybrid ratio combination to obtain a tuned large language model.

5. The method according to claim 1, characterized in that The step of inputting the multi-task log data to be analyzed into the tuned large language model to obtain the log analysis result includes: Input the multi-task log data to be analyzed into the tuned large language model to obtain the initial log analysis results; The initial log analysis result is formatted according to a preset format checker to obtain a final log analysis result.

6. The method according to claim 5, characterized in that The step of formatting the initial log analysis result according to a preset format checker to obtain a final log analysis result includes: Performing format check on the initial log analysis result according to a preset instruction template in a preset format checker; When the format check fails, the format of the initial log analysis result is corrected according to the preset instruction template to obtain a final log analysis result.

7. A multi-task log data analysis device, characterized in that: The multi-task log data analysis device comprises: A log data processing module is used to fuse a preset log analysis data set with a preset dialogue template to obtain a processed log data set, wherein the processed log data set includes a log parsing task data set, a log anomaly detection task data set, a log question-and-answer task data set, and a log summary task data set; A multi-task hybrid tuning module, used to perform multi-task hybrid tuning on the large language model based on the processed log data set and the quantized low-rank adaptive technology to obtain a tuned large language model; The multi-task log analysis module is used to input the multi-task log data to be analyzed into the tuned large language model to obtain the log analysis results.

8. A multi-task log data analysis device, characterized in that: The device comprises: a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein the computer program is configured to implement the steps of the multi-task log data analysis method according to any one of claims 1 to 6.

9. A storage medium, characterized in that: The storage medium is a computer-readable storage medium, and a computer program is stored on the storage medium. When the computer program is executed by a processor, the steps of the multi-task log data analysis method according to any one of claims 1 to 6 are implemented.

10. A computer program product, characterized in that The computer program product comprises a computer program, and when the computer program is executed by a processor, the steps of the multi-task log data analysis method according to any one of claims 1 to 6 are implemented.

Images