Micro-service log information monitoring and early warning method and system

Abstract

The invention discloses a micro-service log information monitoring and early warning method and system, and relates to the technical field of log information monitoring, and the method comprises the steps: obtaining log information in a micro-service through first collection; processing the log information data, and performing data analysis; and generating early warning information based on the first early warning and performing visual display. According to the micro-service log information monitoring and early warning method provided by the invention, Elasticsearch is adopted as a core storage engine, log data is subjected to structured storage according to service types, time dimensions and the like, so that the retrieval efficiency of the system is improved, and the reliability and the operation and maintenance efficiency of the system are improved by timely processing and generating warning information through warning generation; and the influence of faults on the whole system is reduced. The method has better effects in the aspects of efficiency, reliability and real-time performance.

Description

Technical Field

[0001] The present invention relates to the technical field of log information monitoring, and in particular to a microservice log information monitoring and early warning method and system. Background Art

[0002] In recent years, the application of microservice architecture in software development and operation and maintenance has become increasingly widespread. Compared with the traditional monolithic architecture, the microservice architecture decomposes the system into multiple small independent services, each of which runs in its own independent process and collaborates with each other through lightweight communication protocols. This architecture brings flexibility and scalability to development, while supporting independent deployment and horizontal expansion of each service module. With the popularity of microservice architecture, more and more companies are applying it to the development of large-scale distributed systems. Especially in cloud-native environments, multi-container deployment of microservices has become mainstream, and various container orchestration tools such as Kubernetes have gradually matured, which can efficiently manage and schedule microservices. However, the operation of microservice architecture also brings new challenges, especially in complex systems, the management, monitoring, analysis and anomaly detection of massive logs have put forward higher requirements for system operation and maintenance.

[0003] Although the microservice architecture has significant advantages in flexibility and scalability, in actual operation and maintenance, the existing technology still has many shortcomings in log collection, monitoring and early warning. First, the existing log collection methods are relatively scattered and lack unified collection standards. Traditional log monitoring tools cannot accurately handle the inconsistency of log formats in multi-container environments, and it is difficult to timely associate and track log information. Secondly, the existing log processing system cannot effectively support real-time anomaly detection and early warning when processing massive logs. Most systems rely only on simple rule engines to generate alarms, which is difficult to adapt to complex and changeable system environments, resulting in low alarm accuracy. In addition, the existing log monitoring system lacks intelligent means and is difficult to conduct in-depth analysis of logs, especially it is impossible to predict potential faults through data modeling. In contrast, the present invention realizes efficient log collection, storage and analysis by introducing AIOps intelligent algorithms and distributed link tracking technology, and solves the problems of the inability of the existing technology to quickly locate the source of the fault, generate accurate alarms and lack of automated response through an adaptive early warning system, greatly improving the availability and operation and maintenance efficiency of the system. Summary of the invention

[0004] In view of the above-mentioned problems, the present invention is proposed.

[0005] Therefore, the technical problems solved by the present invention are: the existing microservice log monitoring method has the problem of inconsistency in log collection, the problem of inability to effectively perform real-time anomaly detection, and how to overcome the problems of low warning accuracy and lack of automated response mechanism.

[0006] To solve the above technical problems, the present invention provides the following technical solutions: a microservice log information monitoring and early warning method, comprising obtaining log information in a microservice through a first acquisition;

[0007] Process log information data and perform data analysis;

[0008] Generate warning information based on the first warning and display it visually.

[0009] As a preferred solution of the microservice log information monitoring and early warning method described in the present invention, wherein: the obtaining of log information in the microservice through the first collection includes collecting log information generated by each container in the microservice architecture.

[0010] As a preferred solution of the microservice log information monitoring and early warning method described in the present invention, wherein: the processing of log information data includes storing the collected log information in a distributed architecture.

[0011] As a preferred solution of the microservice log information monitoring and early warning method described in the present invention, wherein: the processing of log information data also includes classifying the stored log information.

[0012] As a preferred solution of the microservice log information monitoring and early warning method described in the present invention, wherein: the data analysis includes detecting abnormal situations by analyzing the log data.

[0013] As a preferred solution of the microservice log information monitoring and early warning method described in the present invention, wherein: the generating early warning information based on the first early warning includes generating early warning information according to the abnormal situation of the log.

[0014] As a preferred solution of the microservice log information monitoring and early warning method described in the present invention, the visual display includes visually displaying the log information and the early warning information, and displaying the health status, log statistics, and early warning information of each microservice through the visual monitoring platform Grafana, and generating reports according to a preset period.

[0015] Another object of the present invention is to provide a microservice log information monitoring and early warning system, which can provide flexibility for log management in a microservice environment by embedding a log agent, can adapt to different deployment methods, and solve the problem that the current microservice log monitoring contains the inability to effectively collect log information in real time.

[0016] As a preferred solution of the microservice log information monitoring and early warning system described in the present invention, it includes: a log acquisition module, a data analysis module, and an early warning module;

[0017] The log acquisition module is used to obtain log information in the microservice through the first acquisition;

[0018] The data analysis module is used to process log information data and perform data analysis;

[0019] The warning module is used to generate warning information based on the first warning and perform visual display.

[0020] A computer device includes a memory and a processor, wherein the memory stores a computer program, and the processor executes the computer program to implement a step of a microservice log information monitoring and early warning method.

[0021] A computer-readable storage medium stores a computer program, which, when executed by a processor, implements the steps of a microservice log information monitoring and early warning method.

[0022] Beneficial effects of the present invention: The microservice log information monitoring and early warning method provided by the present invention adopts Elasticsearch as the core storage engine, and the log data is structured and stored according to the service type, time dimension, etc., which improves the retrieval efficiency of the system, and timely processes and generates warning information through alarm generation, thereby improving the reliability and operation and maintenance efficiency of the system and reducing the impact of faults on the overall system. The present invention achieves better results in terms of efficiency, reliability and real-time performance. BRIEF DESCRIPTION OF THE DRAWINGS

[0023] In order to more clearly illustrate the technical solutions of the embodiments of the present invention, the accompanying drawings required for use in the description of the embodiments will be briefly introduced below. Obviously, the accompanying drawings described below are only some embodiments of the present invention. For ordinary technicians in this field, other accompanying drawings can be obtained based on these accompanying drawings without paying creative work.

[0024] Figure 1 An overall flow chart of a microservice log information monitoring and early warning method provided for the first embodiment of the present invention.

[0025] Figure 2 An overall flow chart of a microservice log information monitoring and early warning system provided for the third embodiment of the present invention. DETAILED DESCRIPTION

[0026] In order to make the above-mentioned purposes, features and advantages of the present invention more obvious and easy to understand, the specific implementation methods of the present invention are described in detail below in conjunction with the drawings of the specification. Obviously, the described embodiments are part of the embodiments of the present invention, but not all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by ordinary persons in the art without creative work should fall within the scope of protection of the present invention.

[0027] Example 1, reference Figure 1 , as an embodiment of the present invention, provides a microservice log information monitoring and early warning method, comprising:

[0028] S1: Obtain log information in the microservice through the first collection;

[0029] Furthermore, obtaining log information in the microservice through the first collection includes collecting log information generated by each container in the microservice architecture.

[0030] In a microservice architecture, log information is a direct reflection of the system's operating status, especially in a multi-container environment.

[0031] It should be noted that the first collection can be a variety of methods, such as log collection based on a log agent or log collection based on container native, or other methods that can implement microservice log collection.

[0032] As a preferred embodiment, in this embodiment, the first collection adopts a log collection method based on a log agent, and its principle steps are: embed a log agent in each microservice container, use the SSH protocol, and collect various log information in the container in real time, including system logs, application logs, and exception logs.

[0033] Log information is aggregated to the log processing system through message middleware such as Kafka to ensure high data throughput and low latency.

[0034] Each log entry carries a detailed timestamp, container ID, and service instance identifier, ensuring the relevance and traceability of the log in subsequent processing.

[0035] In another feasible embodiment, the first collection adopts a container-native log collection method, and its principle steps are: directly use the kubectl logs of the container orchestration tool Kubernetes for log collection. There is no need to embed an agent in the container, and use the native functions of the container platform to collect log data from each microservice instance.

[0036] The logging function provided by the container platform simplifies the deployment process of log collection, reduces system resource overhead, and is suitable for environments with mature container management.

[0037] S2: Process log information data and perform data analysis.

[0038] Furthermore, processing the log information data includes storing the collected log information in a distributed architecture.

[0039] It should be noted that processing log information data also includes classifying the stored log information.

[0040] It should also be noted that due to the large number of logs and their non-uniform formats, the logs need to be classified and stored to achieve efficient full-text retrieval and analysis.

[0041] Use Elasticsearch as the core storage engine to store log data in a structured manner according to service type, time dimension, etc.

[0042] Logs are classified into the following types: system operation logs, business operation logs, exception and error logs.

[0043] To support long-term storage and fast retrieval of logs, a distributed storage architecture is adopted, combined with HDFS to store historical log data.

[0044] Furthermore, performing data analysis includes detecting anomalies through analysis of log data.

[0045] It should be noted that the core of log analysis is to detect abnormal situations and warn of possible failures by analyzing massive log data.

[0046] Using AIOps intelligent algorithms, real-time analysis of logs is performed, mainly including:

[0047] Business indicator anomaly detection: such as abnormal CPU usage, memory leaks, and long response time.

[0048] Log pattern recognition: Identify abnormal patterns or repeated errors in logs through machine learning technology.

[0049] A baseline model is established based on historical log data, and abnormal alarms are automatically generated when the monitoring data deviates from the normal baseline.

[0050] Combined with the call chain log, analyze the impact scope of the exception and determine whether it is a global fault or a local fault.

[0051] S3: Generate warning information based on the first warning and display it visually.

[0052] Furthermore, generating warning information based on the first warning includes generating warning information according to the abnormal situation of the log.

[0053] The first warning can be a variety of methods, such as warning generation based on a rule engine or adaptive warning generation based on machine learning, or other methods that can generate log warnings.

[0054] As a preferred embodiment, in this embodiment, the first warning adopts a warning generation method based on a rule engine, and its principle steps are: using a predefined rule engine to generate a warning according to the abnormal pattern in the log data. The system matches the set thresholds and rules according to the abnormal conditions identified in the log, and generates different levels of warning information. For different levels of abnormalities, different warning levels (such as severe, medium, and minor) are set to generate real-time warnings.

[0055] In another feasible embodiment, the first warning adopts an adaptive warning generation method based on machine learning, and its principle steps are: using a machine learning model to perform adaptive anomaly detection and automatically adjust the warning threshold. The model analyzes historical data and current logs, learns and predicts anomalies, and automatically generates alarms.

[0056] It should be noted that the distributed link tracking technology is used to locate the specific service and container where the exception occurred based on the call chain information in the log. According to the warning level, the corresponding self-healing operations are automatically performed, such as restarting the faulty container and adjusting resource allocation. For serious faults that cannot be automatically repaired, the system generates a fault ticket and sends it to the relevant operation and maintenance team for processing.

[0057] It should be noted that the visual display includes the visual display of log information and warning information. Through the visual monitoring platform Grafana, the health status, log statistics, and warning information of each microservice are displayed and reports are generated according to the preset cycle.

[0058] Example 2, an embodiment of the present invention, provides a microservice log information monitoring and early warning method. In order to verify the beneficial effects of the present invention, scientific demonstration is carried out through economic benefit calculation and simulation experiments.

[0059] First, this experiment aims to verify the effectiveness of the microservice log information monitoring and early warning method, mainly comparing the performance of log collection, processing and early warning generation. Based on the microservice architecture, the experiment simulates different service load scenarios, collects data through log agents and Kubernetes native log collection methods, and combines intelligent analysis and early warning generation technology for fault detection and processing. The experimental platform consists of multiple virtual machines, each of which runs multiple container instances, forming a typical microservice environment.

[0060] Table 1 Experimental data comparison table

[0061]

[0062] Through the analysis of the table data, it can be clearly seen that the microservice log monitoring and early warning method proposed in the present invention performs well in multiple key performance indicators. Experimental Group 1 and Group 2 represent the log processing methods based on log agent and Kubernetes native collection, respectively. Experimental data show that the average response time of Group 1 is 115ms, and the log processing delay is only 14ms, while the response time and delay of Group 2 are 130ms and 18ms, respectively. This shows that the collection method of the log agent has more advantages in processing efficiency, especially in an environment that requires high concurrent processing. The log agent solution can provide higher throughput and ensure low-latency transmission of logs.

[0063] When combined with AIOps intelligent analysis, system performance is further improved. Group 3 uses an early warning generation solution based on log agent and rule engine, and the average response time is reduced to 110ms, and the early warning accuracy rate reaches 96%, indicating that intelligent analysis can effectively identify anomalies and generate accurate early warning information. Similarly, Group 4 uses a combination of Kubernetes native log collection and machine learning adaptive early warning, showing good overall performance, but because its log processing speed is slightly slower than the log agent solution, the overall response time is 120ms, slightly lower than Group 3.

[0064] The experimental results of Group 5 are particularly outstanding. This group combines the efficient collection method of the log agent with the adaptive warning model of machine learning. The average response time is only 108ms, the log processing delay is shortened to 10ms, and the warning accuracy rate reaches 98%. This shows that by dynamically adjusting the threshold and analyzing the data in real time, the system can further improve performance and have stronger adaptability and robustness.

[0065] In contrast, group 6 represents the shortcomings of existing technologies in log collection and warning generation. Its average response time is 145ms, the log processing delay is as high as 22ms, and the warning accuracy is only 88%. This data shows that existing technologies are difficult to effectively process massive log data in complex microservice environments, and there are obvious deficiencies in system performance and warning accuracy, especially in handling high concurrency and anomaly detection.

[0066] Example 3, reference Figure 2 , as an embodiment of the present invention, provides a microservice log information monitoring and early warning system, including a log acquisition module, a data analysis module, and an early warning module;

[0067] Among them, the log acquisition module is used to obtain log information in the microservice through the first collection; the data analysis module is used to process the log information data and perform data analysis; the early warning module is used to generate early warning information based on the first early warning and perform visual display.

[0068] If the function is implemented in the form of a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, the technical solution of the present invention, or the part that contributes to the prior art, or the part of the technical solution, can be embodied in the form of a software product. The computer software product is stored in a storage medium, including several instructions for a computer device (which can be a personal computer, server, or network device, etc.) to perform all or part of the steps of the methods of each embodiment of the present invention. The aforementioned storage medium includes: U disk, mobile hard disk, read-only memory (ROM, Read-Only Memory), random access memory (RAM, Random Access Memory), disk or optical disk, etc. Various media that can store program codes.

[0069] The logic and / or steps represented in the flowchart or otherwise described herein, for example, can be considered as an ordered list of executable instructions for implementing logical functions, and can be embodied in any computer-readable medium for use by an instruction execution system, device or apparatus (such as a computer-based system, a system including a processor, or other system that can fetch instructions from an instruction execution system, device or apparatus and execute instructions), or in conjunction with such instruction execution systems, devices or apparatuses. For the purposes of this specification, "computer-readable medium" can be any device that can contain, store, communicate, propagate or transmit a program for use by an instruction execution system, device or apparatus, or in conjunction with such instruction execution systems, devices or apparatuses.

[0070] More specific examples of computer-readable media (a non-exhaustive list) include the following: an electrical connection with one or more wires (electronic device), a portable computer disk case (magnetic device), a random access memory (RAM), a read-only memory (ROM), an erasable and programmable read-only memory (EPROM or flash memory), an optical fiber device, and a portable compact disk read-only memory (CDROM). In addition, the computer-readable medium may even be a paper or other suitable medium on which the program is printed, since the program may be obtained electronically, for example, by optically scanning the paper or other medium, followed by editing, deciphering, or processing in another suitable manner as necessary, and then stored in a computer memory.

[0071] It should be understood that the various parts of the present invention can be implemented by hardware, software, firmware or a combination thereof. In the above-mentioned embodiments, multiple steps or methods can be implemented by software or firmware stored in a memory and executed by a suitable instruction execution system. For example, if implemented by hardware, as in another embodiment, it can be implemented by any one of the following technologies known in the art or their combination: a discrete logic circuit having a logic gate circuit for implementing a logic function for a data signal, a dedicated integrated circuit having a suitable combination of logic gate circuits, a programmable gate array (PGA), a field programmable gate array (FPGA), etc. It should be noted that the above embodiments are only used to illustrate the technical solution of the present invention and are not limited. Although the present invention is described in detail with reference to the preferred embodiments, it should be understood by those skilled in the art that the technical solution of the present invention can be modified or replaced by equivalents without departing from the spirit and scope of the technical solution of the present invention, which should be included in the scope of the claims of the present invention.

[0072] It should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention rather than to limit it. Although the present invention has been described in detail with reference to the preferred embodiments, those skilled in the art should understand that the technical solutions of the present invention may be modified or replaced by equivalents without departing from the spirit and scope of the technical solutions of the present invention, which should all be included in the scope of the claims of the present invention.

Claims

1. A microservice log information monitoring and early warning method, characterized in that: include: Obtain log information in the microservice through the first collection; Process log information data and perform data analysis; Generate warning information based on the first warning and display it visually.

2. The microservice log information monitoring and early warning method according to claim 1, characterized in that: The obtaining of log information in the microservice through the first collection includes collecting log information generated by each container in the microservice architecture.

3. The microservice log information monitoring and early warning method according to claim 2, characterized in that: The processing of log information data includes storing the collected log information in a distributed architecture.

4. The microservice log information monitoring and early warning method according to claim 3 is characterized in that: The processing of log information data also includes classifying the stored log information.

5. The microservice log information monitoring and early warning method according to claim 4 is characterized in that: The data analysis includes detecting abnormal situations by analyzing log data.

6. The microservice log information monitoring and early warning method according to claim 5, characterized in that: The generating of warning information based on the first warning includes generating warning information according to an abnormal situation of the log.

7. The microservice log information monitoring and early warning method according to claim 6 is characterized in that: The visual display includes visually displaying log information and warning information, and displaying the health status, log statistics, and warning information of each microservice through the visual monitoring platform Grafana, and generating reports according to a preset period.

8. A system using the microservice log information monitoring and early warning method as described in any one of claims 1 to 7, characterized in that: Including log acquisition module, data analysis module, and early warning module; The log acquisition module is used to obtain log information in the microservice through the first acquisition; The data analysis module is used to process log information data and perform data analysis; The warning module is used to generate warning information based on the first warning and perform visual display.

9. A computer device comprising a memory and a processor, wherein the memory stores a computer program, wherein: When the processor executes the computer program, the steps of the microservice log information monitoring and early warning method described in any one of claims 1 to 7 are implemented.

10. A computer-readable storage medium having a computer program stored thereon, characterized in that: When the computer program is executed by a processor, the steps of the microservice log information monitoring and early warning method described in any one of claims 1 to 7 are implemented.

Images