Log analysis method and computing device

Abstract

The invention discloses a log analysis method and computing equipment. The method comprises the steps of obtaining log content of a target line of a test log; when determining that the log content does not have the target keyword, judging whether the line number of the test log is greater than a first threshold value or not; when the line number of the test log is greater than a first threshold value, calculating the jasccard similarity between the log content and each keyword; when the similarity is greater than or equal to a second threshold value, determining the keyword corresponding to the similarity as a target keyword; when the line number of the test log is smaller than a first threshold value, the editing distance between the log content and the target keyword is calculated; when the editing distance is smaller than or equal to a third threshold value, determining the keyword corresponding to the editing distance as a target keyword; and then, obtaining a log analysis result according to the target keyword. In this way, the log content can be analyzed more efficiently and accurately.

Description

Technical Field

[0001] The present application relates to the field of artificial intelligence technology, and in particular to a log analysis method and a computing device. Background Art

[0002] The test log is a log file that records various activities, states, and events of the test object during the test process. Analyzing the test log can quickly identify and locate the errors and exceptions that occur during the test process of the test object, so as to solve the problems of the test object in a timely manner. When analyzing the test log, it will query whether there is a log content in the test log that contains the keyword corresponding to a knowledge entry in the knowledge base. If so, the analysis content corresponding to the log content is obtained from the knowledge entry.

[0003] However, since the keywords in the knowledge entries are artificially created, there may be differences between the log content in the test log and the keywords of the knowledge entries, resulting in the inability to determine the target keywords of the target knowledge entries corresponding to the log content, and thus the inability to obtain the analysis content corresponding to the log content. Summary of the invention

[0004] The present application discloses a log analysis method and a computing device. According to the number of lines in the test log, a method for computing the test log is selected, which can improve the accuracy of obtaining keywords and increase the efficiency of the test log analysis.

[0005] In a first aspect, an embodiment of the present application provides a log analysis method, which is executed by a control end and includes:

[0006] Get the log content of the target line of the test log;

[0007] When it is determined that the log content does not contain the target keyword, determining whether the number of lines in the test log is greater than a first threshold;

[0008] When the number of lines in the test log is greater than a first threshold, the jasccard similarity between the log content and each keyword is calculated; when the similarity is greater than or equal to a second threshold, the keyword corresponding to the similarity is determined to be the target keyword;

[0009] When the number of lines in the test log is less than a threshold, calculating the edit distance between the log content and the target keyword; when the edit distance is less than or equal to a third threshold, determining that the keyword corresponding to the edit distance is the target keyword;

[0010] The log analysis result is obtained according to the target keyword.

[0011] In this method, the target keyword is determined by the jaccard similarity or edit distance between the keyword and the log content, and there is no need to conduct in-depth semantic analysis of the log content, which reduces the complexity of determining the target keyword and the matching time; in addition, since the jaccard similarity or edit distance can allow a certain degree of inaccurate matching, it can avoid the situation where the log content and the keyword cannot be successfully matched due to keyword spelling errors or when the log content and the keyword are synonymous, thereby improving the matching accuracy and further improving the analysis efficiency of the test log. At the same time, the appropriate method can be selected according to the number of lines of the test log to be processed, which can take into account both the speed and accuracy of log analysis, thereby improving the analysis efficiency of the test log.

[0012] In a possible implementation, before determining that the log content does not contain the target keyword, the method further includes:

[0013] Check whether there is historical log content identical to the log content in the cache area;

[0014] If yes, the target keyword is obtained from the cache area according to the historical log content.

[0015] In this embodiment, when the cache area pre-stores a whole line of historical log content including a character string sequence indicating that a specific error occurred in the test object during the test process, and the analysis content corresponding to the historical log content is stored, the user obtains the target keyword from the cache area by checking whether there is a character string sequence identical to the log content in the cache area, thereby avoiding the matching process of the log content with multiple keywords, and thereby improving the analysis efficiency of the test log.

[0016] In a possible implementation, the method further includes: storing the log content and the target keyword in a cache area.

[0017] When analyzing test logs, there may be multiple different users analyzing the same test log, or a single user analyzing multiple test logs. The string sequences in multiple test logs indicating specific errors that occurred in the test object during the test process are the same; therefore, the log content and target keywords can be stored in a cache area for later use.

[0018] In a possible implementation, before obtaining the log content of the target line of the test log, it includes: processing the test log according to the position of the log content belonging to the check function in the test log; the processed test log includes: the target log content belonging to the check function, and the log content of a predetermined number of lines above and below the target log content.

[0019] In this embodiment, in the test log, the character string sequence indicating that the test object has a specific error in the test process is often located in the log content of the predetermined number of lines above or below the position of the test log to which the check function belongs. Therefore, before obtaining the log content of the target line of the test log, the single-line log content to which the check function belongs, as well as the log content of the predetermined number of lines above and below the predetermined number of lines of the single-line log content can be directly obtained; thereby reducing the log content used for matching, thereby improving the analysis efficiency of the test log.

[0020] In a possible implementation, before obtaining the log content of the target line of the test log, the method further includes:

[0021] Check whether there is any abnormality in the network connectivity between the control terminal and the test terminal;

[0022] If yes, an analysis result indicating that a network error exists at the test end is obtained.

[0023] In this implementation, by checking whether there is any abnormality in the network connectivity between the control end and the test end, the cause of test failure caused by network connectivity is eliminated, the number of logs to be analyzed is reduced, and the analysis efficiency of the test log is improved.

[0024] In a possible implementation, before obtaining the log content of the target line of the test log, the method further includes:

[0025] Obtaining environmental information of the test end;

[0026] Determining whether there is an abnormality in the test environment of the test end according to the environment information;

[0027] If yes, an analysis result indicating that an abnormality exists in the test environment of the test end is obtained.

[0028] In this implementation, by pre-checking whether there is any abnormality in the test environment of the test end, the cause of the test failure caused by the test environment is eliminated, the number of logs to be analyzed is reduced, and the analysis efficiency of the test log is improved.

[0029] In a possible implementation, before obtaining the log content of the target line of the test log, the method further includes:

[0030] Query the test contents included in the test log in a backward order to obtain the test results;

[0031] When the test result indicates that the test is successful, N lines of log content are obtained from the test log.

[0032] In this implementation, by obtaining the test results of the test logs, the test logs that have been successfully tested are excluded from the test logs that need to be analyzed, thereby reducing the number of logs that need to be analyzed and improving the analysis efficiency of the test logs.

[0033] In a possible implementation, the calculating the jasccard similarity between the log content and each keyword includes:

[0034] According to the log content and the keywords, a first set consisting of character strings included in the log content and a second set consisting of character strings respectively included in the keywords are obtained;

[0035] According to the character strings respectively included in the first set and the second set, obtain the intersection and union corresponding to the first set and the second set respectively;

[0036] The jasccard similarity between the log content and the keyword is calculated according to the number of character strings respectively included in the intersection and the union.

[0037] In this implementation, since the calculation of jasccard similarity does not need to consider all possible character replacement, insertion and deletion combinations, the amount of calculation is small. Therefore, when the value of the number of test log lines is greater than the first threshold, it indicates that the test log has a lot of content. At this time, the user can reduce the calculation time of character similarity by calculating jasccard similarity, thereby improving the analysis efficiency of the test log.

[0038] In a possible implementation, calculating the edit distance between the log content and the target keyword includes:

[0039] Determine whether there is an identical character string between the log content and the keyword;

[0040] If the log content and the keyword have the same character string, based on the position of the first identical character string in the log content, obtain a first character string sequence having the same number of characters as the keyword from the log content;

[0041] The edit distance between the first character string sequence and the keyword is calculated according to the first character string sequence and the keyword.

[0042] In this embodiment, because the edit distance takes into account all possible character operations, the edit distance can more accurately describe the character similarity. When the number of lines in the test log is less than the first threshold, the content of the target line of the test log is small, so the user can determine the character similarity by calculating the edit distance, thereby improving the accuracy of matching the log content with multiple knowledge items, thereby improving the analysis accuracy of the test log.

[0043] At the same time, by selecting a first character string sequence having the same number of characters as the keyword in the log content, the calculated edit distance between the first character string sequence and the keyword is the minimum edit distance between the log content and the keyword. When the minimum edit distance is greater than the second threshold, the edit distance between the log content and the keyword must be greater than the second threshold. Therefore, in the process of calculating the edit distance, the minimum edit distance can be calculated and the second threshold is directly compared with the minimum edit distance, thereby reducing the amount of calculation of the edit distance between the log content and the keyword and improving the efficiency of log analysis.

[0044] In a second aspect, an embodiment of the present application provides a log analysis device, the device comprising:

[0045] The log acquisition module is used to obtain the log content of the target line of the test log;

[0046] A line number judgment module, used to judge whether the line number of the test log is greater than a first threshold when it is determined that the log content does not contain the target keyword;

[0047] A first calculation module is used to calculate the jasccard similarity between the log content and each keyword when the number of lines in the test log is greater than a first threshold; when the similarity is greater than or equal to a second threshold, determine that the keyword corresponding to the similarity is the target keyword;

[0048] A second calculation module is used to calculate the edit distance between the log content and the target keyword when the number of lines in the test log is less than a threshold; when the edit distance is less than or equal to a third threshold, determine that the keyword corresponding to the edit distance is the target keyword;

[0049] The result acquisition module is used to obtain the log analysis result according to the target keyword.

[0050] In the device, the target keyword is determined by the jaccard similarity or edit distance between the keyword and the log content, and there is no need to perform in-depth semantic analysis on the log content, which reduces the complexity of determining the target keyword and the matching time; in addition, since the jaccard similarity or edit distance can allow a certain degree of inaccurate matching, it can avoid the situation where the log content and the keyword cannot be successfully matched due to keyword spelling errors or when the log content and the keyword are synonymous, thereby improving the matching accuracy. At the same time, according to the number of lines of the test log that needs to be processed, a suitable method can be selected, which can take into account both the speed and accuracy of log analysis, thereby improving the analysis efficiency of the test log.

[0051] In a possible implementation, the device further includes a cache checking module for checking whether there is historical log content identical to the log content in the cache area before determining that the log content does not contain the target keyword; if so, obtaining the target keyword from the cache area based on the historical log content.

[0052] In this embodiment, when the cache area pre-stores a whole line of historical log content including a character string sequence indicating that a specific error occurred in the test object during the test process, and the analysis content corresponding to the historical log content is stored, the user obtains the target keyword from the cache area by checking whether there is a character string sequence identical to the log content in the cache area, thereby avoiding the matching process of the log content with multiple keywords, and thereby improving the analysis efficiency of the test log.

[0053] In a possible implementation, the device further includes a keyword storage module, configured to store the log content and the target keyword in a cache area.

[0054] When analyzing test logs, there may be multiple different users analyzing the same test log, or a single user analyzing multiple test logs. The string sequences in multiple test logs indicating specific errors that occurred in the test object during the test process are the same; therefore, the log content and target keywords can be stored in a cache area for later use.

[0055] In a possible implementation, the device further includes a log processing module for processing the test log according to the position of the log content belonging to the check function in the test log before obtaining the log content of the target line of the test log; the processed test log includes: the target log content belonging to the check function, and the log content of a predetermined number of lines above and below the target log content.

[0056] In this embodiment, in the test log, the character string sequence indicating that the test object has a specific error in the test process is often located in the log content of the predetermined number of lines above or below the test log position to which the check function belongs. Therefore, before obtaining the log content of the target line of the test log, the single-line log content including the check function and the log content of the predetermined number of lines above and below the single-line log content can be directly obtained; thereby reducing the log content used for matching, thereby improving the analysis efficiency of the test log.

[0057] In a possible implementation, the device further includes a network checking module for checking whether there is an abnormality in the network connectivity between the control end and the test end before obtaining the log content of the target line of the test log; if so, obtaining an analysis result indicating that there is a network error on the test end.

[0058] In this implementation, by checking whether there is any abnormality in the network connectivity between the control end and the test end, the cause of test failure caused by network connectivity is eliminated, the number of logs to be analyzed is reduced, and the analysis efficiency of the test log is improved.

[0059] In a possible implementation, the device also includes an environment checking module, which is used to obtain environmental information of the test end before obtaining the log content of the target line of the test log; determine whether there is an abnormality in the test environment of the test end based on the environmental information; if so, obtain an analysis result indicating that there is an abnormality in the test environment of the test end.

[0060] In this implementation, by pre-checking whether there is any abnormality in the test environment of the test end, the cause of the test failure caused by the test environment is eliminated, the number of logs to be analyzed is reduced, and the analysis efficiency of the test log is improved.

[0061] In a possible implementation, the device also includes a result judgment module, which is used to query the test content included in the test log in a back-to-front order before obtaining the log content of the target line of the test log to obtain a test result; when the test result indicates that the test is successful, obtain N lines of log content from the test log.

[0062] In this implementation, by obtaining the test results of the test logs, the test logs that have been successfully tested are excluded from the test logs that need to be analyzed, thereby reducing the number of logs that need to be analyzed and improving the analysis efficiency of the test logs.

[0063] In a possible implementation manner, the first calculation module is specifically configured to obtain, according to the log content and the keyword, a first set consisting of character strings included in the log content and a second set consisting of character strings respectively included in the keyword;

[0064] According to the character strings respectively included in the first set and the second set, obtain the intersection and union corresponding to the first set and the second set respectively;

[0065] The jasccard similarity between the log content and the keyword is calculated according to the number of character strings respectively included in the intersection and the union.

[0066] In this implementation, since the calculation of jasccard similarity does not need to consider all possible character replacement, insertion and deletion combinations, the amount of calculation is small. Therefore, when the value of the number of test log lines is greater than the first threshold, it indicates that the test log has a lot of content. At this time, the user can reduce the calculation time of character similarity by calculating jasccard similarity, thereby improving the analysis efficiency of the test log.

[0067] In a possible implementation manner, the second calculation module is specifically used to determine whether there is an identical character string between the log content and the keyword;

[0068] If the log content and the keyword have the same character string, based on the position of the first identical character string in the log content, obtain a first character string sequence having the same number of characters as the keyword from the log content;

[0069] The edit distance between the first character string sequence and the keyword is calculated according to the first character string sequence and the keyword.

[0070] In this embodiment, because the edit distance takes into account all possible character operations, the edit distance can more accurately describe the character similarity. When the number of lines in the test log is less than the first threshold, the content of the target line of the test log is small, so the user can determine the character similarity by calculating the edit distance, thereby improving the accuracy of matching the log content with multiple knowledge items, thereby improving the analysis accuracy of the test log.

[0071] At the same time, by selecting a first character string sequence having the same number of characters as the keyword in the log content, the calculated edit distance between the first character string sequence and the keyword is the minimum edit distance between the log content and the keyword. When the minimum edit distance is greater than the second threshold, the edit distance between the log content and the keyword must be greater than the second threshold. Therefore, in the process of calculating the edit distance, the minimum edit distance can be calculated and the second threshold is directly compared with the minimum edit distance, thereby reducing the amount of calculation of the edit distance between the log content and the keyword and improving the efficiency of log analysis.

[0072] In a third aspect, an embodiment of the present application provides a computing device, comprising a memory and a processor, wherein the memory stores a computer program that can be executed on the processor, and wherein the processor implements the method described in the first aspect or any possible implementation manner of the first aspect when executing the computer program.

[0073] In a fourth aspect, an embodiment of the present application provides a computer storage medium, in which instructions are stored. When the instructions are executed on a computer, the computer executes the method described in the first aspect or any possible implementation of the first aspect.

[0074] In a fifth aspect, an embodiment of the present application provides a computer program product comprising instructions, which, when executed on a computer, enables the computer to execute the method described in the first aspect or any possible implementation of the first aspect.

[0075] It can be understood that the beneficial effects of the third to fifth aspects mentioned above can be found in the relevant description of the first aspect mentioned above, and will not be repeated here. BRIEF DESCRIPTION OF THE DRAWINGS

[0076] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the drawings required for use in the embodiments will be briefly introduced below. It should be understood that the following drawings only show certain embodiments of the present application and therefore should not be regarded as limiting the scope. For ordinary technicians in this field, other related drawings can be obtained based on these drawings without paying creative work.

[0077] Figure 1 A schematic diagram of a schematic diagram of an application scenario provided by an embodiment of the present application;

[0078] Figure 2 A schematic diagram of the data structure of a test log provided in an embodiment of the present application;

[0079] Figure 3 One of the flow charts of a log analysis method provided in an embodiment of the present application;

[0080] Figure 4 A second flow chart of a log analysis method provided in an embodiment of the present application;

[0081] Figure 5 A schematic diagram of a process for calculating jasccard similarity provided as an example in an embodiment of the present application;

[0082] Figure 6 A schematic diagram of a flow chart for calculating edit distance provided as an example in an embodiment of the present application;

[0083] Figure 7 A schematic diagram of a process for obtaining a first character string sequence provided as an example in an embodiment of the present application;

[0084] Figure 8 A schematic diagram of the structure of a log analysis device provided in an embodiment of the present application;

[0085] Fig. 9 A schematic diagram of the structure of an electronic device provided in an embodiment of the present application. DETAILED DESCRIPTION

[0086] The technical solutions in the embodiments of the present application will be described below in conjunction with the accompanying drawings. Obviously, the described embodiments are only part of the embodiments of the present application, rather than all of the embodiments.

[0087] In order to better understand the embodiments of the present application, some key terms are explained below.

[0088] Test log: A test log is a log file that records the test object during the test process. Each test log reflects in detail the execution and results of a test case during the test process, including test object performance, error reports, security events, etc. These test logs can help developers monitor the operation of the test object, quickly locate and solve problems, evaluate the stability and performance of the test object, and ensure the security and reliability of the test object. The test log can include multiple lines of log content arranged in sequence, and a line of log content can usually include a string sequence composed of multiple strings. The aforementioned test objects may include operating systems or various other possible computer programs.

[0089] String: A string is a data structure consisting of a sequence of characters. It can contain letters, numbers, symbols, or other characters. It is used to store text information, perform text processing, and implement various programming tasks. Strings are the basic elements for building log content. A single string includes one or more characters.

[0090] Knowledge base: A knowledge base is a systematic database or information collection that stores common problems, solutions, expert experience, and other knowledge related to the test object. It is used to assist the automated testing framework in analyzing the massive test logs generated, and to quickly identify and locate problems that arise during the test process through pattern recognition and information matching.

[0091] Knowledge entry: Knowledge entry is the basic unit of the knowledge base. Its essence is an organized and classified piece of information. Each knowledge entry describes the relevant content of a problem, including but not limited to the concept definition, operation steps, problem solution, rule guidance, case study, etc. related to the test object. In addition, knowledge entries are usually manually designed with keywords to facilitate retrieval of knowledge entries in the knowledge base, providing users with fast and accurate information support to help solve specific problems or optimize the decision-making process.

[0092] Next, the application scenarios of this application are briefly introduced.

[0093] Before the release of the test object, such as the operating system, the image of the test object needs to be tested on a large scale on the test end; however, due to the complexity of the test environment of the test object, various abnormal conditions inconsistent with the expected results will appear during the test process, and these abnormal conditions will be recorded in the test log of the test object. Figure 1 As shown, the user can send a request for analyzing the test log to the computing device of the control end through the user device. After receiving the analysis request, the computing device obtains and analyzes the test log from the test device of the test end, and returns the analysis result to the user device, so that the user can quickly identify and locate the errors and anomalies of the test object during the test, and solve the problems of the test object in time. Among them, the knowledge base or cache area is usually located on the computing device of the control end; according to actual needs, the knowledge base can also be deployed on other related computing devices such as a distributed cluster composed of multiple computing devices or nodes.

[0094] During the process of testing the test object, the computing device triggers the test case through the automated test framework or manual instructions to perform operations on the test device. After receiving the instructions from the computing device, the test device performs specific test operations on the test object by checking the function, and records detailed test activity information to the test log, including test object performance indicators, error information, test results, etc.; the test log can then be monitored in real time or collected and transmitted back to the computing device after the test is completed, for analysis of test results, and provided as feedback to the development team to optimize the test object.

[0095] Among them, a test log reflects in detail the execution status and results of a test case during the test process. Figure 2 As shown, for a single test log corresponding to a single test case, it is usually divided into three stages: test preparation, test execution, and test post-processing; the stage where the test object generates an error is usually in the test execution stage, and the test result is usually in the test post-processing stage.

[0096] The log content used to represent the test execution phase includes a check function represented by a sequence of one or more strings. A check function is a function used to verify whether the test object can achieve a certain condition or assertion during the test; the check function is usually embedded in the test case to ensure that the state or behavior of the test object meets expectations so that problems can be discovered and solved in time during the operation. Among them, a test case contains one or more check functions, and correspondingly, a test log may contain one or more check functions.

[0097] When analyzing the test log, the control end usually queries the test log based on the pre-established knowledge base to see if there is content in the test log that is identical to the keywords of the knowledge items contained in the knowledge base; then, based on the query results, the analysis content of the test log is obtained from the knowledge base. However, since the keywords in the knowledge items are artificially established, there may be differences between the content of the test log and the keywords of the knowledge items, resulting in poor matching accuracy between the test log and the target knowledge items, causing the analysis content obtained from the knowledge base to be inconsistent with the anomalies in the test log.

[0098] The present application provides a log analysis method, which is executed by a control end, and includes: obtaining the log content of a target line of a test log; when it is determined that the log content does not contain a target keyword, judging whether the number of lines of the test log is greater than a first threshold; when the number of lines of the test log is greater than the first threshold, calculating the jasccard similarity between the log content and each keyword; when the similarity is greater than or equal to a second threshold, determining that the keyword corresponding to the similarity is the target keyword; when the number of lines of the test log is less than the threshold, calculating the edit distance between the log content and the target keyword; when the edit distance is less than or equal to a third threshold, determining that the keyword corresponding to the edit distance is the target keyword; and obtaining a log analysis result according to the target keyword.

[0099] In this way, the user can determine the target keyword by the jaccard similarity or edit distance between the keyword and the log content, so that the user does not need to perform in-depth semantic analysis on the log content, reducing the complexity and matching time of determining the target keyword; in addition, since the jaccard similarity or edit distance can allow a certain degree of inaccurate matching, it can avoid the situation where the log content and the keyword cannot be successfully matched due to spelling errors of the keyword or when the log content and the keyword are synonymous with each other, thereby improving the accuracy of matching and further improving the analysis efficiency of the test log. At the same time, according to the number of lines of the test log that needs to be processed, a suitable method is selected so that the computing device can take into account both the speed and accuracy of the log analysis, thereby improving the analysis efficiency of the test log.

[0100] The technical solutions in the embodiments of the present application are clearly and completely described below with specific embodiments, and the described embodiments are only part of the embodiments of the present application, rather than all the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0101] Figure 3 One of the flow charts of a log analysis method provided in an embodiment of the present application.

[0102] See also Figure 3The method may include but is not limited to part or all of the following steps S37 to S39. The method is executed by the control end.

[0103] Step S31, obtaining the log content of the target line of the test log.

[0104] The test log generated by the test end when the test end tests the test object is obtained from the test end. Referring to the foregoing, the test object may include an operating system or other possible computer programs.

[0105] Step S33: when it is determined that the log content does not contain the target keyword, it is determined whether the number of lines in the test log is greater than a first threshold.

[0106] When the target keyword does not exist in the log content of the target row, the jasccard similarity or edit distance between the log content of the target row and the keyword can be calculated, and the keyword that meets the corresponding conditions of the jasccard similarity or edit distance is determined as the target keyword.

[0107] Although both jasccard similarity and edit distance can describe the character similarity between two string sequences, the amount of calculation and the accuracy of the calculated character similarity are different. Therefore, in the process of analyzing the test log, the appropriate method for determining the target keyword can be selected according to the number of lines in the test log.

[0108] Step S35, when the number of lines in the test log is greater than the first threshold, the jasccard similarity between the log content and each keyword is calculated; when the similarity is greater than or equal to the second threshold, the keyword corresponding to the similarity is determined to be the target keyword.

[0109] Jasccard Similarity is a method to measure the similarity of characters between two sets. For two different string sequences, they need to be converted into sets first, and then the Jasccard Similarity formula is applied.

[0110] For jasccard similarity, the calculation of jasccard similarity does not need to consider all possible character replacement, insertion and deletion combinations, so the amount of calculation required to calculate jasccard similarity is small; but since jasccard similarity mainly focuses on the matching and order between characters, for complex string sequence transformations (such as long-distance character replacement), the accuracy of the presented character similarity is not high. Therefore, when the number of test log lines is small, users can improve the calculation speed by calculating the jasccard similarity between the log content and the keyword, thereby improving the analysis efficiency of the test log.

[0111] Step S37, when the number of lines in the test log is less than the first threshold, the edit distance between the log content and the target keyword is calculated; when the edit distance is less than or equal to the third threshold, the keyword corresponding to the edit distance is determined to be the target keyword.

[0112] The edit distance between two string sequences refers to the minimum number of editing operations required to completely convert one string sequence into another string sequence; editing operations include inserting, deleting, and replacing characters. Therefore, the edit distance can also be used to measure the character similarity between two string sequences. The smaller the edit distance, the higher the character similarity between the two strings. In other words, the larger the reciprocal of the edit distance, the higher the character similarity between the two string sequences.

[0113] As for the edit distance, since it takes into account all possible character operations, it can more accurately describe the similarity of characters; however, because the edit distance needs to consider all possible operations of all characters, calculating the edit distance consumes a high amount of computing time and resources. When the number of test log lines is small, the content of the log is small, so the user can improve the accuracy of the determined target keyword by calculating the edit distance between the log content and the keyword, thereby improving the accuracy of the test log analysis.

[0114] It can be understood that when the number of lines in the test log is equal to the first threshold, step S35 or step S37 can be selected to be executed.

[0115] Step S39, obtaining log analysis results according to the target keyword.

[0116] According to the target keyword, the target knowledge item is searched from the knowledge base, and the analysis content under the target knowledge item is obtained from the target knowledge item. The analysis content under the target knowledge item is the analysis content corresponding to the log content. Since the string sequence used to determine the target keyword in the log content of the target line is a string sequence indicating that the test object has a specific error in the test process; therefore, the log content of the target line of the target keyword can be determined, including a string sequence indicating that the test object has a specific error in the test process; thus, the analysis content corresponding to the log content of the target line is also the analysis content corresponding to the test log.

[0117] Subsequently, the control end may send the test log containing the log content of the target row and the analysis content corresponding to the log content, or the matching result in which the test logs are not successfully matched, to the client.

[0118] Figure 4 The second flowchart of a log analysis method provided in an embodiment of the present application.

[0119] See also Figure 4 The method may include but is not limited to part or all of the following steps S401 to S421. The method is executed by the control end. Figure 4 The method may include but is not limited to the following steps S401 to S421. The method is executed by the control end.

[0120] Optionally, in step S401, it is checked whether there is any abnormality in the network connectivity between the control end and the test end.

[0121] During the test process of the test end testing the test object, the network connectivity between the control end and the test end ensures the smooth transmission of test instructions, the effective collection of log data and the real-time monitoring of the test status. Therefore, when analyzing the test log, it is necessary to first check whether there is any abnormality in the network connectivity between the control end and the test end that generates the test log.

[0122] For example, when checking network connectivity, the control end can enter the ping command followed by the IP address of the test end. Executing this command will cause the control end to send an ICMP (Internet Control Message Protocol) echo request message to the test end; at the same time, after receiving the echo request message, the test end will send an ICMP echo reply message to the control end. If the control end receives a reply message from the test end, it is determined that the test end is online and connected to the control end network; if the control end does not receive a reply message or receives an error message, it is determined that there is an abnormality in the network connectivity between the test end and the control end.

[0123] If there is an abnormality in the network connectivity between the control end and the test end, an analysis result indicating that there is a network error on the test end can be obtained and returned to the client so that the client presents the analysis result to the user.

[0124] If there is no abnormality in the network connectivity between the control end and the test end, perform the subsequent log analysis steps.

[0125] Optionally, in step S403, environmental information of the test end is obtained, and it is determined whether there is an abnormality in the test environment of the test end according to the environmental information.

[0126] Environmental information may include, but is not limited to, hardware configuration information and / or software configuration information of the test end. The hardware configuration information may include, but is not limited to, memory configuration information, motherboard configuration information, etc.; the software configuration information may include, but is not limited to, driver configuration information, service status required to run the test object, etc.

[0127] For example, the control end can connect to the test end through the ssh command. After the connection is successful, the control end can obtain the environment information of the test end from the test segment through various possible commands. Then, based on the obtained environment information, it can be checked whether there is hardware or software configuration error, insufficient memory or computing resources, service failure or other abnormal conditions on the test end; if there is an abnormal condition, it means that there is an abnormality in the test environment of the test end.

[0128] If there is an abnormality in the test environment of the test end, an analysis result indicating that there is an abnormality in the test environment of the test end may be obtained, and the analysis result may be returned to the client so that the client presents the analysis result to the user.

[0129] If there is no abnormality in the test environment of the test end, perform the subsequent log analysis steps.

[0130] Optionally, in step S405, a test log generated by the test end when testing the test object is obtained, and a test result is obtained from the test log, wherein the test result is used to indicate whether the test on the test object is successful or failed.

[0131] As mentioned above, the test object may include an operating system, or may be any other possible computer program.

[0132] If the test result indicates that the test object is tested successfully, there is no need to continue analyzing the test log. An analysis result indicating that the test log does not need to be analyzed can be obtained and sent to the client so that the client presents the analysis result to the user.

[0133] In some embodiments, since the test result is usually located in a line of log content that is relatively close to the back of the test log, the control end can read the log content in the test log line by line from the back to the front, so that the test result can be obtained more quickly.

[0134] In the process of testing the test object, the stage where the test object generates an error is usually in the stage of test execution; correspondingly, the character string sequence indicating that the test object has a specific error in the test process is in the stage of test execution; and when analyzing the test log, the character string sequence indicating that the test object has a specific error in the test process is matched to see if it is similar to the keyword of the knowledge entry, so that the test log analysis content can be obtained from the matched knowledge entry. In other words, the log content of the target line used to determine the target keyword only needs to include the character string sequence indicating that the test object has a specific error in the test process.

[0135] Optionally, in order to narrow the analysis scope of the test log and improve the analysis efficiency, step S407 can be executed to process the test log according to the position of the log content belonging to the check function in the test log; the processed test log includes: the target log content belonging to the check function, and the log content of a predetermined number of lines above and below the target log content.

[0136] In the test log, the check function is represented in the form of a string sequence consisting of a single or multiple strings. In the log content used to represent the test execution phase, the string sequence indicating that a specific error occurred in the test object during the test process is often located in the log content that is a predetermined number of lines above or a predetermined number of lines below the test log position to which the check function belongs. Therefore, when analyzing the test log, it is possible to directly obtain the single-line log content including the check function, as well as the log content that is a predetermined number of lines above and a predetermined number of lines below the single-line log content, thereby filtering out the log content used to represent the test preparation phase, the log content used to represent the test post-processing phase, and part of the content of the test execution phase, thereby reducing the analysis content. For example, Figure 2 As shown, with the test log position to which the check function belongs as the center, the processed test log includes 5 lines of log content, including 1 line belonging to the center, 2 lines above the center, and 2 lines below the center.

[0137] Optionally, in step S409, for the log content of the target row, it is checked whether there is historical log content identical to the log content in the cache area.

[0138] For multiple different users, the same test log may be analyzed; or when a single user analyzes multiple test logs, the character string sequence indicating that the test object has a specific error in the test process is the same in multiple test logs. Therefore, the cache area may pre-store the entire line of historical log content, including the character string sequence indicating that the test object has a specific error in the test process, and the target keyword corresponding to the historical log content.

[0139] If the cache area contains historical log content identical to the target row log content, then the target keyword corresponding to the historical log content identical to the target row log content is obtained from the cache area; wherein, because the historical log content is identical to the target row log content, correspondingly, the target keyword corresponding to the target row log content is the same as the target keyword corresponding to the historical log content.

[0140] If the cache area does not contain the same historical log content as the log content of the target row, the subsequent log analysis steps are performed.

[0141] Optionally, in step S411, it is determined whether a target keyword exists in the log content of the target row; wherein the target keyword belongs to a plurality of keywords corresponding to a plurality of knowledge items.

[0142] Exemplarily, when any of the multiple keywords corresponding to the multiple knowledge items exists in the log content of the target row, the keyword included in the log content of the target row is determined as the target keyword. When the log content of the target row does not include the multiple keywords corresponding to the multiple knowledge items, it is determined that the log of the target row does not have the target keyword.

[0143] If the target keyword exists in the log content of the target row, the knowledge entry corresponding to the target keyword is determined as the target knowledge entry.

[0144] If the target keyword does not exist in the log content of the target row, the subsequent log analysis steps are performed.

[0145] In step S413, it is determined whether the number of lines in the test log is greater than a first threshold. For details, please refer to step S33.

[0146] Optionally, in step S415, when the number of test log lines is greater than a first threshold, the jasccard similarity between the log content and each keyword is calculated; when the similarity is greater than or equal to a second threshold, the keyword corresponding to the similarity is determined to be the target keyword. For details, refer to step S35.

[0147] Optionally, in step S417, when the number of test log lines is less than a threshold, the edit distance between the log content and the target keyword is calculated; when the edit distance is less than or equal to a third threshold, the keyword corresponding to the edit distance is determined to be the target keyword. For details, refer to step S37.

[0148] Finally, in step S419, the log analysis result is obtained according to the target keyword. For details, please refer to step S39.

[0149] Optionally, in step S421, after the target keyword is determined, the log content of the target row and the target keyword are stored in the cache area.

[0150] Similar to the above content, there may be multiple different users analyzing the same test log, or a single user analyzing multiple test logs, and the string sequence indicating that the test object encountered specific errors in the test process in multiple test logs is the same; therefore, the log content of the target line and the target keyword can be stored in the cache area for use.

[0151] For example, a dictionary (or hash table) can be created to store key-value pairs, where the key is the log content of the target row and the value is the target keyword, and then the dictionary (or hash table) is stored in the cache area for easy search.

[0152] The following is an example of the process of calculating the jasccard similarity and edit distance between a single line of log content and a single keyword.

[0153] like Figure 5 As shown, in some possible implementations, the jasccard similarity between the log content and the keyword can be calculated through part or all of the following steps S51-S55.

[0154] Step S51, obtaining, according to the log content and the keyword, a first set consisting of character strings included in the log content and a second set consisting of character strings included in the keyword.

[0155] Exemplarily, for log content, the log content can be decomposed into character strings, characters or other basic units representing words. For example, for log content composed of character strings representing words, it can be decomposed into multiple character strings representing words to obtain a first set of character strings including multiple character strings representing words.

[0156] For a single set, the elements in the set are unique. For example, the elements in the first set are strings representing words, and each string in the set is unique.

[0157] Step S53: Obtain the intersection and union of the first set and the second set according to the elements respectively included in the first set and the second set.

[0158] For example, based on the common elements in the first set and the second set, the intersection of the first set and the second set is obtained; and based on all the elements in the first set and the second set, the union of the first set and the second set is obtained.

[0159] Step S55, calculating the jasccard similarity between the keyword and the log content according to the number of elements included in the intersection and the union respectively.

[0160] For example, the jasccard similarity can be calculated by the following formula 1:

[0161] Jasccard similarity = number of elements in the intersection / number of elements in the union (1)

[0162] For example Figure 6 As shown, the calculation of the edit distance between the log content and the keyword can be completed by part or all of the following steps S61-S65.

[0163] In step S61, it is checked whether the log content and the keyword have the same character string.

[0164] If the same string exists between the log content and the keyword, the subsequent edit distance calculation step is performed.

[0165] If there is no identical character string between the log content and the keyword, an analysis result indicating that the log content and the keyword are not successfully matched is obtained.

[0166] Step S63 : obtaining a first string sequence having the same number of characters as the keyword from the log content based on the position of the first identical string in the log content.

[0167] Since the number of characters included in the keyword is usually smaller than the number of characters included in the log content, the first string sequence can be obtained from the log content. The edit distance between the first string sequence and the keyword is the minimum edit distance between the log content and the keyword.

[0168] For example Figure 7 As shown, in step S63, the first character string sequence can be obtained by completing part or all of the following steps S631-S635.

[0169] There may be multiple identical strings between the log content and the keyword, and the order of the multiple identical strings in the log and the keyword may be inconsistent, resulting in the first identical string in the log content being different from the first identical string in the keyword. Therefore, in step S631, the first string is obtained from the keyword, where the first string is the first identical string in the log content, corresponding to the string in the keyword.

[0170] It should be noted that if there are multiple character strings in the keyword that correspond to the first identical character string in the log content, the first corresponding character string in the keyword is used as the first character string.

[0171] Step S633: Obtain the number of characters on the first side and the second side of the first character string in the keyword according to the position of the first character string in the keyword.

[0172] Step S635 , obtaining a first string sequence from the log content according to the number of characters on the first side and the second side of the first string and the position of the first identical string in the log content.

[0173] In the first string sequence, the number of characters on the first side and the second side of the first identical string of the log content is equal to the number of characters on the first side and the second side of the first string in the keyword.

[0174] It should be noted that when the number of characters A on the first side of the first string in the keyword is greater than the number of characters B on the first side of the first identical string in the log content, AB empty characters are padded on the first side of the first identical string in the log content; and the first string sequence is obtained from the padded log content.

[0175] Step S65, calculating the edit distance between the first character string sequence and the keyword according to the first character string sequence and the keyword, thereby obtaining the edit distance between the log content and the keyword, and then obtaining the character similarity between the log content and the keyword according to the edit distance.

[0176] Referring to the foregoing, by selecting a first character string sequence having the same number of characters as the keyword in the log content, the calculated edit distance between the first character string sequence and the keyword is the minimum edit distance between the log content and the keyword. When the minimum edit distance does not meet the second threshold, the edit distance between the log content and the keyword must not meet the second threshold. Therefore, in the process of calculating the edit distance, the minimum edit distance can be calculated and the second threshold is directly compared with the minimum edit distance, thereby reducing the amount of calculation of the edit distance between the log content and the keyword and improving the efficiency of log analysis.

[0177] In some more specific implementations, based on the first character string sequence and the keyword, the edit distance between the first character string sequence and the keyword may be calculated through a dynamic programming graph.

[0178] The above mainly introduces the solution provided by the embodiment of the present application from the perspective of the method. In order to achieve the above functions, the log analysis device includes a hardware structure and / or software module corresponding to the execution of each function. Those skilled in the art should easily realize that, in combination with the units and algorithm steps of each example described in the embodiments disclosed herein, the present application can be implemented in the form of hardware or a combination of hardware and computer software. Whether a function is executed in the form of hardware or computer software driving hardware depends on the specific application and design constraints of the technical solution. Professional and technical personnel can use different methods to implement the described functions for each specific application, but such implementation should not be considered to be beyond the scope of this application.

[0179] The embodiment of the present application can exemplarily divide the functional modules of the log analysis device according to the above method. For example, the log analysis device can include various functional modules corresponding to the various functional divisions, or two or more functions can be integrated into one processing module. The above integrated modules can be implemented in the form of hardware or in the form of software functional modules. It should be noted that the division of modules in the embodiment of the present application is schematic and is only a logical functional division. There may be other division methods in actual implementation.

[0180] Figure 8 A structural diagram of a log analysis device 80 provided in an embodiment of the present application. Figure 8 The log analysis device 80 includes a log acquisition module 81, a line number determination module 82, a first calculation module 83, a second calculation module 84, and a result acquisition module 85.

[0181] The log acquisition module 81 is used to acquire the log content of the target line of the test log;

[0182] A line number determination module 82, configured to determine whether the line number of the test log is greater than a first threshold when it is determined that the log content does not contain a target keyword;

[0183] The first calculation module 83 is used to calculate the jasccard similarity between the log content and each keyword when the number of lines in the test log is greater than a first threshold; when the similarity is greater than or equal to a second threshold, determine that the keyword corresponding to the similarity is the target keyword;

[0184] A second calculation module 84 is used to calculate the edit distance between the log content and the target keyword when the number of lines in the test log is less than a threshold; when the edit distance is less than or equal to a third threshold, determine that the keyword corresponding to the edit distance is the target keyword;

[0185] The result acquisition module 85 is used to obtain the log analysis result according to the target keyword.

[0186] Fig. 9 This is a hardware structure diagram of an electronic device provided in an embodiment of the present application. Fig. 9 , the electronic device 90 may include a processor 91 and a memory 92. The processor 91 and the memory 92 may communicate with each other; illustratively, the processor 91 and the memory 92 communicate with each other via a communication bus 93.

[0187] The memory 92 is used to store computer executable instructions.

[0188] The processor 91 is used to execute the computer execution instructions stored in the memory 92, so that the processor 91 executes the technical solution shown in the above method embodiment.

[0189] Optionally, the electronic device 90 may further include a communication interface, which may include a transmitter and / or a receiver.

[0190] Optionally, the processor may be a central processing unit (CPU), or other general-purpose processors, digital signal processors (DSP), application-specific integrated circuits (ASIC), etc. A general-purpose processor may be a microprocessor or the processor may be any conventional processor, etc. The steps of the method disclosed in the embodiments of the present application may be directly implemented as being executed by a hardware processor, or may be implemented by a combination of hardware and software modules in the processor.

[0191] The electronic device provided in the embodiments of the present application can be used to execute the technical solutions shown in any of the above method embodiments. Its implementation principles and technical effects are similar and will not be elaborated here.

[0192] The embodiment of the present application also provides a computer-readable storage medium, in which computer instructions are stored. When the computer instructions are executed by a computer, the log analysis method performed by any of the above method embodiments is implemented. The implementation principle and technical effect are similar and will not be repeated here.

[0193] The embodiment of the present application also provides a computer program product, including a computer program. When the computer program is executed by a computer, it implements the log analysis method performed by any of the above method embodiments. The implementation principle and technical effect are similar and will not be repeated here.

[0194] All or part of the steps of the above-mentioned method embodiments can be completed by hardware related to program instructions. The aforementioned program can be stored in a readable memory. When the program is executed, the steps of the above-mentioned method embodiments are executed; and the aforementioned memory (storage medium) includes: read-only memory (ROM), RAM, flash memory, hard disk, solid state drive, magnetic tape, floppy disk, optical disc and any combination thereof.

[0195] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, apparatuses, computing devices, computer-readable storage media, and computer program products according to the embodiments of the present application. It should be understood that each process and / or block in the flowchart and / or block diagram, as well as the combination of the processes and / or blocks in the flowchart and / or block diagram, can be implemented by computer program instructions. These computer program instructions can be provided to a processing unit of a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable terminal device to generate a machine, so that the instructions executed by the processing unit of the computer or other programmable terminal device generate instructions for implementing the processes in the flowchart and / or block diagram. Figure 1 A process or multiple processes and / or boxes Figure 1 A device that provides the functions specified in a block or multiple blocks.

[0196] These computer program instructions can also be loaded onto a computer or other programmable terminal device so that a series of operating steps are executed on the computer or other programmable device to produce a computer-implemented process, thereby providing instructions for executing on the computer or other programmable device to implement the process. Figure 1 A process or multiple processes and / or boxes Figure 1 The steps for the functions specified in one or more boxes.

[0197] Obviously, those skilled in the art can make various changes and modifications to the embodiments of the present application without departing from the spirit and scope of the embodiments of the present application. Thus, if these modifications and variations of the embodiments of the present application fall within the scope of the claims of the present application and their equivalents, the embodiments of the present application are also intended to include these modifications and variations.

[0198] In the above embodiments, the description of each embodiment has its own emphasis. For parts that are not described or recorded in detail in a certain embodiment, reference can be made to the relevant descriptions of other embodiments.

[0199] It should be understood that the size of the serial numbers of the steps in the above embodiments does not mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0200] The basic principles of the present application are described above in conjunction with specific embodiments. However, it should be noted that the advantages, strengths, effects, etc. mentioned in the present application are only examples and not limitations, and it cannot be considered that these advantages, strengths, effects, etc. are required by each embodiment of the present disclosure. In addition, the specific details disclosed above are only for the purpose of illustration and ease of understanding, rather than limitation, and the above details do not limit the present disclosure to the necessity of adopting the above specific details to be implemented.

[0201] The block diagrams of the devices, apparatuses, equipment, and systems involved in this disclosure are only illustrative examples and are not intended to require or imply that they must be connected, arranged, and configured in the manner shown in the block diagrams. As will be appreciated by those skilled in the art, these devices, apparatuses, equipment, and systems can be connected, arranged, and configured in any manner. Words such as "including," "comprising," "having," and the like are open words, meaning "including but not limited to," and can be used interchangeably therewith. The words "or" and "and" used herein refer to the words "and / or," and can be used interchangeably therewith, unless the context clearly indicates otherwise.

[0202] It should also be noted that in the apparatus, device and method of the present disclosure, each component or each step can be decomposed and / or recombined. Such decomposition and / or recombination should be regarded as equivalent solutions of the present disclosure.

[0203] The above description has been given for the purpose of illustration and description. In addition, this description is not intended to limit the embodiments of the present disclosure to the forms disclosed herein. Although multiple example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

[0204] It should be understood that the various numerical numbers involved in the embodiments of the present application are only used for the convenience of description and are not used to limit the scope of the embodiments of the present application.

Claims

1. A log analysis method, the method being executed by a control terminal, characterized in that: The method comprises: Get the log content of the target line of the test log; When it is determined that the log content does not contain the target keyword, determining whether the number of lines in the test log is greater than a first threshold; When the number of lines in the test log is greater than a first threshold, the jasccard similarity between the log content and each keyword is calculated; when the similarity is greater than or equal to a second threshold, the keyword corresponding to the similarity is determined to be the target keyword; When the number of lines in the test log is less than a first threshold, calculating the edit distance between the log content and the target keyword; when the edit distance is less than or equal to a third threshold, determining that the keyword corresponding to the edit distance is the target keyword; The log analysis result is obtained according to the target keyword.

2. The method according to claim 1, characterized in that Before determining that the log content does not contain the target keyword, the method further includes: Check whether there is historical log content identical to the log content in the cache area; If yes, the target keyword is obtained from the cache area according to the historical log content.

3. The method according to claim 1, characterized in that The method further includes: storing the log content and the target keyword in a cache area.

4. The method according to claim 1, characterized in that: Before obtaining the log content of the target line of the test log, the following steps are included: The test log is processed according to the position of the log content belonging to the check function in the test log; the processed test log includes: the target log content belonging to the check function, and the log content of the target log content within a predetermined number of lines above and below.

5. The method according to claim 1, characterized in that Before obtaining the log content of the target line of the test log, the method further includes: Check whether there is any abnormality in the network connectivity between the control terminal and the test terminal; If yes, an analysis result indicating that a network error exists at the test end is obtained.

6. The method according to claim 1, characterized in that Before obtaining the log content of the target line of the test log, the method further includes: Obtaining environmental information of the test end; Determining whether there is an abnormality in the test environment of the test end according to the environment information; If yes, an analysis result indicating that an abnormality exists in the test environment of the test end is obtained.

7. The method according to claim 1, characterized in that Before obtaining the log content of the target line of the test log, the method further includes: Query the test contents included in the test log in a backward order to obtain the test results; When the test result does not indicate that the test is successful, the log content of the target line of the test log is obtained.

8. The method according to claim 1, characterized in that The calculating the jasccard similarity between the log content and each keyword includes: According to the log content and the keywords, a first set consisting of character strings included in the log content and a second set consisting of character strings respectively included in the keywords are obtained; According to the character strings respectively included in the first set and the second set, obtain the intersection and union corresponding to the first set and the second set respectively; The jasccard similarity between the log content and the keyword is calculated according to the number of character strings respectively included in the intersection and the union.

9. The method according to claim 1, characterized in that: Calculating the edit distance between the log content and the target keyword, including: Determine whether there is an identical character string between the log content and the keyword; If the log content and the keyword have the same character string, based on the position of the first identical character string in the log content, obtain a first character string sequence having the same number of characters as the keyword from the log content; The edit distance between the first character string sequence and the keyword is calculated according to the first character string sequence and the keyword.

10. A computing device comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, wherein: When the processor executes the computer program, the method according to any one of claims 1 to 9 is implemented.

Images