Alarm log data analysis method and device, electronic equipment and storage medium

Abstract

The embodiment of the invention discloses an alarm log data analysis method and device, electronic equipment and a storage medium. The method comprises the steps of obtaining an original log data set, and determining a first entity field in target original log data; generating a target entity field and a target entity identifier according to the first entity field, and generating reference alarm log data based on the target original log data, the target entity field and the target entity identifier; obtaining reference alarm log data with the same target entity identifier in the target time period, and fusing the reference alarm log data to obtain fused target alarm log data; and determining an entity topological graph of the target alarm log data, and determining a target alarm entity matched with the target alarm log data according to the entity topological graph. According to the scheme provided by the embodiment of the invention, the alarm log data of different data sources can be analyzed at the same time, and an accurate analysis result can be quickly obtained.

Description

Technical Field

[0001] The present invention relates to the field of computer technology, and in particular to an analysis method, device, electronic equipment and storage medium for alarm log data. Background Art

[0002] With the rapid development of the Internet and computer technology, network equipment and application services are showing an explosive growth trend, and all walks of life are integrated with the Internet. This has brought many opportunities for the development of Internet technology, but also brought huge challenges to the availability, stability and user experience of Internet-related services.

[0003] At present, in order to ensure the stability of large-scale Internet application services, the alarm log data (i.e., abnormal log data) can be monitored in real time through the monitoring system and the alarm log data can be analyzed; however, the existing scheme can only analyze the alarm log data of the same data source, and it is difficult to analyze the alarm log data of multiple data sources at the same time, resulting in a long analysis time and low accuracy.

[0004] How to analyze alarm log data from different data sources at the same time and quickly obtain accurate analysis results is a key issue in industry research. Summary of the invention

[0005] The present invention provides an analysis method, device, electronic device and storage medium for alarm log data to solve the problem that alarm log data from multiple data sources cannot be analyzed simultaneously. Alarm log data from different data sources can be analyzed simultaneously, and accurate analysis results can be obtained quickly.

[0006] According to one aspect of the present invention, a method for analyzing alarm log data is provided, the method comprising:

[0007] Acquire an original log data set, and determine a first entity field in target original log data; each original log data in the original log data set is alarm log data generated by different data sources;

[0008] Generate a target entity field and a target entity identifier according to the first entity field, and generate reference alarm log data based on the target original log data, the target entity field and the target entity identifier;

[0009] Acquire reference alarm log data with the same target entity identifier within a target time period, and fuse the reference alarm log data to obtain fused target alarm log data;

[0010] An entity topology map of the target alarm log data is determined, and a target alarm entity matching the target alarm log data is determined according to the entity topology map.

[0011] According to another aspect of the present invention, there is provided a device for analyzing alarm log data, the device comprising:

[0012] A first entity field determination module is used to obtain an original log data set and determine a first entity field in target original log data; each original log data in the original log data set is alarm log data generated by different data sources;

[0013] A reference alarm log data generating module, configured to generate a target entity field and a target entity identifier according to the first entity field, and to generate reference alarm log data based on the target original log data, the target entity field and the target entity identifier;

[0014] A target alarm log data determination module is used to obtain reference alarm log data with the same target entity identifier within a target time period, and merge the reference alarm log data to obtain merged target alarm log data;

[0015] The entity topology map determining module is used to determine the entity topology map of the target alarm log data, and determine the target alarm entity matching the target alarm log data according to the entity topology map.

[0016] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0017] at least one processor; and

[0018] a memory communicatively connected to the at least one processor; wherein,

[0019] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the alarm log data analysis method described in any embodiment of the present invention.

[0020] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the alarm log data analysis method described in any embodiment of the present invention when executed.

[0021] According to another aspect of the present invention, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the method for analyzing alarm log data according to any embodiment of the present invention is implemented.

[0022] The technical solution of the embodiment of the present invention is to obtain an original log data set and determine the first entity field in the target original log data; each original log data in the original log data set is alarm log data generated by different data sources; generate a target entity field and a target entity identifier according to the first entity field, and generate reference alarm log data based on the target original log data, the target entity field and the target entity identifier; obtain each reference alarm log data with the same target entity identifier within a target time period, and merge each reference alarm log data to obtain merged target alarm log data; determine the entity topology map of the target alarm log data, and determine the target alarm entity matching the target alarm log data according to the entity topology map, so as to solve the problem that the alarm log data of multiple data sources cannot be analyzed at the same time, and the alarm log data of different data sources can be analyzed at the same time, and accurate analysis results can be obtained quickly.

[0023] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0024] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0025] Figure 1 is a flow chart of a method for analyzing alarm log data provided according to Embodiment 1 of the present invention;

[0026] Figure 2 is a flow chart of a method for analyzing alarm log data provided according to Embodiment 2 of the present invention;

[0027] Figure 3 This is a schematic diagram of the structure of an alarm log data analysis device provided according to Embodiment 3 of the present invention;

[0028] Figure 4 It is a structural schematic diagram of an electronic device for implementing the alarm log data analysis method according to an embodiment of the present invention. DETAILED DESCRIPTION

[0029] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0030] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0031] Embodiment 1

[0032] Figure 1 This is a flow chart of a method for analyzing alarm log data according to the first embodiment of the present invention. This embodiment is applicable to the case of analyzing alarm log data from different data sources. The method can be executed by an analysis device for alarm log data. The analysis device for alarm log data can be implemented in the form of hardware and / or software. The analysis device for alarm log data can be configured in electronic devices such as computers, servers or tablet computers. Figure 1 As shown, the method includes:

[0033] Step 110: Acquire an original log data set, and determine the first entity field in the target original log data.

[0034] Among them, log data refers to the process event record data generated during the operation of servers, network equipment, security equipment, databases, middleware and business systems in the Internet production environment; log data is unstructured text, and the log information in the log data records specific system behaviors through timestamps, log levels and log contents.

[0035] In a specific implementation, each log data can be monitored by a monitoring system to determine abnormal log data, i.e., alarm log data, and store these alarm log data in a target storage; wherein the target storage can be a cloud database or a local database, which is not limited in this embodiment.

[0036] Optionally, in this embodiment, the original log data set can be obtained from the target storage; it should be noted that each original log data in the original log data set involved in this embodiment is alarm log data generated by different data sources; wherein the data source can be various types of databases, files or services, etc., which are not limited in this embodiment.

[0037] In this embodiment, the target original log data can be any one or more alarm log data in the original log data set, which is not limited in this embodiment. The first entity field in the target original log data can be any entity field in the target original log data, such as a host name or a process, which is not limited in this embodiment.

[0038] It is understandable that the entity may be a machine, process, container, service or interface that generates log data, which is not limited in this embodiment.

[0039] Optionally, in an optional implementation of the present embodiment, the first entity field in the target original log data can be determined according to a predefined entity configuration rule; exemplarily, if the predefined entity configuration rule defines the host name as a field to be processed, then the host name in the target original log data and the data content corresponding to the host name can be determined as the first entity field.

[0040] In an optional implementation of the present embodiment, determining the first entity field in the target original log data may include: splitting the target original log data based on preset key fields to obtain data content matching each key field; associating each key field with each alarm field in the target page, matching the data content matching the target key field with the target alarm field; associating the target key field with the target alarm field; displaying each target alarm field and the data content matching each target alarm field in the target page; obtaining a preset entity configuration rule, and determining the first entity field according to the preset entity configuration rule;

[0041] Among them, the key field may include at least one of the following: name, time, identifier and source; the alarm field may include at least one of the following: alarm name, alarm time, alarm identifier, alarm level and alarm object, which are not limited in this embodiment.

[0042] Optionally, in this embodiment, the target original log data can be split according to preset key fields to obtain data content about the target original log data that matches each key field; for example, it can be split to obtain "name-xx, time-xx, identifier-xx", where "xx" is the specific data content of the log data, and in this embodiment, it is only used to represent the corresponding data content, and does not represent the data content itself; it should be noted that in this embodiment, the split data content that matches each of the key fields can also be displayed or stored in other ways. For example, each key field and the data content that matches each key field can be stored in the form of a table; for example, the first row of the table can be each key field, and the second row is the data content that matches each key field.

[0043] Furthermore, each key field can be associated with each alarm field in the target page. For example, the name in the key field can be associated with the alarm name in the alarm field; the time in the key field can be associated with the alarm time in the alarm field; the identifier in the key field can be associated with the alarm identifier in the alarm field; and the source in the key field can be associated with the alarm source in the alarm field.

[0044] Furthermore, each target alarm field and the data content matching the target alarm field can be displayed in the target page. Exemplarily, the content of the target page can be displayed in the form of a table; for example, the first row of the table can be each target alarm field, and the second row can be the data content matching each target alarm field. Further, the preset entity configuration rule can be obtained, and the specific content of the entity configuration rule can be determined, and further, the first entity field can be determined. Exemplarily, the first entity field can be "hostname", and the specific numerical content of the first entity field can be "10.23.42.1".

[0045] Step 120: Generate a target entity field and a target entity identifier according to the first entity field, and generate reference alarm log data based on the target original log data, the target entity field and the target entity identifier.

[0046] In an optional implementation of this embodiment, after obtaining the first entity field in the target original log data, the target entity field and the target entity identifier can be further generated based on the first entity field. Furthermore, reference alarm log data can be generated based on the target original log data, the target entity field and the target entity identifier.

[0047] Optionally, in this embodiment, generating a target entity field and a target entity identifier based on the first entity field may include: combining the first entity field with a preset string to obtain a first component of the target entity field; using the data content of the first entity field as the second component of the target entity field; connecting the first component and the second component via a preset connector to obtain the target entity field; and generating the target entity identifier based on the data content of the first entity field.

[0048] The preset character string may be "yotta.entity" or other character strings, which are not limited in this embodiment.

[0049] In this embodiment, the preset string can be combined with the first entity field to obtain the first component of the target entity field; exemplarily, if the preset string is "yotta.entity" and the first entity field is "hostname", then the first component of the target entity field can be "yotta.entity.hostname".

[0050] Furthermore, the data content of the first entity field may be used as the second component of the target entity field, and the first component and the second component may be connected by a preset connector to obtain the target entity field.

[0051] The preset connector may be "=" or "-", which is not limited in this embodiment. It is understandable that in this embodiment, the target entity field may be represented as "first component (preset string + first entity field) = second component".

[0052] In the above example, if the specific numeric content of the first entity field is "10.23.42.1", it can be used as the second component of the target entity field, and the obtained target entity field can be "yotta.entity.hostname=10.23.42.1".

[0053] In this embodiment, a target entity identifier can also be generated based on the data content of the first entity field; illustratively, the target entity identifier generated in the above example can be "yotta.entity.id=10.23.42.1"; optionally, in this embodiment, after obtaining the target entity identifier, the content of the target entity identifier can be converted into an unreadable fixed string according to a preset format. illustratively, the target entity identifier in the above example can be converted into "yotta.entity.id=cd3422245".

[0054] In an optional implementation of this embodiment, generating reference alarm log data based on the target original log data, the target entity field and the target entity identifier may include: adding the target entity field and the target entity identifier to the target original log data to obtain the reference alarm log data.

[0055] For example, the target original log data is "hostname = 10.23.42.1, alarm.time, 2024.8.24 10:23:24, memory.usage = 82%, alarm.id = 1324, alarm.name = memory alarm, alarm.type =, alarm.object = 10.23.42.1" and the target entity field is: "yotta.entity.hostname = 10.23.42.1", and the target entity identifier is: "yotta.entity.id = cd3422245", then the generated reference alarm log data can be: "hostname = 10.23.42.1, yotta.entity.hostname = 10.23.42.1, yotta.entity.id = cd3422245, alarm.time, 2024.8.24 10:23:24, memory.usage = 82%, alarm.id = 1324, alarm.name = memory alarm, alarm.type =, alarm.object = 10.23.42.1".

[0056] Step 130: Acquire reference alarm log data with the same target entity identifier within a target time period, and fuse the reference alarm log data to obtain fused target alarm log data.

[0057] The target time period may be any time period, for example, 8:00 to 8:30 in the morning or 2:00 today to 11:00 tomorrow, etc., which is not limited in the present embodiment.

[0058] In an optional implementation of this embodiment, reference alarm log data with the same target entity identifier within the target time period may be fused to obtain fused target alarm log data.

[0059] Optionally, in this embodiment, after obtaining each reference alarm log data generated within the target time period, the target entity identifier of each reference alarm log data may be identified, and the reference alarm log data with the same target entity identifier may be fused to obtain fused target alarm log data.

[0060] Exemplarily, Table 1 records two reference alarm log data with the same target entity identifier:

[0061] Table 1

[0062]

[0063]

[0064] Step 140: Determine an entity topology map of the target alarm log data, and determine a target alarm entity that matches the target alarm log data according to the entity topology map.

[0065] In an optional implementation of this embodiment, after obtaining the fused target alarm log data, an entity topology map of the target alarm log data may be further determined, and a target alarm entity matching the target alarm data may be determined according to the entity topology map.

[0066] It should be noted that the entity topology diagram records the associations between entities involved in the target alarm log data, such as inclusion relationships or connection relationships, which are not limited in this embodiment.

[0067] Optionally, determining the entity topology map of the target alarm log data may include: obtaining each target entity field in the target alarm log data, and determining the upstream and downstream relationships of each target entity based on an entity relationship rule base; and generating the entity topology map of the target alarm log data according to the upstream and downstream relationships of each target entity.

[0068] In an optional implementation of the present embodiment, after obtaining the fused target alarm log data, the target entity fields in the target alarm log data can be further obtained, and the upstream and downstream relationships of the target entities corresponding to the target entity fields can be determined based on the entity relationship rule base. Furthermore, an entity topology diagram of the target alarm log data can be generated based on the upstream and downstream relationships of the target entities.

[0069] The target entity may be an entity corresponding to any target entity field in the target alarm log data, which is not limited in this embodiment. It can be understood that in this embodiment, the entity relationship rule base records the relationship between the entities; for example, machine 1 includes container 2 and interface 3, machine 1 is connected to machine 4, etc., which is not limited in this embodiment.

[0070] In this embodiment, the generated entity topology map may include multiple levels, each level may include multiple entities; illustratively, the entity topology map may include three levels, the first level and the third level include one entity, and the second level, i.e., the middle level, includes three entities.

[0071] Optionally, in this embodiment, determining the target alarm entity that matches the target alarm log data based on the entity topology map may include: traversing each level of the entity topology map to determine the target level; the target level contains the largest number of alarm entities; and determining the entity in the target level as the target alarm entity.

[0072] In an optional implementation of the present embodiment, after obtaining the entity topology map, each level of the entity topology map can be further traversed to determine the number of entities contained in each level. Furthermore, the level with the largest number of entities can be determined as the target level, and the entities in the target level can be determined as target alarm entities.

[0073] The advantage of this setting is that it can help users quickly locate key entities and pay attention to them.

[0074] In another optional implementation of this embodiment, after obtaining the entity topology map, the most downstream entity can be further determined based on the upstream and downstream relationships of each entity in the entity topology map, and the most downstream entity can be analyzed to obtain the root cause of the target alarm log data alarm, thereby providing a basis for solving the alarm problem.

[0075] The technical solution of this embodiment is to obtain an original log data set and determine the first entity field in the target original log data; each original log data in the original log data set is alarm log data generated by different data sources; generate a target entity field and a target entity identifier according to the first entity field, and generate reference alarm log data based on the target original log data, the target entity field and the target entity identifier; obtain each reference alarm log data with the same target entity identifier within a target time period, and merge each reference alarm log data to obtain merged target alarm log data; determine an entity topology map of the target alarm log data, and determine a target alarm entity matching the target alarm log data according to the entity topology map, thereby solving the problem that the alarm log data of multiple data sources cannot be analyzed at the same time, and the alarm log data of different data sources can be analyzed at the same time, and accurate analysis results can be obtained quickly.

[0076] Embodiment 2

[0077] Figure 2 1 is a flowchart of an analysis method of alarm log data provided according to Embodiment 2 of the present invention. This embodiment is a further refinement of the above technical solution. The technical solution in this embodiment can be combined with each optional solution in one or more of the above embodiments. Figure 2 As shown, the method includes:

[0078] Step 210: Acquire an original log data set, and determine the first entity field in the target original log data.

[0079] Step 220: Generate a target entity field and a target entity identifier according to the first entity field, and generate reference alarm log data based on the target original log data, the target entity field and the target entity identifier.

[0080] Step 230: Acquire reference alarm log data with the same target entity identifier within the target time period, and fuse the reference alarm log data to obtain fused target alarm log data.

[0081] In an optional implementation of the present embodiment, after generating reference alarm log data based on the target original log data, the target entity field and the target entity identifier, it is possible to further obtain the reference alarm log data with the same target entity identifier within the target time period, and fuse the reference alarm log data to obtain the fused target alarm log data; exemplarily, in the present embodiment, the reference alarm log data with the same target entity identifier can be stored in the same table or the same folder to quickly fuse the reference alarm log data.

[0082] Optionally, in this embodiment, each reference alarm log data with the same target entity identifier within a target time period is obtained, and each reference alarm log data is merged to obtain the merged target alarm log data, which may include: determining the target time period in response to an analysis instruction of the alarm log data; identifying the target entity identifier of each reference alarm log data within the target time period, and determining each reference alarm log data with the same target entity identifier; and displaying each reference alarm log data on the same page to obtain the target alarm log data.

[0083] In an optional implementation of the present embodiment, if an analysis instruction for alarm log data is received, the target time period can be determined based on the instruction; further, the target entity identifier of each reference alarm log data generated within the target time period can be identified, thereby obtaining each reference alarm log data with the same target entity identifier; further, each reference alarm log data with the same target entity identifier can be displayed on the same page, thereby obtaining the fused target alarm log data.

[0084] Step 240: Generate an alarm push message according to the target alarm log data, and send the alarm push message to the target user.

[0085] In an optional implementation of this embodiment, after the fused target alarm log data is obtained, an alarm push message of the target alarm log data may be further generated, and the alarm push message may be sent to the target user.

[0086] It should be noted that the target alarm log data corresponding to the same target entity identifier can be pushed to the same user, which can facilitate the target user to quickly determine the alarm cause corresponding to the target alarm log data.

[0087] The solution of this embodiment can determine the target time period in response to the analysis instruction of the alarm log data; identify the target entity identifier of each reference alarm log data within the target time period, and determine each reference alarm log data with the same target entity identifier; display each of the reference alarm log data on the same page to obtain the target alarm log data; further, an alarm push message can be generated based on the target alarm log data, and the alarm push message can be sent to the target user, and the log data with the same target entity identifier can be quickly merged and pushed to the target user, providing a basis for the target user to quickly determine the alarm cause corresponding to the target alarm log data.

[0088] Embodiment 3

[0089] Figure 3 1 is a schematic diagram of the structure of an analysis device for alarm log data provided according to Embodiment 3 of the present invention. Figure 3 As shown, the device includes: a first entity field determination module 310 , a reference alarm log data generation module 320 , a target alarm log data determination module 330 and an entity topology map determination module 340 .

[0090] The first entity field determination module 310 is used to obtain an original log data set and determine a first entity field in the target original log data; each original log data in the original log data set is alarm log data generated by different data sources;

[0091] A reference alarm log data generating module 320, configured to generate a target entity field and a target entity identifier according to the first entity field, and to generate reference alarm log data based on the target original log data, the target entity field and the target entity identifier;

[0092] The target alarm log data determination module 330 is used to obtain reference alarm log data with the same target entity identifier within a target time period, and merge the reference alarm log data to obtain merged target alarm log data;

[0093] The entity topology map determining module 340 is used to determine the entity topology map of the target alarm log data, and determine the target alarm entity matching the target alarm log data according to the entity topology map.

[0094] The solution of this embodiment is to obtain the original log data set through the first entity field determination module, and determine the first entity field in the target original log data; generate the target entity field and the target entity identifier according to the first entity field through the reference alarm log data generation module, and generate the reference alarm log data based on the target original log data, the target entity field and the target entity identifier; obtain each reference alarm log data with the same target entity identifier within the target time period through the target alarm log data determination module, and merge each reference alarm log data to obtain the merged target alarm log data; determine the entity topology map of the target alarm log data through the entity topology map determination module, and determine the target alarm entity matching the target alarm log data according to the entity topology map, which solves the problem that the alarm log data of multiple data sources cannot be analyzed at the same time, and the alarm log data of different data sources can be analyzed at the same time, and accurate analysis results can be obtained quickly.

[0095] In an optional implementation of this embodiment, the first entity field determination module 310 is specifically configured to split the target original log data based on preset key fields to obtain data content matching the key fields;

[0096] Associating each of the key fields with each of the alarm fields in the target page, matching the data content matching the target key field with the target alarm field; associating the target key field with the target alarm field;

[0097] Displaying each of the target alarm fields and data content matching each of the target alarm fields on a target page;

[0098] Obtaining a preset entity configuration rule, and determining the first entity field according to the preset entity configuration rule;

[0099] The key fields include at least one of the following: name, time, identification and source;

[0100] The alarm field includes at least one of the following: alarm name, alarm time, alarm identifier, alarm level and alarm object.

[0101] In an optional implementation of this embodiment, referring to the alarm log data generating module 320, it is specifically configured to combine the first entity field with a preset string to obtain a first component of the target entity field;

[0102] Using the data content of the first entity field as the second component of the target entity field;

[0103] Connecting the first component and the second component by a preset connector to obtain the target entity field;

[0104] Generate the target entity identifier according to the data content of the first entity field;

[0105] Correspondingly, the reference alarm log data generating module 320 is further specifically configured to add the target entity field and the target entity identifier to the target original log data to obtain the reference alarm log data.

[0106] In an optional implementation of this embodiment, the target alarm log data determination module 330 is specifically configured to determine a target time period in response to an analysis instruction of the alarm log data;

[0107] Identify the target entity identifiers of the reference alarm log data within the target time period, and determine the reference alarm log data with the same target entity identifier;

[0108] The reference alarm log data are displayed on the same page to obtain the target alarm log data.

[0109] In an optional implementation of this embodiment, the alarm log data analysis device further includes a push module, which is used to generate an alarm push message according to the target alarm log data, and send the alarm push message to a target user.

[0110] In an optional implementation of this embodiment, the entity topology map determination module 340 is specifically used to obtain each target entity field in the target alarm log data, and determine the upstream and downstream relationship of each target entity based on the entity relationship rule base;

[0111] An entity topology diagram of the target alarm log data is generated according to the upstream and downstream relationships of each of the target entities.

[0112] In an optional implementation of this embodiment, the entity topology map determining module 340 is further specifically used to traverse each level of the entity topology map to determine a target level; the target level contains the largest number of alarm entities;

[0113] An entity in the target level is determined as a target alarm entity.

[0114] The alarm log data analysis device provided in the embodiment of the present invention can execute the alarm log data analysis method provided in any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method.

[0115] Embodiment 4

[0116] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0117] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0118] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0119] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various dedicated artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, digital signal processors (DSPs), and any appropriate processors, controllers, microcontrollers, etc. The processor 11 performs the various methods and processes described above, such as an analysis method for alarm log data; the method includes: obtaining an original log data set, and determining a first entity field in the target original log data; each original log data in the original log data set is an alarm log data generated by different data sources; generating a target entity field and a target entity identifier according to the first entity field, and generating reference alarm log data based on the target original log data, the target entity field and the target entity identifier; obtaining each reference alarm log data with the same target entity identifier within a target time period, and fusing each reference alarm log data to obtain the fused target alarm log data; determining an entity topology map of the target alarm log data, and determining a target alarm entity matching the target alarm log data according to the entity topology map.

[0120] In some embodiments, the analysis method of alarm log data may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the analysis method of alarm log data described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to perform the analysis method of alarm log data in any other appropriate manner (e.g., by means of firmware).

[0121] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0122] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0123] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0124] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0125] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0126] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0127] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps described in the present invention can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solution of the present invention can be achieved, and this document does not limit this.

[0128] The above specific implementations do not constitute a limitation on the protection scope of the present invention. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present invention should be included in the protection scope of the present invention.

Claims

1. A method for analyzing alarm log data, characterized in that: include: Obtaining an original log data set, and determining a first entity field in the target original log data; Each original log data in the original log data set is alarm log data generated by different data sources; Generate a target entity field and a target entity identifier according to the first entity field, and generate reference alarm log data based on the target original log data, the target entity field and the target entity identifier; Acquire reference alarm log data with the same target entity identifier within a target time period, and fuse the reference alarm log data to obtain fused target alarm log data; An entity topology map of the target alarm log data is determined, and a target alarm entity matching the target alarm log data is determined according to the entity topology map.

2. The method for analyzing alarm log data according to claim 1, characterized in that: The determining of the first entity field in the target original log data includes: Splitting the target original log data based on preset key fields to obtain data content matching the key fields; Associating each of the key fields with each of the alarm fields in the target page, matching the data content matching the target key field with the target alarm field; associating the target key field with the target alarm field; Displaying each of the target alarm fields and data content matching each of the target alarm fields on a target page; Obtaining a preset entity configuration rule, and determining the first entity field according to the preset entity configuration rule; The key fields include at least one of the following: name, time, identification and source; The alarm field includes at least one of the following: alarm name, alarm time, alarm identifier, alarm level and alarm object.

3. The method for analyzing alarm log data according to claim 2, characterized in that: The generating a target entity field and a target entity identifier according to the first entity field includes: Combining the first entity field with a preset character string to obtain a first component of the target entity field; Using the data content of the first entity field as the second component of the target entity field; Connecting the first component and the second component by a preset connector to obtain the target entity field; Generate the target entity identifier according to the data content of the first entity field; Accordingly, the generating reference alarm log data based on the target original log data, the target entity field and the target entity identifier includes: The target entity field and the target entity identifier are added to the target original log data to obtain the reference alarm log data.

4. The method for analyzing alarm log data according to claim 1, characterized in that: The obtaining of reference alarm log data with the same target entity identifier within the target time period, and fusing the reference alarm log data to obtain fused target alarm log data, includes: In response to the analysis instruction of the alarm log data, determining a target time period; Identify the target entity identifiers of the reference alarm log data within the target time period, and determine the reference alarm log data with the same target entity identifier; The reference alarm log data are displayed on the same page to obtain the target alarm log data.

5. The method for analyzing alarm log data according to claim 1, characterized in that: After obtaining the target alarm log data, the method further includes: Generate an alarm push message according to the target alarm log data, and send the alarm push message to the target user.

6. The method for analyzing alarm log data according to claim 1, characterized in that: The determining of the entity topology diagram of the target alarm log data includes: Obtain each target entity field in the target alarm log data, and determine the upstream and downstream relationships of each target entity based on the entity relationship rule base; An entity topology diagram of the target alarm log data is generated according to the upstream and downstream relationships of each of the target entities.

7. The method for analyzing alarm log data according to claim 6, characterized in that: The determining, according to the entity topology map, a target alarm entity that matches the target alarm log data comprises: Traversing each level of the entity topology map to determine a target level; the target level contains the largest number of alarm entities; An entity in the target level is determined as a target alarm entity.

8. An analysis device for alarm log data, characterized in that: include: A first entity field determination module, used to obtain an original log data set and determine a first entity field in the target original log data; Each original log data in the original log data set is alarm log data generated by different data sources; A reference alarm log data generating module, configured to generate a target entity field and a target entity identifier according to the first entity field, and to generate reference alarm log data based on the target original log data, the target entity field and the target entity identifier; A target alarm log data determination module is used to obtain reference alarm log data with the same target entity identifier within a target time period, and fuse the reference alarm log data to obtain fused target alarm log data; The entity topology map determining module is used to determine the entity topology map of the target alarm log data, and determine the target alarm entity matching the target alarm log data according to the entity topology map.

9. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the alarm log data analysis method according to any one of claims 1 to 7.

10. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the alarm log data analysis method according to any one of claims 1 to 7 when executed.

Images