Log retrieval performance evaluation method and device, electronic equipment, medium and program

Abstract

The embodiment of the invention discloses a log retrieval performance evaluation method and device, electronic equipment, a medium and a program, and the method comprises the steps: generating log sample data according to original log data of a target log retrieval system; executing a log retrieval operation under a first set retrieval condition on the log sample data through the target log retrieval system; wherein the first set retrieval condition comprises a first set log data volume and / or a first set log retrieval concurrent load; obtaining log retrieval performance index data of the log retrieval operation executed by the target log retrieval system; and evaluating the log retrieval performance of the log retrieval system according to the log retrieval performance index data. According to the technical scheme, the efficiency, accuracy and rationality of log retrieval performance evaluation can be improved.

Description

Technical Field

[0001] Embodiments of the present invention relate to the field of data processing technology, and in particular to a log retrieval performance evaluation method, device, electronic device, storage medium and program. Background Art

[0002] With the widespread application of large-scale distributed systems and cloud computing, the amount of log data generated by the system has exploded. Log retrieval systems play an important role in fault diagnosis, system optimization, and security monitoring, but in the scenario of large data volumes and high concurrent access, the evaluation of retrieval performance has become an urgent problem to be solved.

[0003] At present, traditional log retrieval performance analysis of log retrieval systems usually relies on manual intervention, which is inefficient and cannot handle complex queries of large-scale data sets. At the same time, existing log retrieval performance analysis methods fail to fully consider the impact of data scale on performance and lack scalability tests for large data sets. Most traditional methods can only provide evaluation results under current conditions, lack the ability to predict system performance under future data growth, and the evaluation method is not reasonable enough. Summary of the invention

[0004] The embodiments of the present invention provide a log retrieval performance evaluation method, device, electronic device, storage medium and program, which can improve the efficiency, accuracy and rationality of log retrieval performance evaluation.

[0005] According to one aspect of the present invention, a log retrieval performance evaluation method is provided, comprising:

[0006] Generate log sample data according to the original log data of the target log retrieval system;

[0007] Performing a log retrieval operation under a first set retrieval condition on the log sample data through the target log retrieval system; wherein the first set retrieval condition includes a first set log data volume and / or a first set log retrieval concurrent load;

[0008] Obtaining log retrieval performance indicator data of the target log retrieval system executing the log retrieval operation;

[0009] The log retrieval performance of the log retrieval system is evaluated according to the log retrieval performance indicator data.

[0010] According to another aspect of the present invention, a log retrieval performance evaluation device is provided, comprising:

[0011] A log sample data generation module, used to generate log sample data according to the original log data of the target log retrieval system;

[0012] A log retrieval operation execution module, configured to execute a log retrieval operation under a first set retrieval condition on the log sample data through the target log retrieval system; wherein the first set retrieval condition includes a first set log data volume and / or a first set log retrieval concurrent load;

[0013] A log retrieval performance indicator data acquisition module, used to acquire log retrieval performance indicator data of the log retrieval system executing the log retrieval operation;

[0014] The log retrieval performance evaluation module is used to evaluate the log retrieval performance of the log retrieval system according to the log retrieval performance indicator data.

[0015] According to another aspect of the present invention, an electronic device is provided, the electronic device comprising:

[0016] at least one processor; and

[0017] a memory communicatively connected to the at least one processor; wherein,

[0018] The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the log retrieval performance evaluation method described in any embodiment of the present invention.

[0019] According to another aspect of the present invention, a computer-readable storage medium is provided, wherein the computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the log retrieval performance evaluation method described in any embodiment of the present invention when executed.

[0020] According to another aspect of the present invention, a computer program product is provided, including a computer program, wherein when the computer program is executed by a processor, the log retrieval performance evaluation method according to any embodiment of the present invention is implemented.

[0021] The embodiment of the present invention generates log sample data based on the original log data of the target log retrieval system, and performs a log retrieval operation on the log sample data under a first set log data volume and / or a first set log retrieval concurrent load condition through the target log retrieval system, thereby obtaining log retrieval performance indicator data of the log retrieval operation performed by the target log retrieval system, and then evaluates the log retrieval performance of the log retrieval system based on the log retrieval performance indicator data, thereby solving the problems of low efficiency and unreasonableness existing in the existing log retrieval performance evaluation methods, and being able to improve the efficiency, accuracy and rationality of the log retrieval performance evaluation.

[0022] It should be understood that the contents described in this section are not intended to identify the key or important features of the embodiments of the present invention, nor are they intended to limit the scope of the present invention. Other features of the present invention will become easily understood through the following description. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions in the embodiments of the present invention, the following briefly introduces the drawings required for use in the description of the embodiments. Obviously, the drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other drawings can be obtained based on these drawings without creative work.

[0024] Figure 1 is a flow chart of a log retrieval performance evaluation method provided by Embodiment 1 of the present invention;

[0025] Figure 2 is a flow chart of a log retrieval performance evaluation method provided by Embodiment 2 of the present invention;

[0026] Figure 3 is a schematic diagram of a log retrieval performance evaluation device provided by Embodiment 3 of the present invention;

[0027] Figure 4 A schematic diagram of the structure of an electronic device provided in Embodiment 4 of the present invention. DETAILED DESCRIPTION

[0028] In order to enable those skilled in the art to better understand the scheme of the present invention, the technical scheme in the embodiments of the present invention will be clearly and completely described below in conjunction with the drawings in the embodiments of the present invention. Obviously, the described embodiments are only part of the embodiments of the present invention, not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary technicians in this field without creative work should fall within the scope of protection of the present invention.

[0029] It should be noted that the terms "first", "second", etc. in the specification and claims of the present invention and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence. It should be understood that the data used in this way can be interchanged where appropriate, so that the embodiments of the present invention described herein can be implemented in an order other than those illustrated or described herein. In addition, the terms "including" and "having" and any variations thereof are intended to cover non-exclusive inclusions, for example, a process, method, system, product or device that includes a series of steps or units is not necessarily limited to those steps or units that are clearly listed, but may include other steps or units that are not clearly listed or inherent to these processes, methods, products or devices.

[0030] Embodiment 1

[0031] Figure 1 This is a flow chart of a log retrieval performance evaluation method provided in the first embodiment of the present invention. This embodiment can be applied to the situation where the retrieval condition is set according to the first set log data volume and / or the first set log retrieval concurrent load to evaluate the performance of the log retrieval system. The method can be executed by a log retrieval performance evaluation device, which can be implemented by software and / or hardware and can generally be integrated in an electronic device. The electronic device can be a terminal device or a server device. As long as it can execute the log retrieval performance evaluation method, the embodiment of the present invention does not limit the specific device type of the electronic device. Accordingly, Figure 1 As shown, the method includes the following operations:

[0032] S110 , generating log sample data according to original log data of a target log retrieval system.

[0033] Among them, the target log retrieval system can be a log retrieval system that needs to perform log retrieval performance evaluation. As long as it can provide log retrieval function, the embodiment of the present invention does not limit the system type and functional composition architecture of the target log retrieval system. The original log data can be the log data originally stored by the target log retrieval system. It can be understood that the type and application scenario of the target log retrieval system are different, and the content and type of the original log data stored may also be different. The embodiment of the present invention does not limit the data type and data content of the original log data. The log sample data can be sample data generated by simulating the original log data of the target log retrieval system.

[0034] In the embodiment of the present invention, the log retrieval system whose log retrieval performance needs to be evaluated can be first determined as the target log retrieval system. Accordingly, after the target log retrieval system is determined, the original log data stored in the target log retrieval system can be simulated to generate a large number of required log sample data to meet the scalability test requirements for the large data set of the target log retrieval system.

[0035] S120. Perform a log retrieval operation under a first set retrieval condition on the log sample data through the target log retrieval system; wherein the first set retrieval condition includes a first set log data volume and / or a first set log retrieval concurrent load.

[0036] The first set retrieval condition may be a retrieval condition for collecting relevant performance indicator data generated by the target log retrieval system during the log retrieval operation. The first set log data volume may be the volume of log data to be retrieved set for the target log retrieval system during the process of collecting relevant performance indicator data of the target log retrieval system. The first set log retrieval concurrent load may be the number of concurrent log retrieval queries set for the target log retrieval system during the process of collecting relevant performance indicator data of the target log retrieval system.

[0037] Correspondingly, after generating log sample data suitable for the target log retrieval system, the log retrieval operation under the first set retrieval condition can be performed on the log sample data through the target log retrieval system. Optionally, the target log retrieval system can be called to perform the corresponding log retrieval operation on the log sample data according to the first set retrieval condition by calling the API (Application Programming Interface) of the target log retrieval system. That is, the first set log data volume of the log sample data can be set to perform the log retrieval operation on the log sample data of the first set log data volume through the target log retrieval system. Alternatively, the first set log retrieval concurrent load of the log sample data can also be set to perform the log retrieval operation on the log sample data in response to the first set log retrieval concurrent load through the target log retrieval system. Alternatively, the first set log data volume and the first set log retrieval concurrent load of the log sample data can also be set to perform the log retrieval operation on the log sample data of the first set log data volume in response to the first set log retrieval concurrent load through the target log retrieval system.

[0038] S130: Obtain log retrieval performance indicator data of the target log retrieval system executing the log retrieval operation.

[0039] Among them, the log retrieval performance indicator data can be relevant indicator data that can reflect the retrieval performance of the target log retrieval system, for example, it can include but is not limited to data such as response time, throughput, and resource occupancy. The embodiment of the present invention does not limit the specific data content of the log retrieval performance indicator data.

[0040] Correspondingly, in the process of the target log retrieval system performing a log retrieval operation under the first set retrieval conditions on the log sample data, log retrieval performance indicator data related to the response time, throughput, resource occupancy, etc. of the target log retrieval system performing the log retrieval operation can be collected and acquired in real time, thereby recording the key performance indicators of the target log retrieval system under different log volumes and / or different log query scenarios.

[0041] Optionally, the first set log data volume can be changed dynamically to obtain log retrieval performance indicator data of the target log retrieval system under different data volumes. The first set log retrieval concurrent load can also be changed dynamically to obtain log retrieval performance indicator data of the target log retrieval system under different concurrent query volumes. At the same time, the first set log data volume and the first set log retrieval concurrent load can also be configured and combined as needed to obtain log retrieval performance indicator data of the target log retrieval system under different data volumes and different concurrent query volumes.

[0042] It can be understood that since the log sample data is data generated by simulating the target log retrieval system, it will not include the content of the original log data in the target log retrieval system, nor will it cause the leakage of log data stored in the target log retrieval system. Therefore, the security and reliability of the target log retrieval system can be guaranteed.

[0043] S140: Evaluate the log retrieval performance of the log retrieval system according to the log retrieval performance indicator data.

[0044] Accordingly, after obtaining the log retrieval performance index data of the target log retrieval system, the log retrieval performance index data of the target log retrieval system can be used as a benchmark for statistical analysis to obtain the retrieval performance of the target log retrieval system under the log sample data. Furthermore, based on the retrieval performance of the target log retrieval system under the log sample data, the log retrieval performance of the log retrieval system under other set retrieval conditions can be predicted and evaluated.

[0045] It can be seen that the above technical scheme sets a first set log data volume and / or a first set log retrieval concurrent load for the target log retrieval system to configure its first set retrieval condition, and performs log retrieval operations based on the first set retrieval condition through the target log retrieval system. This can effectively simulate the log retrieval behavior of the target log retrieval system under different log data volumes and / or query retrieval concurrency conditions, thereby obtaining performance indicator data of the target log retrieval system in various retrieval scenarios, and further realizing a comprehensive evaluation of the target log retrieval system.

[0046] The embodiment of the present invention generates log sample data based on the original log data of the target log retrieval system, and performs a log retrieval operation on the log sample data under a first set log data volume and / or a first set log retrieval concurrent load condition through the target log retrieval system, thereby obtaining log retrieval performance indicator data of the log retrieval operation performed by the target log retrieval system, and then evaluates the log retrieval performance of the log retrieval system based on the log retrieval performance indicator data, thereby solving the problems of low efficiency and unreasonableness existing in the existing log retrieval performance evaluation methods, and being able to improve the efficiency, accuracy and rationality of the log retrieval performance evaluation.

[0047] Embodiment 2

[0048] Figure 2 is a flow chart of a log retrieval performance evaluation method provided by the second embodiment of the present invention. This embodiment is specific based on the above embodiment. In this embodiment, multiple specific optional implementation methods are provided for generating log sample data based on the original log data of the target log retrieval system, performing a log retrieval operation under a first set retrieval condition on the log sample data through the target log retrieval system, and evaluating the log retrieval performance of the log retrieval system based on the log retrieval performance indicator data. Accordingly, as Figure 2 As shown, the method of this embodiment may include:

[0049] S210: Acquire original log data stored in the target log retrieval system.

[0050] S220, extracting log data features of the original log data; wherein the log data features include log data timestamp distribution features, keyword search field distribution features and log type ratios.

[0051] Among them, the timestamp distribution characteristics of the log data can reflect the distribution characteristics of the timestamp of the original log data. The keyword search field distribution characteristics can reflect the distribution characteristics of the keywords and search fields of the original log data. Keywords can be key information extracted from the original log data, and the search field can be a field commonly used for searching log data. Exemplarily, keywords and search fields can include but are not limited to IP addresses and user IDs (Identity document, ID card identification number), etc. The proportion of log types can reflect the proportion of different types of logs in the original log data. Exemplarily, different types of logs can include but are not limited to error logs and access logs.

[0052] In an embodiment of the present invention, when generating log sample data adapted to a target log retrieval system, the original log data stored in the target log retrieval system can be first obtained, and various required log data features such as log data timestamp distribution features, keyword retrieval field distribution features, and log type ratios of the original log data can be extracted.

[0053] In an optional embodiment of the present invention, if the log data characteristics include the keyword retrieval field distribution characteristics, then the extraction of the log data characteristics of the original log data may include: parsing the log format of the original log data to obtain the original log parsing result; extracting the key field and the retrieval field according to the original log parsing result; counting the absolute frequency of the key field and the retrieval field; and calculating the relative frequency of the key field and the retrieval field according to the absolute frequency of the key field and the retrieval field.

[0054] The original log parsing result may be a data result obtained by parsing the log format of the original log data.

[0055] Specifically, before extracting log data features of raw log data, the raw log data may be preprocessed first, for example, useless information may be cleaned, and then the log structure may be parsed according to useful information to extract key fields.

[0056] First, the structure of the log file can be parsed according to predefined log formats such as JSON (JavaScript Object Notation), CSV (Comma-Separated Values), or plain text. Common log fields may include timestamp, log level (such as ERROR, WARN, and INFO), source IP, user ID, request URL (uniform resource locator), and message content. For unstructured raw log data, regular expressions can be used to identify and extract key fields.

[0057] In a specific example, suppose one of the log entries of the original log data is: "2024-10-12 12:34:56 ERR OR [server-1] Timeout occurred while accessing database from IP 192.168.1.100 for user ID 12345". After parsing the log entry, the following fields can be extracted: timestamp: 2024-10-12 12:34:56; log level: ERROR; message content: Timeout occurred while accessing database; IP address: 192.168.1.100; user ID: 12345. After completing the parsing and preprocessing of the log entry, key fields and search fields, such as IP address and user ID, can be extracted from the message content and fields of the log. Optionally, text processing technology can be used to analyze the log content and extract key fields therein. Common methods may include: Term Frequency (TF): The system traverses the message part of the log and counts the frequency of each word. Frequently appearing words are considered to be common key fields. Stop word filtering: To improve the accuracy of keyword extraction, you can first filter out common stop words such as "the", "is", "in", etc., which have little meaning to the log content. After extracting the key fields, you can perform stem extraction and word morphology merging on the words in the log to ensure that similar words such as "timeout" and "timeouts" can be identified as the same key field. In a specific example, for the following message content: "Timeout occurred while accessing database from IP 192.168.1.100", the following high-frequency key fields can be extracted: "timeout", "database" and "accessing".

[0058] For common search fields in the original log data, such as IP addresses and user IDs, the frequency of occurrence of these fields can be directly extracted and recorded. Since these fields usually have a specific format, such as IP addresses are xxx.xxx.xxx.xxx, and user IDs are usually numbers, regular expressions can be used to quickly identify these fields and count their occurrences. Exemplarily, the regular expression examples are as follows: Regular expression for IP address matching: (?:\d{1,3}\.){3}\d{1,3}; Regular expression for user ID matching: \b\d+\b (assuming that the user ID is a pure number). In this way, all IP addresses and user IDs can be quickly extracted from the original log data, and their frequency of occurrence can be counted.

[0059] After extracting the key fields and search fields, the absolute frequency of occurrence of each key field and field can be calculated. Specifically, a hash table or dictionary data structure can be used to record the number of occurrences of each key field and search field. The specific method is to traverse each key field or field. If the key field or field already exists in the dictionary, increase its count by one; otherwise, add it to the dictionary and set the count to 1. In a specific example, in 1,000 records of original log data, "timeout" appears 800 times and "database error" appears 500 times. These data can be recorded in JSON format as follows:

[0060]

[0061]

[0062] In order to calculate the relative frequency of key fields and search fields, the number of occurrences of each key field can be divided by the total amount of original log data to obtain the relative frequency of each key field and field. Continuing with the above example, the relative frequency of "imeoutt" is 800 / 1000=80%, and the relative frequency of "database error" is 500 / 1000=50%.

[0063] Optionally, after the extraction and frequency statistics of key fields and search fields are completed, a statistical report can be generated or the results can be visualized to help users understand common problems and hot keywords in the original log data. For example, a statistical report of the frequency of keywords (including key fields and search fields) can be shown in Table 1:

[0064] Table 1 Keyword frequency statistics

[0065] Keywords frequency timeout 80％ databaseerror 50％ IP192.168.1.100 15％ User ID 12345 20％

[0066] Alternatively, you can also generate a bar chart or pie chart for the statistical results of the key fields and search fields to visually display the frequency distribution of keywords, so as to help users more intuitively find hot issues in the original log data.

[0067] S230: Generate the log sample data according to the log data features of the original log data.

[0068] Accordingly, after extracting the log data features of the original log data, the log data features of the original log data can be simulated to generate a large number of required log sample data, so that the feature distribution of the log sample data matches the log data features of the original log data. In the process of generating log sample data based on the log data features of the original log data, the sensitive information of the data can be desensitized so that the log sample data finally generated does not include any sensitive information, thereby avoiding the problem of sensitive information leakage.

[0069] In a specific example, suppose that 1 billion pieces of raw log data stored in the target log retrieval system are obtained, and statistical analysis is performed on the 1 billion pieces of raw log data, the following log data features can be found:

[0070] (1) Error logs account for 40% of the total, access logs account for 50%, and other types account for 10%.

[0071] (2) In the error log, “timeout” and “database error” are the most common keywords, with frequencies of 80% and 50% respectively.

[0072] (3) The timestamps of the logs are mainly concentrated between 9:00 and 18:00 on weekdays.

[0073] Based on the above log data characteristics, large amounts of log sample data are automatically generated. The sample size of log sample data can start from 1 million and gradually increase, such as 1 million, 5 million, and 100 million, until the maximum sample size. Regardless of the size of the log sample data, its overall data characteristics still meet the above log data characteristics, so that each level of log sample data can effectively simulate the original log data.

[0074] S240: Perform a log search operation under a first set search condition on the log sample data through the target log search system.

[0075] The first set search condition includes a first set log data volume and / or a first set log search concurrent load.

[0076] In an optional embodiment of the present invention, performing a log retrieval operation under a first set retrieval condition on the log sample data through the target log retrieval system may include: determining a log retrieval method of the target log retrieval system; wherein the log retrieval method includes at least one of a keyword query method, a time range-based query method, a complex condition combination query method, and a concurrent query method; and performing the log retrieval operation under the first set retrieval condition on the log sample data in the target log retrieval system according to the log retrieval method.

[0077] When executing a log retrieval operation under the first set retrieval condition on the log sample data through the target log retrieval system, a variety of available log retrieval methods of the target log retrieval system can be set as needed, such as a keyword query method, a query method based on a time range, a complex condition combination query method, and a concurrent query method. The keyword query method is to query the log according to the keyword input by the user. The query method based on the time range is to query the log according to the time range specified by the user. The complex condition combination query method is to perform a log query based on multiple query conditions input by the user. The concurrent query method is that multiple users simultaneously and in parallel initiate log query retrieval requests to the target log retrieval system to perform parallel log queries. Accordingly, after determining the log retrieval method of the target log retrieval system, the log retrieval operation under the first set retrieval condition can be performed on the log sample data in the target log retrieval system according to the log retrieval method.

[0078] In an optional embodiment of the present invention, performing a log retrieval operation under a first set retrieval condition on the log sample data through the target log retrieval system may include: determining a current log sample data volume; performing a log retrieval operation under the first set log retrieval concurrent load on the log sample data of the current log sample data volume through the target log retrieval system; multiplying the current log sample data volume step by step using a multiplication method; and returning to perform a log retrieval operation under the first set log retrieval concurrent load on the log sample data of the current log sample data volume through the target log retrieval system until it is determined that the current log sample data volume reaches a performance bottleneck log sample data volume.

[0079] The current log sample data volume may be the data volume that the target log retrieval system currently refers to for retrieval. The performance bottleneck log sample data volume may be the maximum log data volume that the target log retrieval system can carry. It is understandable that when the data volume of the log sample data exceeds the performance bottleneck log sample data volume, the target log retrieval system may experience various faults such as serious retrieval timeout, inability to retrieve normally, or retrieval failure.

[0080] In an embodiment of the present invention, different levels of log sample data volumes can also be set for the target log retrieval system so that the target log retrieval system performs corresponding log retrieval operations for different levels of log sample data volumes, thereby obtaining performance indicator data of the target log retrieval system performing log retrieval under different levels of log sample data volumes.

[0081] In a specific example, by calling the API of the target log retrieval system, a series of retrieval operations can be performed based on the target log retrieval system, including: (1) Simple keyword query, such as searching for logs related to "timeout". (2) Queries based on time range, such as querying logs between October 1, 2024 and October 7, 2024. (3) Query with complex condition combinations, such as logs containing both "error" and "database". (4) Concurrent query simulation, a query scenario where multiple users access the system at the same time. The system simulates a concurrent number starting from 10 and gradually increasing to 1,000.

[0082] For example, by calling the API of the target log retrieval system, 50 users' concurrent log queries are performed, and all log data of the keyword "timeout" in the past 7 days are searched. Then, the number of concurrent queries is gradually increased to 500, and the response time of each log query is recorded. Alternatively, by calling the API of the target log retrieval system, the current 1 million log sample data are queried, and the response time of each log query is recorded.

[0083] In order to comprehensively evaluate the performance of the target log retrieval system under large amounts of data, the amount of log sample data can be multiplied step by step. By increasing the amount of log sample data by multiples such as 10 times, 50 times and 100 times, a log data set of multiple log sample data is generated for retrieval performance testing, and the current amount of log sample data is multiplied step by step using the multiplication method until the performance bottleneck of the target log retrieval system is reached. Exemplarily, during the test of the target log retrieval system, it can start from 1 million log sample data and increase step by step to 10 million, 100 million and 1 billion, and record the log retrieval performance indicator data under each multiple log amount. When the amount of log sample data reaches 1 billion, it is detected that the response time of the target log retrieval system rises sharply to 5 seconds, and the system resources are close to saturation.

[0084] S250: Obtain log retrieval performance indicator data of the target log retrieval system executing the log retrieval operation.

[0085] Optionally, an automated monitoring tool may be used to automatically monitor and record key performance indicators of the target log retrieval system under different log data volumes and / or different concurrent query scenarios, which may include but are not limited to: response time: the time from sending a log retrieval request to the target log retrieval system returning the result, which is recorded in milliseconds; throughput: the number of query requests that the target log retrieval system can process per unit time; resource usage: recording the CPU (Central Processing Unit), memory, and disk I / O (Input / Output) usage of the target log retrieval system, expressed as a percentage or absolute value.

[0086] For example, under the retrieval conditions of 1 million log sample data and 50 concurrent queries, the target log retrieval system recorded a response time of 500 milliseconds, a throughput of 300 times / second, a CPU occupancy rate of 70%, and a memory occupancy rate of 50%. When the amount of log sample data increases to 100 million, the response time is improved to 2 seconds, and the CPU occupancy rate reaches 90%.

[0087] Optionally, the log retrieval performance indicator data can also be recorded to draw a performance chart of the target log retrieval system under different log data volumes and / or concurrent query conditions, which can mainly include but are not limited to: a curve showing the response time changing with the doubling of the log volume, a trend showing the throughput changing with the increase in the number of concurrent queries, and a chart showing the change in resource occupancy such as CPU and memory with the increase in data volume. Exemplary: A performance evaluation report can be generated for the collected log retrieval performance indicator data, which contains trend charts of response time, throughput, and resource occupancy. Similar conclusions can be drawn from the chart: as the amount of log data increases from 1 million to 1 billion, the response time increases from 500 milliseconds to 5 seconds, and the throughput decreases from 300 times / second to 50 times / second.

[0088] S260: construct a log retrieval evaluation model according to the log retrieval performance indicator data.

[0089] The log retrieval evaluation model includes at least one of a response time prediction model, a throughput prediction model and a resource occupancy prediction model.

[0090] Among them, the log retrieval evaluation model can be a model for evaluating relevant indicators of the target log retrieval system. The response time prediction model can be used to predict and evaluate the response time of the target log retrieval system. The throughput prediction model can be used to predict and evaluate the throughput of the target log retrieval system. The resource occupancy prediction model can be used to predict and evaluate the resource occupancy of the target log retrieval system. Optionally, the log retrieval evaluation model can be a mathematical evaluation model, or a machine learning model trained based on log retrieval performance indicator data, etc. The embodiment of the present invention does not limit the model type of the log retrieval evaluation model.

[0091] At present, the existing log retrieval system performance evaluation methods usually only consider one or several indicators, such as response time or throughput, and cannot provide a comprehensive evaluation of the overall performance of the log retrieval system. In an embodiment of the present invention, after obtaining the log retrieval performance indicator data of the target log retrieval system, it can be statistically analyzed to obtain the change law of each performance indicator of the target log retrieval system. Furthermore, the change law of each performance indicator of the target log retrieval system is abstracted to obtain various types of log retrieval evaluation models such as response time prediction model, throughput prediction model and resource occupancy prediction model.

[0092] S270: Predicting the log retrieval performance of the target log retrieval system under a second set retrieval condition according to the log retrieval evaluation model.

[0093] The second set search condition may include a second set log data volume and / or a second set log search concurrent load.

[0094] The second set retrieval condition may be a retrieval condition for predicting and evaluating the retrieval performance of the target log retrieval system. The second set log data volume may be the amount of retrieved log data set when predicting and evaluating the retrieval performance of the target log retrieval system. The second set log retrieval concurrent load may be the concurrent number of log retrieval queries set when predicting and evaluating the retrieval performance of the target log retrieval system.

[0095] After obtaining the log retrieval evaluation model applicable to the target log retrieval system, the target log retrieval system can be configured with second set retrieval conditions such as a second set log data volume and / or a second set log retrieval concurrent load, and then the log retrieval evaluation model can be used to predict the log retrieval performance of the target log retrieval system under the second set retrieval conditions.

[0096] Optionally, a mathematical model can be constructed based on the log retrieval performance indicator data as a log retrieval evaluation model to use the mathematical model to predict the retrieval performance of the target log retrieval system. By fitting the trend lines of indicators such as response time, throughput, and resource usage, the performance of the target log retrieval system under a larger data set can be predicted and optimization suggestions can be provided.

[0097] In a specific example, by fitting the response time and data volume of the target log retrieval system, a linear regression model can be derived, predicting that when the log volume reaches 10 billion, the system response time will exceed 10 seconds. The steps for building and using the above mathematical model are as follows:

[0098] (1) Build a response time prediction model:

[0099] In the process of gradually doubling the amount of log sample data, the target log retrieval system records the query response time under different log sample data amounts and concurrent requests. By collecting these data, a response time prediction model can be constructed to fit the trend of response time changing with the amount of logs and the number of concurrent requests. Specifically, in the data collection stage, the query response time under different log sample data amounts (such as 1 million, 5 million, 100 million and 1 billion) and different concurrent request numbers (such as 10, 100 and 500 concurrent) can be recorded. In the model fitting stage, a linear regression or nonlinear regression model can be used to fit the collected data. For example, assuming that the response time of the target log retrieval system shows an exponential growth trend with the amount of log sample data, then an exponential growth model can be constructed, such as: T(q, N) = α·N β +γ. Where T(q,N) represents the response time when the log data volume is N and the number of concurrent queries is q, and α, β, and γ are the fitted model parameters. Through this response time prediction model, the query response time of the target log retrieval system under a larger data set or a higher concurrent load can be predicted. For example, assuming that the current log volume is 10 billion and the number of concurrent queries is 1,000, the response time prediction model can predict the response time of the system under this condition.

[0100] For example, when the log sample data volume is 100 million, the response time of 50 concurrent requests is 2 seconds, and when the log sample data volume is 1 billion, the response time of 50 concurrent requests is 4 seconds. By fitting an exponential model, it can be concluded that the relationship between the response time and the log sample data volume is: T(50, N) = 0.5·N 0.5 +1. When the amount of log data increases to 10 billion, the above model can predict the response time to be: T(50, 10000000000) = 0.5 · 10000000000 0.5 +1=501 seconds.

[0101] (2) Throughput prediction model:

[0102] Throughput is another key performance indicator of the log retrieval system, which is used to measure the number of query requests that the retrieval system can handle per unit time. Throughput is usually related to the amount of log data, query complexity, and the number of concurrent requests. During the data collection phase, the throughput under different data scales and concurrent request numbers can be recorded, and the data may show a nonlinear relationship. During the model fitting phase, linear regression or nonlinear regression models can be used to fit the relationship between throughput and the amount of log data N and the number of concurrent requests q. Assuming that throughput increases with the increase in the number of concurrent requests and decreases with the increase in the amount of log sample data, the following model can be used for fitting: Among them, P(q,N) represents the system throughput when the log sample data volume is N and the number of concurrent requests is q, and δ and θ are fitting parameters. Based on the above fitting model, the throughput performance of the target log retrieval system under larger log data volume and concurrent request number can be predicted.

[0103] For example, assuming that the throughput under 1 million log sample data and 100 concurrent requests is 500 times / second, and the throughput under 100 million log sample data and 100 concurrent requests is 300 times / second, the relationship between throughput and log data volume is fitted as follows: When the amount of log data increases to 1 billion and the number of concurrent requests is 500, the throughput of the target log retrieval system can be predicted by the above model as follows:

[0104] (3) Resource occupancy prediction model

[0105] The CPU, memory, and disk I / O resource usage of the target log retrieval system will also change with the increase of log data volume and concurrent queries. By modeling these data, it is possible to predict resource usage in different scenarios to ensure that the target log retrieval system will not crash due to resource overload. In the data collection phase, the CPU, memory, and disk I / O usage under different log sample data volumes and concurrent query numbers can be recorded. For example, with 1 billion log sample data and 100 concurrent queries, the CPU usage is 80% and the memory usage is 60%. In the model fitting phase, linear regression or nonlinear regression models can be used to fit these data. Assuming that the CPU usage increases linearly with the log volume, the fitting formula is as follows: C(q, N) = η·N+ζ. Among them, C(q, N) represents the CPU usage under the log data volume N and the concurrent query number q, and η and ζ are fitting parameters. Through this model, the resource usage of the target log retrieval system under larger data sets or higher concurrent loads can be predicted to avoid system resource saturation.

[0106] For example, when the amount of log sample data is 100 million, the CPU occupancy is 75%, and the fitted relationship is: C(100, N) = 0.00075·N+50. When the amount of log data increases to 1 billion, the CPU occupancy predicted by the above model is: C(100, 1000000000) = 0.00075·1000000000+50 = 800. Based on the above prediction results, optimization suggestions can be provided to the target log retrieval system to allocate more CPU resources or optimize the architecture to avoid overload.

[0107] In order to ensure the accuracy of the log retrieval evaluation model, a feedback mechanism can be introduced to regularly update the parameters of the log retrieval evaluation model. Each time a new log retrieval test is performed on the target log retrieval system, the latest collected log retrieval performance indicator data can be input into the log retrieval evaluation model to fine-tune the fitting parameters of the log retrieval evaluation model, ensuring that the log retrieval evaluation model can timely reflect the actual performance of the target log retrieval system.

[0108] The above technical solution extracts common keywords and fields from the original log data of the target log retrieval system through word frequency statistics, stop word filtering and regular expressions, and performs statistical analysis. Further, by calling the API of the target log retrieval system, multiple query operations such as simple keyword query, time range query and complex condition combination query are performed and concurrent query scenarios are simulated. In the process of calling the target log retrieval system to perform the retrieval operation, the performance indicator data such as query response time, throughput and resource occupancy are automatically recorded, and the data of different log volumes are combined for evaluation. By increasing the amount of log data step by step, the performance of the target log retrieval system under large-scale data is tested until the performance bottleneck is reached. Further, the performance indicator data collected is fitted using a linear or nonlinear regression model to construct a prediction model for response time, throughput and resource occupancy. The entire process from log feature extraction, retrieval operation to performance indicator recording and report generation is automatically completed, which greatly reduces manual intervention. Through multi-dimensional performance analysis, namely response time, throughput and resource occupancy, the performance of the target log retrieval system under different loads can be comprehensively evaluated. By gradually doubling the amount of log data, the performance of the target log retrieval system under different data scales can be evaluated. Through linear or nonlinear regression models, the performance bottleneck of the target log retrieval system under larger data sets in the future can be predicted, and optimization suggestions can be provided. At the same time, the introduction of feedback mechanism and dynamic adjustment of model parameters can ensure the accuracy of the model, thereby improving the accuracy of log retrieval evaluation prediction.

[0109] In the technical solution disclosed herein, the collection, storage, use, processing, transmission, provision and disclosure of user personal information (such as user ID, IP address, etc.) are in compliance with the relevant laws and regulations and do not violate public order and good morals.

[0110] It should be noted that any arrangement and combination of the technical features in the above embodiments also falls within the protection scope of the present invention.

[0111] Embodiment 3

[0112] Figure 3 is a schematic diagram of a log retrieval performance evaluation device provided by Embodiment 3 of the present invention, such as Figure 3 As shown, the device includes: a log sample data generating module 310, a log retrieval operation executing module 320, a log retrieval performance indicator data acquiring module 330 and a log retrieval performance evaluating module 340, wherein:

[0113] A log sample data generating module 310 is used to generate log sample data according to the original log data of the target log retrieval system;

[0114] The log retrieval operation execution module 320 is used to execute the log retrieval operation under the first set retrieval condition on the log sample data through the target log retrieval system; wherein the first set retrieval condition includes a first set log data volume and / or a first set log retrieval concurrent load;

[0115] The log retrieval performance indicator data acquisition module 330 is used to obtain the log retrieval performance indicator data of the log retrieval system performing the log retrieval operation;

[0116] The log retrieval performance evaluation module 340 is used to evaluate the log retrieval performance of the log retrieval system according to the log retrieval performance indicator data.

[0117] The embodiment of the present invention generates log sample data based on the original log data of the target log retrieval system, and performs a log retrieval operation on the log sample data under a first set log data volume and / or a first set log retrieval concurrent load condition through the target log retrieval system, thereby obtaining log retrieval performance indicator data of the log retrieval operation performed by the target log retrieval system, and then evaluates the log retrieval performance of the log retrieval system based on the log retrieval performance indicator data, thereby solving the problems of low efficiency and unreasonableness existing in the existing log retrieval performance evaluation methods, and being able to improve the efficiency, accuracy and rationality of the log retrieval performance evaluation.

[0118] Optionally, the log sample data generation module 310 is also used to: obtain the original log data stored in the target log retrieval system; extract the log data features of the original log data; wherein the log data features include log data timestamp distribution features, keyword retrieval field distribution features and log type ratios; generate the log sample data based on the log data features of the original log data.

[0119] Optionally, if the log data characteristics include the keyword search field distribution characteristics, the log sample data generation module 310 is also used to: parse the log format of the original log data to obtain the original log parsing results; extract key fields and search fields based on the original log parsing results; count the absolute frequencies of the key fields and the search fields; calculate the relative frequencies of the key fields and the search fields based on the absolute frequencies of the key fields and the search fields.

[0120] Optionally, the log retrieval operation execution module 320 is also used to: determine the log retrieval method of the target log retrieval system; wherein the log retrieval method includes at least one of a keyword query method, a time range-based query method, a complex condition combination query method, and a concurrent query method; and execute the log retrieval operation under the first set retrieval condition on the log sample data in the target log retrieval system according to the log retrieval method.

[0121] Optionally, the log retrieval operation execution module 320 is also used to: determine the current log sample data volume; perform the log retrieval operation under the first set log retrieval concurrent load on the log sample data of the current log sample data volume through the target log retrieval system; multiply the current log sample data volume step by step using a multiplication method; return to execute the log retrieval operation under the first set log retrieval concurrent load on the log sample data of the current log sample data volume through the target log retrieval system until it is determined that the current log sample data volume reaches the performance bottleneck log sample data volume.

[0122] Optionally, the log retrieval performance evaluation module 340 is also used to: construct a log retrieval evaluation model based on the log retrieval performance indicator data; wherein the log retrieval evaluation model includes at least one of a response time prediction model, a throughput prediction model, and a resource occupancy prediction model; predict the log retrieval performance of the target log retrieval system under a second set retrieval condition based on the log retrieval evaluation model; wherein the second set retrieval condition includes a second set log data volume and / or a second set log retrieval concurrent load.

[0123] The above-mentioned log retrieval performance evaluation device can execute the log retrieval performance evaluation method provided by any embodiment of the present invention, and has the corresponding functional modules and beneficial effects of the execution method. For technical details not described in detail in this embodiment, please refer to the log retrieval performance evaluation method provided by any embodiment of the present invention.

[0124] Since the log retrieval performance evaluation device introduced above is a device that can execute the log retrieval performance evaluation method in the embodiment of the present invention, based on the log retrieval performance evaluation method introduced in the embodiment of the present invention, the technical personnel in the field can understand the specific implementation of the log retrieval performance evaluation device of the present embodiment and its various variations, so how the log retrieval performance evaluation device implements the log retrieval performance evaluation method in the embodiment of the present invention is not described in detail here. As long as the technical personnel in the field implement the device used by the log retrieval performance evaluation method in the embodiment of the present invention, it belongs to the scope of protection of this application.

[0125] Embodiment 4

[0126] Figure 4 A schematic diagram of the structure of an electronic device 10 that can be used to implement an embodiment of the present invention is shown. The electronic device is intended to represent various forms of digital computers, such as laptop computers, desktop computers, workstations, personal digital assistants, servers, blade servers, mainframe computers, and other suitable computers. The electronic device can also represent various forms of mobile devices, such as personal digital processing, cellular phones, smart phones, wearable devices (such as helmets, glasses, watches, etc.) and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the present invention described and / or required herein.

[0127] like Figure 4 As shown, the electronic device 10 includes at least one processor 11, and a memory connected to the at least one processor 11, such as a read-only memory (ROM) 12, a random access memory (RAM) 13, etc., wherein the memory stores a computer program that can be executed by at least one processor, and the processor 11 can perform various appropriate actions and processes according to the computer program stored in the read-only memory (ROM) 12 or the computer program loaded from the storage unit 18 to the random access memory (RAM) 13. In the RAM 13, various programs and data required for the operation of the electronic device 10 can also be stored. The processor 11, the ROM 12, and the RAM 13 are connected to each other through a bus 14. An input / output (I / O) interface 15 is also connected to the bus 14.

[0128] A number of components in the electronic device 10 are connected to the I / O interface 15, including: an input unit 16, such as a keyboard, a mouse, etc.; an output unit 17, such as various types of displays, speakers, etc.; a storage unit 18, such as a disk, an optical disk, etc.; and a communication unit 19, such as a network card, a modem, a wireless communication transceiver, etc. The communication unit 19 allows the electronic device 10 to exchange information / data with other devices through a computer network such as the Internet and / or various telecommunication networks.

[0129] The processor 11 may be a variety of general and / or special processing components with processing and computing capabilities. Some examples of the processor 11 include, but are not limited to, a central processing unit (CPU), a graphics processing unit (GPU), various special artificial intelligence (AI) computing chips, various processors running machine learning model algorithms, a digital signal processor (DSP), and any appropriate processor, controller, microcontroller, etc. The processor 11 executes the various methods and processes described above, such as the log retrieval performance evaluation method.

[0130] Optionally, the log retrieval performance evaluation method may include: generating log sample data based on the original log data of the target log retrieval system; performing a log retrieval operation under a first set retrieval condition on the log sample data through the target log retrieval system; wherein the first set retrieval condition includes a first set log data volume and / or a first set log retrieval concurrent load; obtaining log retrieval performance indicator data of the target log retrieval system performing the log retrieval operation; and evaluating the log retrieval performance of the log retrieval system based on the log retrieval performance indicator data.

[0131] In some embodiments, the log retrieval performance evaluation method may be implemented as a computer program, which is tangibly contained in a computer-readable storage medium, such as a storage unit 18. In some embodiments, part or all of the computer program may be loaded and / or installed on the electronic device 10 via the ROM 12 and / or the communication unit 19. When the computer program is loaded into the RAM 13 and executed by the processor 11, one or more steps of the log retrieval performance evaluation method described above may be performed. Alternatively, in other embodiments, the processor 11 may be configured to execute the log retrieval performance evaluation method in any other appropriate manner (e.g., by means of firmware).

[0132] Various implementations of the systems and techniques described above herein can be implemented in digital electronic circuit systems, integrated circuit systems, field programmable gate arrays (FPGAs), application specific integrated circuits (ASICs), application specific standard products (ASSPs), systems on chips (SOCs), load programmable logic devices (CPLDs), computer hardware, firmware, software, and / or combinations thereof. These various implementations can include: being implemented in one or more computer programs that can be executed and / or interpreted on a programmable system including at least one programmable processor, which can be a special purpose or general purpose programmable processor that can receive data and instructions from a storage system, at least one input device, and at least one output device, and transmit data and instructions to the storage system, the at least one input device, and the at least one output device.

[0133] Computer programs for implementing the methods of the present invention may be written in any combination of one or more programming languages. These computer programs may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing device, so that when the computer program is executed by the processor, the functions / operations specified in the flow chart and / or block diagram are implemented. The computer program may be executed entirely on the machine, partially on the machine, partially on the machine and partially on a remote machine as a stand-alone software package, or entirely on a remote machine or server.

[0134] In the context of the present invention, a computer-readable storage medium may be a tangible medium that may contain or store a computer program for use by or in combination with an instruction execution system, device or equipment. A computer-readable storage medium may include, but is not limited to, electronic, magnetic, optical, electromagnetic, infrared, or semiconductor systems, devices or equipment, or any suitable combination of the foregoing. Alternatively, a computer-readable storage medium may be a machine-readable signal medium. A more specific example of a machine-readable storage medium may include an electrical connection based on one or more lines, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0135] To provide interaction with a user, the systems and techniques described herein may be implemented on an electronic device having: a display device (e.g., a CRT (cathode ray tube) or LCD (liquid crystal display) monitor) for displaying information to the user; and a keyboard and a pointing device (e.g., a mouse or trackball) through which the user can provide input to the electronic device. Other types of devices may also be used to provide interaction with the user; for example, the feedback provided to the user may be any form of sensory feedback (e.g., visual feedback, auditory feedback, or tactile feedback); and input from the user may be received in any form (including acoustic input, voice input, or tactile input).

[0136] The systems and techniques described herein may be implemented in a computing system that includes backend components (e.g., as a data server), or a computing system that includes middleware components (e.g., an application server), or a computing system that includes frontend components (e.g., a user computer with a graphical user interface or a web browser through which a user can interact with implementations of the systems and techniques described herein), or a computing system that includes any combination of such backend components, middleware components, or frontend components. The components of the system may be interconnected by any form or medium of digital data communication (e.g., a communication network). Examples of communication networks include: a local area network (LAN), a wide area network (WAN), a blockchain network, and the Internet.

[0137] A computing system may include a client and a server. The client and the server are generally remote from each other and usually interact through a communication network. The client and server relationship is generated by computer programs running on the corresponding computers and having a client-server relationship with each other. The server may be a cloud server, also known as a cloud computing server or cloud host, which is a host product in the cloud computing service system to solve the defects of difficult management and weak business scalability in traditional physical hosts and VPS services.

[0138] It should be understood that the various forms of processes shown above can be used to reorder, add or delete steps. For example, the steps recorded in this disclosure can be executed in parallel, sequentially or in different orders, as long as the desired results of the technical solutions disclosed in this disclosure can be achieved, and this document does not limit this.

[0139] The above specific implementations do not constitute a limitation on the protection scope of the present disclosure. It should be understood by those skilled in the art that various modifications, combinations, sub-combinations and substitutions can be made according to design requirements and other factors. Any modification, equivalent substitution and improvement made within the spirit and principle of the present disclosure shall be included in the protection scope of the present disclosure.

Claims

1. A log retrieval performance evaluation method, characterized in that: include: Generate log sample data according to the original log data of the target log retrieval system; Performing a log retrieval operation under a first set retrieval condition on the log sample data through the target log retrieval system; wherein the first set retrieval condition includes a first set log data volume and / or a first set log retrieval concurrent load; Obtaining log retrieval performance indicator data of the target log retrieval system executing the log retrieval operation; The log retrieval performance of the log retrieval system is evaluated according to the log retrieval performance indicator data.

2. The method according to claim 1, characterized in that The generating log sample data according to the original log data of the target log retrieval system includes: Obtaining original log data stored in the target log retrieval system; Extracting log data features of the original log data; wherein the log data features include log data timestamp distribution features, keyword search field distribution features and log type proportions; The log sample data is generated according to the log data features of the original log data.

3. The method according to claim 2, characterized in that If the log data feature includes the keyword search field distribution feature, then extracting the log data feature of the original log data includes: Parsing the log format of the original log data to obtain an original log parsing result; Extract key fields and search fields according to the original log parsing results; Counting the absolute frequencies of the key fields and the search fields; The relative frequencies of the key field and the search field are calculated according to the absolute frequencies of the key field and the search field.

4. The method according to claim 1, characterized in that The performing a log retrieval operation under a first set retrieval condition on the log sample data by the target log retrieval system includes: Determine a log retrieval method of the target log retrieval system; wherein the log retrieval method includes at least one of a keyword query method, a query method based on a time range, a complex condition combination query method, and a concurrent query method; The log search operation under the first set search condition is performed on the log sample data in the target log search system according to the log search method.

5. The method according to claim 1 or 4, characterized in that: The performing a log retrieval operation under a first set retrieval condition on the log sample data by the target log retrieval system includes: Determine the current log sample data volume; Performing the log retrieval operation under the first set log retrieval concurrent load on the log sample data of the current log sample data volume through the target log retrieval system; Using a multiplication method to gradually multiply the current log sample data volume; Return to execute the log retrieval operation under the first set log retrieval concurrent load on the log sample data of the current log sample data volume through the target log retrieval system until it is determined that the current log sample data volume reaches the performance bottleneck log sample data volume.

6. The method according to claim 1, characterized in that The step of evaluating the log retrieval performance of the log retrieval system according to the log retrieval performance indicator data includes: Constructing a log retrieval evaluation model according to the log retrieval performance indicator data; wherein the log retrieval evaluation model includes at least one of a response time prediction model, a throughput prediction model, and a resource occupancy prediction model; Predicting the log retrieval performance of the target log retrieval system under a second set retrieval condition according to the log retrieval evaluation model; The second set search condition includes a second set log data volume and / or a second set log search concurrent load.

7. A log retrieval performance evaluation device, characterized in that: include: A log sample data generation module, used to generate log sample data according to the original log data of the target log retrieval system; A log retrieval operation execution module, configured to execute a log retrieval operation under a first set retrieval condition on the log sample data through the target log retrieval system; wherein the first set retrieval condition includes a first set log data volume and / or a first set log retrieval concurrent load; A log retrieval performance indicator data acquisition module, used to acquire log retrieval performance indicator data of the log retrieval system executing the log retrieval operation; The log retrieval performance evaluation module is used to evaluate the log retrieval performance of the log retrieval system according to the log retrieval performance indicator data.

8. An electronic device, characterized in that: The electronic device comprises: at least one processor; and a memory communicatively connected to the at least one processor; wherein, The memory stores a computer program executable by the at least one processor, and the computer program is executed by the at least one processor so that the at least one processor can execute the log retrieval performance evaluation method described in any one of claims 1-6.

9. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores computer instructions, and the computer instructions are used to enable a processor to implement the log retrieval performance evaluation method described in any one of claims 1 to 6 when executed.

10. A computer program product comprising a computer program / instructions, wherein: When the computer program / instructions are executed by a processor, the log retrieval performance evaluation method according to any one of claims 1 to 6 is implemented.

Images