Log analysis method and computing device

Abstract

The application discloses a log analysis method and a computing device. The method comprises the following steps: obtaining log content of a target line of a test log; determining whether the number of lines of the test log is greater than a first threshold value when the log content does not contain a target keyword; when the number of lines of the test log is greater than the first threshold value, calculating the jasccard similarity between the log content and each keyword; when the similarity is greater than or equal to a second threshold value, determining that the keyword corresponding to the similarity is the target keyword; when the number of lines of the test log is less than the first threshold value, calculating the edit distance between the log content and the target keyword; when the edit distance is less than or equal to a third threshold value, determining that the keyword corresponding to the edit distance is the target keyword; and then obtaining a log analysis result according to the target keyword. In this way, the analysis of the log content can be more efficient and accurate.

Description

TECHNICAL FIELD

[0001] The present application relates to the technical field of artificial intelligence, and particularly relates to a log analysis method and a computing device. BACKGROUND

[0002] A test log is a log file recording various activities, states and events of a test object in a test process. Analyzing the test log can quickly identify and locate errors and exceptions of the test object in the test process, so as to solve problems existing in the test object in time. When analyzing the test log, it is queried whether a log content in the test log contains a keyword corresponding to a knowledge item in a knowledge base, and if so, the analysis content corresponding to the log content is obtained from the knowledge item.

[0003] However, since the keyword in the knowledge item is established by human, there may be a difference between the log content in the test log and the keyword in the knowledge item, which leads to the fact that the target keyword of the target knowledge item corresponding to the log content cannot be determined, and thus the analysis content corresponding to the log content cannot be obtained. SUMMARY

[0004] The present application discloses a log analysis method and a computing device. According to the number of rows of the test log, the method for calculating the test log is selected, which can improve the accuracy of obtaining the keyword and increase the efficiency of test log analysis.

[0005] In a first aspect, an embodiment of the present application provides a log analysis method, the method is executed by a control end, and the method comprises:

[0006] obtaining a log content of a target row of a test log;

[0007] when it is determined that the log content does not contain a target keyword, determining whether the number of rows of the test log is greater than a first threshold value;

[0008] when the number of rows of the test log is greater than the first threshold value, calculating a jasccard similarity between the log content and each keyword, and when the similarity is greater than or equal to a second threshold value, determining that the keyword corresponding to the similarity is the target keyword;

[0009] when the number of rows of the test log is less than the threshold value, calculating an edit distance between the log content and the target keyword, and when the edit distance is less than or equal to a third threshold value, determining that the keyword corresponding to the edit distance is the target keyword;

[0010] obtaining a log analysis result according to the target keyword.

[0011] In the method, the target keyword is determined by the jaccard similarity or the edit distance between the keyword and the log content, without deep semantic analysis of the log content, reducing the complexity and matching time of determining the target keyword; in addition, since the jaccard similarity or the edit distance can allow a certain degree of inaccurate matching, it can avoid the situation that the log content and the keyword cannot be successfully matched due to spelling errors of the keyword or the log content and the keyword being synonymous with each other, thereby improving the accuracy of the matching, and further improving the analysis efficiency of the test log. At the same time, according to the number of test logs to be processed, a suitable method can be selected to balance the speed and accuracy of log analysis, thereby improving the analysis efficiency of the test log.

[0012] In a possible implementation, before the determining that the log content does not contain the target keyword, the method further includes:

[0013] checking whether there is historical log content identical to the log content in a cache area;

[0014] if yes, obtaining the target keyword from the cache area according to the historical log content.

[0015] In this implementation, when the cache area pre-stores the historical log content containing the whole line of the string sequence indicating that the test object has a specific error in the test process, and stores the analysis content corresponding to the historical log content, the user obtains the target keyword from the cache area by checking whether there is the same string sequence in the cache area, thereby avoiding the matching process of the log content and multiple keywords, and further improving the analysis efficiency of the test log.

[0016] In a possible implementation, the method further includes: storing the log content and the target keyword in a cache area.

[0017] When analyzing the test log, there can be multiple users analyzing the same test log, or a single user analyzing multiple test logs, and the string sequences indicating that the test object has a specific error in the test process in the multiple test logs are the same; therefore, the log content and the target keyword can be stored in the cache area for use.

[0018] In a possible implementation, before the obtaining the log content of the target line of the test log, the method includes: processing the test log according to the position of the log content to which the check function belongs in the test log; the processed test log includes the target log content to which the check function belongs, and the log content of the target log content and a predetermined number of lines above and below the target log content.

[0019] In the embodiment, in the test log for indicating the test object in the test process, the string sequence indicating the specific error of the test object is often located in the log content of the upward predetermined number of lines or downward predetermined number of lines of the test log position of the check function. Therefore, before taking the log content of the target line of the test log, the single line log content to which the check function belongs and the log content of the upward predetermined number of lines and the downward predetermined number of lines of the single line log content can be directly obtained; thereby reducing the log content for matching, and improving the analysis efficiency of the test log.

[0020] In a possible implementation, before the log content of the target line of the test log is obtained, the method further includes:

[0021] checking whether there is an abnormality in the network connectivity between the test terminal and the test terminal;

[0022] If yes, obtaining an analysis result for indicating that there is a network error in the test terminal.

[0023] In the embodiment, by checking whether there is an abnormality in the network connectivity between the test terminal and the test terminal, the reason for the test failure caused by the network connectivity is excluded, the number of logs needing to be analyzed is reduced, and the analysis efficiency of the test log is improved.

[0024] In a possible implementation, before the log content of the target line of the test log is obtained, the method further includes:

[0025] obtaining environment information of the test terminal;

[0026] determining whether there is an abnormality in the test environment of the test terminal according to the environment information;

[0027] If yes, obtaining an analysis result for indicating that there is an abnormality in the test environment of the test terminal.

[0028] In the embodiment, by checking whether there is an abnormality in the test environment of the test terminal in advance, the reason for the test failure caused by the test environment is excluded, the number of logs needing to be analyzed is reduced, and the analysis efficiency of the test log is improved.

[0029] In a possible implementation, before the log content of the target line of the test log is obtained, the method further includes:

[0030] obtaining a test result by querying the test content included in the test log in the order from the back to the front;

[0031] when the test result indicates that the test is successful, obtaining N lines of log content from the test log.

[0032] In the embodiment, the test results of the test logs are obtained, so that the test logs with successful tests are excluded from the test logs to be analyzed, the number of logs to be analyzed is reduced, and the analysis efficiency of the test logs is improved.

[0033] In a possible implementation, the jasccard similarity between the log content and each keyword is calculated, including:

[0034] According to the log content and the keywords, a first set composed of strings included in the log content and a second set composed of strings respectively included in the keywords are obtained;

[0035] According to the strings respectively included in the first set and the second set, intersections and unions respectively corresponding to the first set and the second set are obtained;

[0036] According to the number of strings respectively included in the intersections and the unions, the jasccard similarity between the log content and the keywords is calculated respectively.

[0037] In the implementation, the calculation of the jasccard similarity does not need to consider all possible combinations of character replacement, insertion, and deletion, and the calculation amount is small. Therefore, when the number of test logs is greater than a first threshold value, it indicates that the content of the test logs is more, at this time, the user can reduce the calculation time of the character similarity by calculating the jasccard similarity, and then improve the analysis efficiency of the test logs.

[0038] In a possible implementation, the edit distance between the log content and the target keyword is calculated, including:

[0039] It is determined whether there is a same string between the log content and the keyword;

[0040] If there is a same string between the log content and the keyword, based on the position of the first same string in the log content, a first string sequence with the same number of characters as the keyword is obtained from the log content;

[0041] According to the first string sequence and the keyword, the edit distance between the first string sequence and the keyword is calculated.

[0042] In the embodiment, because the edit distance considers all possible character operations, the edit distance can more accurately describe the character similarity. When the number of test logs is less than the first threshold value, at this time, the content of the logs of the target rows of the test logs is less, therefore, the user can determine the character similarity by calculating the edit distance, so as to improve the accuracy of the matching of the log content and the plurality of knowledge entries, and then improve the analysis accuracy of the test logs.

[0043] Meanwhile, by selecting the first string sequence with the same number of characters as the keyword in the log content, the minimum edit distance between the first string sequence and the keyword is calculated, and when the minimum edit distance is greater than the second threshold value, the edit distance between the log content and the keyword is necessarily greater than the second threshold value; therefore, in the process of calculating the edit distance, the minimum edit distance can be calculated, and the second threshold value and the minimum edit distance can be directly compared, so as to reduce the calculation amount of the edit distance between the log content and the keyword, and improve the efficiency of log analysis.

[0044] In a second aspect, an embodiment of the present application provides a log analysis device, the device comprising:

[0045] a log acquisition module configured to acquire log content of a target line of a test log;

[0046] a line number judgment module configured to determine whether the number of lines of the test log is greater than a first threshold value when the log content does not contain a target keyword;

[0047] a first calculation module configured to calculate a jaccard similarity between the log content and each keyword when the number of lines of the test log is greater than the first threshold value; and determine a keyword corresponding to the similarity as the target keyword when the similarity is greater than or equal to a second threshold value;

[0048] a second calculation module configured to calculate an edit distance between the log content and a target keyword when the number of lines of the test log is less than the threshold value; and determine a keyword corresponding to the edit distance as the target keyword when the edit distance is less than or equal to a third threshold value;

[0049] a result acquisition module configured to obtain a log analysis result according to the target keyword.

[0050] In the device, the target keyword is determined by the jaccard similarity or the edit distance between the keyword and the log content, without deep semantic analysis of the log content, thereby reducing the complexity and matching time of determining the target keyword; in addition, since the jaccard similarity or the edit distance can allow a certain degree of inaccurate matching, the situation that the log content and the keyword cannot be successfully matched due to spelling errors of the keyword or the log content and the keyword being synonymous with each other can be avoided, thereby improving the accuracy of matching. Meanwhile, according to the number of lines of the test log to be processed, a suitable method can be selected, the speed and accuracy of log analysis can be considered at the same time, and the analysis efficiency of the test log is improved.

[0051] In a possible implementation, the device further comprises a cache checking module, configured to check whether historical log content identical to the log content exists in a cache area before the determination that the log content does not contain the target keyword, and if so, acquire the target keyword from the cache area according to the historical log content.

[0052] In this implementation, when the cache area pre-stores the historical log content containing the string sequence indicating that the test object has a specific error in the test process in an entire row, and stores the analysis content corresponding to the historical log content, the user acquires the target keyword from the cache area by checking whether the string sequence identical to the log content exists in the cache area, thereby avoiding the matching process of the log content and the plurality of keywords, and further improving the analysis efficiency of the test log.

[0053] In a possible implementation, the device further comprises a keyword storage module, configured to store the log content and the target keyword in a cache area.

[0054] When analyzing the test log, a plurality of different users can analyze the same test log, or a single user can analyze a plurality of test logs, and the string sequences indicating that the test object has a specific error in the test process in the plurality of test logs are identical; therefore, the log content and the target keyword can be stored in the cache area for use.

[0055] In a possible implementation, the device further comprises a log processing module, configured to process the test log according to the position of the log content to which the checking function belongs in the test log before the acquisition of the log content of the target row of the test log; the processed test log comprises the target log content to which the checking function belongs, and the log content of a predetermined number of rows above and below the target log content.

[0056] In this implementation, the string sequence indicating that the test object has a specific error in the test process in the test log often exists in the log content of a predetermined number of rows above or below the position of the test log to which the checking function belongs. Therefore, before the acquisition of the log content of the target row of the test log, the single-row log content to which the checking function belongs and the log content of a predetermined number of rows above and below the single-row log content can be directly acquired; thereby reducing the log content for matching, and further improving the analysis efficiency of the test log.

[0057] In a possible implementation, the apparatus further comprises a network checking module configured to check whether there is an abnormality in network connectivity between the control terminal and the test terminal before the log content of the target line of the test log is acquired; if so, acquire an analysis result indicating that the test terminal has a network error.

[0058] In this implementation, by checking whether there is an abnormality in network connectivity between the control terminal and the test terminal, a reason for test failure caused by network connectivity is excluded, the number of logs that need to be analyzed is reduced, and the analysis efficiency of the test log is improved.

[0059] In a possible implementation, the apparatus further comprises an environment checking module configured to acquire environment information of the test terminal before the log content of the target line of the test log is acquired; determine whether there is an abnormality in the test environment of the test terminal according to the environment information; if so, acquire an analysis result indicating that the test environment of the test terminal has an abnormality.

[0060] In this implementation, by checking whether there is an abnormality in the test environment of the test terminal in advance, a reason for test failure caused by the test environment is excluded, the number of logs that need to be analyzed is reduced, and the analysis efficiency of the test log is improved.

[0061] In a possible implementation, the apparatus further comprises a result judging module configured to query test content included in the test log in a sequence from back to front to obtain a test result before the log content of the target line of the test log is acquired; and acquire N lines of log content from the test log when the test result indicates that the test is successful.

[0062] In this implementation, by acquiring the test result of the test log, a test log with a successful test is excluded from test logs that need to be analyzed, the number of logs that need to be analyzed is reduced, and the analysis efficiency of the test log is improved.

[0063] In a possible implementation, the first calculating module is specifically configured to acquire, according to the log content and the keyword, a first set composed of strings included in the log content and a second set composed of strings included in the keyword respectively;

[0064] acquire, according to the strings included in the first set and the second set respectively, an intersection and a union corresponding to the first set and the second set respectively;

[0065] calculate jasccard similarity between the log content and the keyword according to the number of strings included in the intersection and the union respectively.

[0066] In the implementation, the jasccard similarity does not need to consider all possible combinations of character replacement, insertion and deletion, and the amount of calculation is small. Therefore, when the value of the number of test log lines is greater than the first threshold, it indicates that the content of the test log is more, at this time, the user can reduce the calculation time of the character similarity by calculating the jasccard similarity, and then improve the analysis efficiency of the test log.

[0067] In a possible implementation, the second calculation module is specifically configured to determine whether there is a same string between the log content and the keyword;

[0068] If the log content and the keyword have the same string, based on the position of the first same string in the log content, a first string sequence with the same number of characters as the keyword is obtained from the log content;

[0069] According to the first string sequence and the keyword, the edit distance between the first string sequence and the keyword is calculated.

[0070] In the implementation, because the edit distance considers all possible character operations, the edit distance can more accurately describe the character similarity. When the number of test logs is less than the first threshold, the content of the target log of the test log is less at this time, therefore, the user can determine the character similarity by calculating the edit distance, thereby improving the accuracy of matching the log content with the plurality of knowledge items, and then improving the analysis accuracy of the test log.

[0071] Meanwhile, by selecting the first string sequence with the same number of characters as the keyword in the log content, the edit distance between the first string sequence and the keyword is calculated, which is the minimum edit distance between the log content and the keyword. When the minimum edit distance is greater than the second threshold, the edit distance between the log content and the keyword is necessarily greater than the second threshold. Therefore, in the calculation process of the edit distance, the minimum edit distance can be calculated, and the second threshold and the minimum edit distance can be directly compared, thereby reducing the calculation amount of the edit distance between the log content and the keyword, and improving the efficiency of log analysis.

[0072] In a third aspect, an embodiment of the present application provides a computing device, including a memory and a processor, the memory stores a computer program capable of running on the processor, and the processor implements the method described in the first aspect or any possible implementation manner of the first aspect when executing the computer program.

[0073] In a fourth aspect, an embodiment of the present application provides a computer storage medium, which stores instructions. When the instructions are run on a computer, the computer executes the method described in the first aspect or any possible implementation manner of the first aspect.

[0074] In a fifth aspect, an embodiment of the present application provides a computer program product containing instructions. When the instructions are run on a computer, the computer executes the method described in the first aspect or any possible implementation manner of the first aspect.

[0075] It can be understood that the beneficial effects of the third aspect to the fifth aspect described above can be referred to the related description in the first aspect, which will not be repeated here. BRIEF DESCRIPTION OF DRAWINGS

[0076] In order to more clearly illustrate the technical solutions of the embodiments of the present application, the following will briefly introduce the drawings needed to be used in the embodiments. It should be understood that the following drawings only show some of the embodiments of the present application, and therefore should not be considered as a limitation to the scope. For those skilled in the art, other related drawings can also be obtained without creative labor.

[0077] Figure 1 The schematic diagram of the application scenario provided by the embodiment of the present application;

[0078] Figure 2 The data structure diagram of the test log provided by the embodiment of the present application;

[0079] Figure 3 One of the flow diagrams of the log analysis method provided by the embodiment of the present application;

[0080] Figure 4 The flow diagram of the log analysis method provided by the embodiment of the present application;

[0081] Figure 5 The flow diagram for calculating the jasccard similarity provided by the embodiment of the present application;

[0082] Figure 6 The flow diagram for calculating the edit distance provided by the embodiment of the present application;

[0083] Figure 7 The flow diagram for obtaining the first string sequence provided by the embodiment of the present application;

[0084] Figure 8 The structural diagram of the log analysis device provided by the embodiment of the present application;

[0085] Figure 9 FIG. 1 is a structural schematic diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0086] The technical solutions in the embodiments of the present application will be described below with reference to the drawings. Obviously, the described embodiments are only some of the embodiments of the present application, not all the embodiments.

[0087] In order to better understand the embodiments of the present application, some key terms will be explained below.

[0088] Test log: Test log is a log file that records the test object in the test process, each test log reflects the execution and results of a test case in the test process in detail, including test object performance, error report, security event, etc. These test logs can help developers monitor the test object running situation, quickly locate and solve problems, evaluate the stability and performance of the test object, and ensure the safety and reliability of the test object. Test log can include multiple rows of log content arranged in order, and a row of log content usually includes a string sequence composed of multiple strings. The aforementioned test object can include an operating system or other various possible computer programs.

[0089] String: String is a data structure composed of character sequences, which can contain letters, numbers, symbols or other characters, used to store text information, perform text processing and implement various programming tasks. String is the basic element of building log content, and a single string includes a single or multiple characters.

[0090] Knowledge base: Knowledge base refers to a systematic database or information collection that stores common problems, solutions, expert experience, etc. related to the test object, which is used to assist the automated test framework to analyze the massive test logs generated, and quickly identify and locate the problems in the test process through pattern recognition and information matching.

[0091] Knowledge item: Knowledge item is the basic unit of knowledge base, which is essentially an organized and classified information segment. Each knowledge item describes the relevant content of a problem, including but not limited to concept definition, operation steps, problem solving solution, rule guidance, case study, etc. related to the test object. In addition, knowledge items are usually designed with keywords by humans to facilitate the retrieval of knowledge items in the knowledge base, providing users with fast and accurate information support to help solve specific problems or optimize decision-making processes.

[0092] Next, the application scenarios of the present application will be briefly introduced.

[0093] Before being released, a test object such as an operating system needs to be tested on a test end by a large-scale test on the mirror image of the test object; however, due to the complexity of the test environment of the test object, various abnormal conditions inconsistent with the expected results may occur in the test process, and these abnormal conditions are recorded in the test log of the test object. For the abnormal conditions recorded in the test log, as shown in Figure 1 , a user can send a test log analysis request to a computing device to which a control end belongs through a user device, the computing device acquires and analyzes the test log from a test device to which a test end belongs after receiving the analysis request, and returns the analysis result to the user device, so that the user can quickly identify and locate the errors and abnormalities of the test object in the test and timely solve the problems of the test object. The knowledge base or cache area is usually located on the computing device to which the control end belongs; according to actual needs, the knowledge base can also be deployed on other related computing devices such as a distributed cluster composed of multiple computing devices or nodes.

[0094] In the process of testing the test object, the computing device triggers the test case to perform operations on the test device through an automated test framework or manual instructions. After receiving the instructions from the computing device, the test device performs specific test operations on the test object through the check function, and records detailed test activity information including test object performance indicators, error information, test results, etc. in the test log; the test log can then be monitored in real time or collected and transmitted back to the computing device after the test is completed, for analyzing the test results and providing feedback to the development team to optimize the test object.

[0095] Among them, a test log reflects the execution and results of a test case in the test process in detail. As shown in Figure 2 , for a single test log corresponding to a single test case, it is usually divided into three stages representing test preparation, test execution, and post-processing; the stage at which the test object produces an error is usually located in the test execution stage, and the test result is usually located in the post-processing stage.

[0096] In the log content for representing the test execution stage, the check function in the form of a string sequence composed of a single or multiple strings is included. The check function is a function used in the test to verify whether the test object can achieve a certain condition or assertion; the check function is usually embedded in the test case to ensure that the state or behavior of the test object meets the expectations, so as to discover and solve problems in a timely manner during the running process. Among them, the test case contains a single or multiple check functions, and correspondingly, a test log can contain a single or multiple check functions.

[0097] When analyzing the test log, the control terminal usually queries whether the test log contains the same key as the knowledge item in the pre-established knowledge base according to the knowledge base, and then obtains the analysis content of the test log from the knowledge base according to the query result. However, since the key in the knowledge item is established artificially, there may be differences between the content of the test log and the key of the knowledge item, resulting in poor matching accuracy of the test log and the target knowledge item, and causing the analysis content obtained from the knowledge base to be inconsistent with the abnormalities existing in the test log.

[0098] The present application provides a log analysis method, which is executed by a control terminal, and the method comprises the following steps: obtaining log content of a target line of a test log; determining whether the number of lines of the test log is greater than a first threshold value when the log content does not contain a target key; calculating the jaccard similarity between the log content and each key when the number of lines of the test log is greater than the first threshold value; determining that the key corresponding to the similarity is the target key when the similarity is greater than or equal to a second threshold value; calculating the edit distance between the log content and the target key when the number of lines of the test log is less than the threshold value; determining that the key corresponding to the edit distance is the target key when the edit distance is less than or equal to a third threshold value; and obtaining a log analysis result according to the target key.

[0099] In this way, the user can determine the target key through the jaccard similarity or the edit distance between the key and the log content, so that the user does not need to perform in-depth semantic analysis on the log content, reducing the complexity and matching time of determining the target key. In addition, since the jaccard similarity or the edit distance can allow a certain degree of inaccurate matching, it can avoid the situation that the log content and the key cannot be successfully matched due to spelling errors of the key or the log content and the key being synonymous with each other, thereby improving the matching accuracy and the analysis efficiency of the test log. At the same time, according to the number of lines of the test log to be processed, a suitable method is selected, so that the computing device can simultaneously consider the speed and accuracy of log analysis, thereby improving the analysis efficiency of the test log.

[0100] The technical solutions in the embodiments of the present application are described in detail below with specific embodiments. The described embodiments are only a part of the embodiments of the present application, not all embodiments. Based on the embodiments in the present application, all other embodiments obtained by those skilled in the art without creative labor are within the scope of protection of the present application.

[0101] Figure 3 One of the flowcharts of the log analysis method provided by the embodiments of the present application.

[0102] Please refer to Figure 3The method can include, but is not limited to, some or all of the following steps S37-S39. The method is performed by the control end.

[0103] In step S31, the log content of the target line of the test log is obtained.

[0104] The test log generated by the test end in testing the test object is obtained from the test end. As described above, the test object can include an operating system or other possible computer programs.

[0105] In step S33, when the log content of the target line does not contain the target keyword, it is determined whether the number of lines of the test log is greater than a first threshold.

[0106] When the log content of the target line does not contain the target keyword, the jasccard similarity or the edit distance of the log content of the target line and the keyword can be calculated, and the keyword meeting the corresponding condition of the jasccard similarity or the edit distance is determined as the target keyword.

[0107] Although both jasccard similarity and edit distance can describe the character similarity between two string sequences, the calculation amount and the accuracy of the calculated character similarity are different. Therefore, in the analysis process of the test log, the appropriate determination method of the target keyword can be selected according to the number of lines of the test log.

[0108] In step S35, when the number of lines of the test log is greater than the first threshold, the jasccard similarity of the log content and each keyword is calculated; and when the similarity is greater than or equal to a second threshold, the keyword corresponding to the similarity is determined as the target keyword.

[0109] Jasccard similarity is a method for measuring the character similarity between two sets. For two different string sequences, first, they need to be converted into set form, and then the formula of jasccard similarity is applied.

[0110] For jasccard similarity, the calculation of jasccard similarity does not need to consider all possible combinations of character replacement, insertion and deletion, so the required calculation amount for calculating jasccard similarity is small; but since jasccard similarity mainly focuses on the matching and order between characters, for complex string sequence transformation (such as long-distance character replacement), the accuracy of the presented character similarity is not high. Therefore, when the number of lines of the test log is small, the user can calculate the jasccard similarity of the log content and the keyword to improve the calculation speed and thus improve the analysis efficiency of the test log.

[0111] Step S37, when the number of rows of the test log is less than the first threshold, calculating the edit distance between the log content and the target keyword; when the edit distance is less than or equal to the third threshold, determining that the keyword corresponding to the edit distance is the target keyword.

[0112] The edit distance between two string sequences refers to the minimum number of editing operations required to convert one string sequence into another string sequence; wherein the editing operations include inserting, deleting and replacing characters. Therefore, the edit distance can also be used to measure the character similarity between two string sequences, the smaller the edit distance, the higher the character similarity between the two strings, in other words, the larger the reciprocal of the edit distance, the higher the character similarity between the two string sequences.

[0113] As for the edit distance, since the edit distance considers all possible character operations, the edit distance can more accurately describe the character similarity; however, because the edit distance needs to consider all possible operations of all characters, calculating the edit distance will consume high computing time and resources. When the number of rows of the test log is small, the content of the log is less at this time, so the user can improve the accuracy of the target keyword determined by calculating the edit distance between the log content and the keyword, and thus improve the analysis accuracy of the test log.

[0114] It can be understood that when the number of rows of the test log is equal to the first threshold, step S35 or step S37 can be selected to be executed.

[0115] Step S39, obtaining a log analysis result according to the target keyword.

[0116] According to the target keyword, a target knowledge item is found from the knowledge base, and analysis content under the target knowledge item is obtained from the target knowledge item, and the analysis content under the target knowledge item is the analysis content corresponding to the log content. Since the string sequence used to determine the target keyword in the log content of the target row is a string sequence indicating that the test object has a specific error in the test process; therefore, the log content of the target row which can determine the target keyword includes the string sequence indicating that the test object has a specific error in the test process; thus, the analysis content corresponding to the log content of the target row is also the analysis content corresponding to the test log.

[0117] Subsequently, the control end can send the test log containing the log content of the target row, and the analysis content corresponding to the log content, or the matching result that the test log is not matched successfully, to the client end.

[0118] Figure 4 A flowchart of a log analysis method provided by an embodiment of the present application.

[0119] Please refer toFigure 4 The method can include, but is not limited to, some or all of the following steps S401-S421. The method is executed by the control terminal. Please refer to Figure 4 The method can include, but is not limited to, the following steps S401-S421. The method is executed by the control terminal.

[0120] Optionally, in step S401, it is checked whether there is an abnormality in the network connectivity between the control terminal and the test terminal.

[0121] During the test process of testing the test object by the test terminal, the network connectivity between the control terminal and the test terminal ensures the smooth transmission of the test instruction, the effective collection of the log data and the real-time monitoring of the test status. Therefore, when analyzing the test log, it is necessary to first check whether there is an abnormality in the network connectivity between the control terminal and the test terminal which generates the test log.

[0122] For example, when checking the network connectivity, the control terminal can execute the command by inputting the ping command followed by the ip address of the test terminal, which makes the control terminal send the ICMP (Internet Control Message Protocol) echo request message to the test terminal; at the same time, the test terminal sends the ICMP echo reply message to the control terminal after receiving the echo request message. If the control terminal receives the reply message from the test terminal, it is determined that the test terminal is online and in network connectivity with the control terminal; if the control terminal does not receive the reply message or receives an error message, it is determined that there is an abnormality in the network connectivity between the control terminal and the test terminal.

[0123] If there is an abnormality in the network connectivity between the control terminal and the test terminal, the analysis result indicating that the test terminal has a network error can be obtained, and the analysis result is returned to the client so as to present the analysis result to the user by the client.

[0124] If there is no abnormality in the network connectivity between the control terminal and the test terminal, the subsequent log analysis step is executed.

[0125] Optionally, in step S403, the environment information of the test terminal is obtained, and it is determined whether there is an abnormality in the test environment of the test terminal according to the environment information.

[0126] The environment information can include, but is not limited to, the hardware configuration information and / or the software configuration information of the test terminal. The hardware configuration information can include, but is not limited to, the memory configuration information, the mainboard configuration information, etc.; the software configuration information can include, but is not limited to, the driver configuration information, the service status required for running the test object, etc.

[0127] For example, the control terminal can connect to the test terminal through an ssh command. After the connection is successful, the control terminal can obtain the environment information of the test terminal through various possible commands. Then, based on the obtained environment information, it can be checked whether the test terminal has hardware or software configuration errors, insufficient memory or computing resources, service failures or other abnormal situations. If there is an abnormal situation, it means that the test environment of the test terminal is abnormal.

[0128] If the test environment of the test terminal is abnormal, the analysis result indicating that the test environment of the test terminal is abnormal can be obtained and returned to the client, so that the client presents the analysis result to the user.

[0129] If the test environment of the test terminal is not abnormal, the subsequent log analysis step is performed.

[0130] Optionally, in step S405, the test log generated by the test terminal in testing the test object is obtained, and the test result indicating that the test object is tested successfully or unsuccessfully is obtained from the test log.

[0131] As described above, the test object can include an operating system or other possible computer programs.

[0132] If the test result indicates that the test object is tested successfully, there is no need to continue analyzing the test log. The analysis result indicating that there is no need to analyze the test log can be obtained and sent to the client, so that the client presents the analysis result to the user.

[0133] In some embodiments, because the test result is usually located in a certain line of log content at a relatively late position in the test log, the control terminal can read the log content in the test log from back to front, so as to obtain the test result more quickly.

[0134] During the testing of the test object, the stage at which the test object generates an error is usually located in the stage of test execution. Correspondingly, the string sequence indicating that the test object has a specific error during the test process is located in the stage of test execution. When analyzing the test log, whether the string sequence indicating that the test object has a specific error during the test process is similar to the keyword of the knowledge item is matched, so that the test log analysis content can be obtained from the matched knowledge item. In other words, the log content of the target line for determining the target keyword only needs to include the string sequence indicating that the test object has a specific error during the test process.

[0135] Optionally, to narrow the analysis range of the test log and improve the analysis efficiency, step S407 can be performed to process the test log according to the location of the log content to which the check function belongs in the test log; the processed test log includes the target log content to which the check function belongs, and the log content of the target log content and a predetermined number of lines above and below the target log content.

[0136] In the test log, the check function is represented in the form of a string sequence composed of a single or multiple strings. In the log content used to represent the test execution stage, the string sequence indicating that the test object has a specific error in the test process is often located in the log content of a predetermined number of lines above or below the location of the test log to which the check function belongs. Therefore, when analyzing the test log, the single-line log content including the check function and the log content of the single-line log content and a predetermined number of lines above and below the single-line log content can be directly obtained, so as to screen out the log content used to represent the test preparation stage, the log content used to represent the post-processing stage, and part of the content of the test execution stage, thereby reducing the analysis content. For example, as shown in the figure, the processed test log includes the log content of 1 line of the center, 2 lines above the center, and 2 lines below the center, i.e., a total of 5 lines. Figure 2

[0137] Optionally, in step S409, for the log content of the target line, it is checked whether there is historical log content identical to the log content in the cache area.

[0138] For multiple different users, the same test log can be analyzed; or when a single user analyzes multiple test logs, the string sequences indicating that the test object has a specific error in the test process in the multiple test logs are the same. Therefore, the cache area can pre-store the entire historical log content including the string sequence indicating that the test object has a specific error in the test process, and the target keyword corresponding to the historical log content.

[0139] If the cache area has historical log content identical to the log content of the target line, the target keyword corresponding to the historical log content identical to the log content of the target line is obtained from the cache area; wherein because the historical log content is identical to the log content of the target line, the target keyword corresponding to the log content of the target line is identical to the target keyword corresponding to the historical log content.

[0140] If the cache area does not have historical log content identical to the log content of the target line, subsequent log analysis steps are performed.

[0141] ​Optionally, in step S411, it is determined whether the target keyword exists in the log content of the target row; wherein the target keyword belongs to the plurality of keywords corresponding to the plurality of knowledge entries.

[0142] For example, when any one of the plurality of keywords corresponding to the plurality of knowledge entries exists in the log content of the target row, the keyword included in the log content of the target row is determined as the target keyword. When none of the plurality of keywords corresponding to the plurality of knowledge entries is included in the log content of the target row, it is determined that the log of the target row does not have the target keyword.

[0143] If the target keyword exists in the log content of the target row, the knowledge entry corresponding to the target keyword is determined as the target knowledge entry.

[0144] If the target keyword does not exist in the log content of the target row, the subsequent log analysis step is performed.

[0145] In step S413, it is determined whether the number of rows of the test log is greater than the first threshold. For details, refer to step S33.

[0146] Optionally, in step S415, when the number of rows of the test log is greater than the first threshold, the jasccard similarity between the log content and each keyword is calculated; when the similarity is greater than or equal to the second threshold, the keyword corresponding to the similarity is determined as the target keyword. For details, refer to step S35.

[0147] Optionally, in step S417, when the number of rows of the test log is less than the threshold, the edit distance between the log content and the target keyword is calculated; when the edit distance is less than or equal to the third threshold, the keyword corresponding to the edit distance is determined as the target keyword. For details, refer to step S37.

[0148] Finally, in step S419, the log analysis result is obtained according to the target keyword. For details, refer to step S39.

[0149] Optionally, in step S421, after the target keyword is determined, the log content of the target row and the target keyword are stored in the cache area.

[0150] As described above, when different users analyze the same test log, or when a single user analyzes a plurality of test logs, the string sequence indicating the specific error of the test object in the test process in the plurality of test logs is the same; therefore, the log content of the target row and the target keyword can be stored in the cache area for use.

[0151] For example, a dictionary (or hash table) can be created to store key-value pairs, where the key is the log content of the target line and the value is the target keyword. The dictionary (or hash table) can then be stored in a cache area for easy retrieval.

[0152] The following example illustrates the process of calculating the Jasccard similarity and edit distance between a single log entry and a single keyword.

[0153] like Figure 5 As shown, in some possible implementations, the Jasccard similarity between the log content and the keywords can be calculated by partially or entirely in the following steps S51-S55.

[0154] Step S51: Based on the log content and keywords, obtain a first set consisting of strings included in the log content and a second set consisting of strings included in the keywords.

[0155] For example, log content can be decomposed into strings of representative words, characters, or other basic units. For instance, log content composed of strings of representative words can be decomposed into strings of multiple representative words to obtain a first set of strings containing multiple representative words.

[0156] Within a single set, each element is unique. For example, the elements in the first set are strings representing words, and each string in the set is unique.

[0157] Step S53: Based on the elements included in the first set and the second set, obtain the intersection and union of the first set and the second set.

[0158] For example, the intersection of the first set and the second set can be obtained based on the elements that exist in both sets; and the union of the first set and the second set can be obtained based on all the elements in both sets.

[0159] Step S55: Calculate the Jasccard similarity between the keywords and the log content based on the number of elements included in the intersection and union.

[0160] For example, Jasccard similarity can be calculated using the following formula 1:

[0161] Jasccard similarity = number of elements in the intersection / number of elements in the union (1)

[0162] For example Figure 6 As shown, the edit distance between the log content and the keywords can be calculated by taking some or all of the steps S61-S65 below.

[0163] In step S61, it is checked whether there is a same string between the log content and the keyword.

[0164] If there is a same string between the log content and the keyword, a subsequent edit distance calculation step is performed.

[0165] If there is no same string between the log content and the keyword, an analysis result indicating that the log content and the keyword are not successfully matched is obtained.

[0166] In step S63, based on the position of the first same string in the log content, a first string sequence with the same number of characters as the keyword is obtained from the log content.

[0167] Because the number of characters included in the keyword is usually less than the number of characters included in the log content, the first string sequence can be obtained from the log content. The edit distance between the first string sequence and the keyword is the minimum edit distance between the log content and the keyword.

[0168] For example Figure 7 As shown in the figure, step S63 can be completed by some or all of steps S631-S635.

[0169] There can be multiple same strings between the log content and the keyword, and the order of the multiple same strings in the log and the keyword can not be consistent, so that the first same string in the log content is not the same as the first same string in the keyword. Therefore, in step S631, a first string is obtained from the keyword, wherein the first string is the first same string in the log content corresponding to the string in the keyword.

[0170] It should be noted that if there are multiple strings in the keyword corresponding to the first same string in the log content, the first corresponding string in the keyword is taken as the first string.

[0171] In step S633, the number of characters on the first side and the second side of the first string in the keyword is obtained according to the position of the first string in the keyword.

[0172] In step S635, the first string sequence is obtained from the log content according to the position of the first same string in the log content and the number of characters on the first side and the second side of the first string in the keyword.

[0173] In the first string sequence, the number of characters on the first side and the second side of the first same string in the log content is equal to the number of characters on the first side and the second side of the first string in the keyword.

[0174] It should be noted that when the first string has A characters on the first side in the keyword, and the first string has B characters on the first side in the log content, A-B empty characters are filled on the first side of the first string in the log content, and the first string sequence is obtained from the filled log content.

[0175] In step S65, the edit distance between the first string sequence and the keyword is calculated according to the first string sequence and the keyword. Thus, the edit distance between the log content and the keyword can be obtained, and the character similarity between the log content and the keyword can be obtained according to the edit distance.

[0176] According to the foregoing, the edit distance between the first string sequence and the keyword calculated by selecting the first string sequence with the same number of characters as the keyword in the log content is the minimum edit distance between the log content and the keyword. When the minimum edit distance does not satisfy the second threshold, the edit distance between the log content and the keyword does not satisfy the second threshold. Therefore, in the calculation of the edit distance, the minimum edit distance can be calculated, and the second threshold can be directly compared with the minimum edit distance, so that the calculation amount of the edit distance between the log content and the keyword can be reduced, and the efficiency of log analysis can be improved.

[0177] In some more specific embodiments, according to the first string sequence and the keyword, the edit distance between the first string sequence and the keyword can be calculated by a dynamic programming graph.

[0178] The above mainly describes the scheme provided by the embodiments of the present application from the perspective of the method. In order to implement the above functions, the log analysis device includes hardware structures and / or software modules corresponding to each function. Those skilled in the art should easily realize that the units and algorithm steps of each example described in combination with the embodiments disclosed herein can be implemented in the form of hardware or a combination of hardware and computer software. Whether a certain function is implemented in hardware or computer software driven hardware depends on the specific application and design constraints of the technical solution. Professional technicians can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of the present application.

[0179] The embodiments of the present application can divide the log analysis device into functional modules according to the above method. For example, the log analysis device can include functional modules corresponding to each function, or two or more functions can be integrated into one processing module. The integrated module can be implemented in the form of hardware or software functional module. It should be noted that the division of modules in the embodiments of the present application is illustrative, and is only a logical functional division. In actual implementation, there can be another division method.

[0180] Figure 8 A structure diagram of a log analysis device 80 is provided in an embodiment of the present application. Please refer to Figure 8 The log analysis device 80 comprises a log acquisition module 81, a row number judgment module 82, a first calculation module 83, a second calculation module 84, and a result acquisition module 85. Among them,

[0181] The log acquisition module 81 is configured to acquire log content of a target row of a test log.

[0182] The row number judgment module 82 is configured to determine whether the number of rows of the test log is greater than a first threshold value when the log content does not contain a target keyword.

[0183] The first calculation module 83 is configured to calculate a jaccard similarity between the log content and each keyword when the number of rows of the test log is greater than the first threshold value, and determine that a keyword corresponding to the similarity is the target keyword when the similarity is greater than or equal to a second threshold value.

[0184] The second calculation module 84 is configured to calculate an edit distance between the log content and the target keyword when the number of rows of the test log is less than the threshold value, and determine that a keyword corresponding to the edit distance is the target keyword when the edit distance is less than or equal to a third threshold value.

[0185] The result acquisition module 85 is configured to obtain a log analysis result according to the target keyword.

[0186] Figure 9 A hardware structure diagram of an electronic device is provided in an embodiment of the present application. Please refer to Figure 9 The electronic device 90 can comprise a processor 91 and a memory 92. Among them, the processor 91 and the memory 92 can communicate; for example, the processor 91 and the memory 92 communicate through a communication bus 93.

[0187] The memory 92 is configured to store computer execution instructions.

[0188] The processor 91 is configured to execute the computer execution instructions stored in the memory 92, so that the processor 91 executes the technical solutions shown in the above method embodiments.

[0189] Optionally, the electronic device 90 can further comprise a communication interface, which can comprise a transmitter and / or a receiver.

[0190] Optionally, the processor can be a central processing unit (CPU), and can also be other general-purpose processors, digital signal processors (DSP), application specific integrated circuits (ASIC), or the like. The general-purpose processor can be a microprocessor or the processor can also be any conventional processor or the like. The steps of the method disclosed in combination with the embodiments of the present application can be directly embodied as a hardware processor for execution, or a combination of hardware and software modules in the processor for execution.

[0191] The electronic device provided by the embodiments of the present application can be used to execute the technical solutions shown in any of the method embodiments described above, and the implementation principles and technical effects are similar, and thus will not be described here.

[0192] The embodiments of the present application further provide a computer readable storage medium, and the computer readable storage medium stores computer instructions. When the computer instructions are executed by a computer, a log analysis method executed by any of the method embodiments described above is implemented, and the implementation principles and technical effects are similar, and thus will not be described here.

[0193] The embodiments of the present application further provide a computer program product, and the computer program product includes a computer program. When the computer program is executed by a computer, a log analysis method executed by any of the method embodiments described above is implemented, and the implementation principles and technical effects are similar, and thus will not be described here.

[0194] All or part of the steps of the above method embodiments can be completed by program instruction related hardware. The foregoing program can be stored in a readable memory. When the program is executed, the steps of the above method embodiments are executed; and the foregoing memory (storage medium) includes a read-only memory (ROM), a RAM, a flash memory, a hard disk, a solid state disk, a magnetic tape, a floppy disk, an optical disc, and any combination thereof.

[0195] The embodiments of the present application are described with reference to the flowcharts and / or block diagrams of the methods, devices, computing devices, computer-readable storage media, and computer program products according to the embodiments of the present application. It should be understood that each flow and / or block in the flowcharts and / or block diagrams, and a combination of flows and / or blocks in the flowcharts and / or block diagrams can be implemented by computer program instructions. These computer program instructions can be provided to a general-purpose computer, a special-purpose computer, an embedded processor, or other programmable terminal equipment to produce a machine, so that the instructions executed by the computer or other programmable terminal equipment produce a device implemented in the flowcharts and / or block diagrams to implement the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks. Figure 1 one or more flows and / or blocks.

[0196] These computer program instructions can also be loaded onto a computer or other programmable terminal equipment to cause a series of operational steps to be performed on the computer or other programmable terminal equipment to produce a computer implemented process, so that the instructions executed by the computer or other programmable terminal equipment provide a process implemented in the flowcharts and / or block diagrams to implement the functions specified in the flowcharts and / or block diagrams. Figure 1 one or more flows and / or blocks. Figure 1 one or more flows and / or blocks.

[0197] Obviously, those skilled in the art can make various modifications and variations to the embodiments of the present application without departing from the spirit and scope of the embodiments of the present application. Thus, if these modifications and variations of the embodiments of the present application fall within the scope of the claims of the present application and their equivalent technologies, the embodiments of the present application are also intended to include these modifications and variations.

[0198] In the above embodiments, the description of each embodiment has its own focus, and the parts not described or recorded in detail in a certain embodiment can be referred to the related description of other embodiments.

[0199] It should be understood that the size of the serial number of each step in the above embodiments does not mean the order of execution, and the execution order of each process should be determined according to its function and inherent logic, and should not constitute any limitation on the implementation process of the embodiments of the present application.

[0200] The basic principles of the present application are described above in combination with specific embodiments, but it should be pointed out that the advantages, advantages, effects and the like mentioned in the present application are only examples and not limitations, and these advantages, advantages, effects and the like cannot be considered as the must-have of each embodiment of the present disclosure. In addition, the specific details of the above disclosure are only for the purpose of example and for the purpose of understanding, and not for limitation, and the above details do not limit the present disclosure to be implemented with the above specific details.

[0201] The block diagrams of the devices, apparatuses, equipment, systems involved in the present disclosure are only as illustrative examples and are not intended to require or imply that the connection, arrangement, configuration must be as shown in the block diagrams. As those skilled in the art will recognize, these devices, apparatuses, equipment, systems can be connected, arranged, configured in any manner. Words such as "include", "contain", "have", and the like are open-ended words, mean "including but not limited to", and can be used interchangeably. The words "or" and "and" used herein mean the word "and / or", and can be used interchangeably, unless the context clearly indicates otherwise.

[0202] It is also necessary to point out that in the devices, apparatuses and methods of the present disclosure, each component or each step can be decomposed and / or recombined. These decompositions and / or recombinations should be considered as equivalent solutions of the present disclosure.

[0203] The above description has been given for the purpose of illustration and description. Furthermore, this description does not intend to limit the embodiments of the present disclosure to the forms disclosed herein. Although a plurality of example aspects and embodiments have been discussed above, those skilled in the art will recognize certain variations, modifications, changes, additions and sub-combinations thereof.

[0204] It can be understood that the various numerical numbers involved in the embodiments of the present application are only for the convenience of differentiation in the description, and are not used to limit the scope of the embodiments of the present application.

Claims

1. A log analysis method, wherein the method is executed by a control terminal, characterized in that, The method includes: Retrieve the log content of the target line in the test log; If it is determined that the target keyword does not exist in the log content, it is then determined whether the number of lines in the test log is greater than a first threshold. When the number of lines in the test log exceeds the first threshold, calculate the Jasccard similarity between the log content and each keyword; when the similarity is greater than or equal to the second threshold, determine the keyword corresponding to the similarity as the target keyword. When the number of lines in the test log is less than the first threshold, the edit distance between the log content and the target keyword is calculated; when the edit distance is less than or equal to the third threshold, the keyword corresponding to the edit distance is determined as the target keyword; the log analysis results are obtained based on the target keyword. The calculation of the edit distance between the log content and the target keyword includes: determining whether there is a common string between the log content and the keyword; if there is a common string between the log content and the keyword, based on the position of the first common string in the log content, obtaining a first string sequence with the same number of characters as the keyword from the log content; and calculating the edit distance between the first string sequence and the keyword based on the first string sequence and the keyword. Based on the position of the first identical string in the log content, obtaining a first string sequence with the same number of characters as the keyword from the log content includes: obtaining a first string from the keyword, wherein the first string is the first identical string in the log content, corresponding to the string in the keyword; obtaining the number of characters on the first side and the second side of the first string in the keyword according to the position of the first string in the keyword; and obtaining the first string sequence from the log content based on the number of characters on the first side and the second side of the first string and the position of the first identical string in the log content.

2. The method according to claim 1, characterized in that, Before determining that the target keyword does not exist in the log content, the method further includes: Check if there is any historical log content in the cache area that is identical to the log content mentioned above; If so, retrieve the target keyword from the cache area based on the historical log content.

3. The method according to claim 1, characterized in that, The method further includes storing the log content and the target keyword in a cache area.

4. The method according to claim 1, characterized in that, Before obtaining the log content of the target line of the test log, the following is included: The test log is processed according to the position of the log content to which the inspection function belongs in the test log; the processed test log includes: the target log content to which the inspection function belongs, and the log content of the target log content up and down a predetermined number of lines.

5. The method according to claim 1, characterized in that, Before obtaining the log content of the target line of the test log, the method further includes: Check for any abnormalities in the network connectivity between the control terminal and the test terminal; If so, obtain the analysis results used to indicate that there is a network error at the test end.

6. The method according to claim 1, characterized in that, Before obtaining the log content of the target line of the test log, the method further includes: Obtain the environmental information of the test terminal; Based on the environmental information, determine whether there are any anomalies in the test environment of the test terminal; If so, obtain the analysis results used to indicate that there is an anomaly in the test environment of the test terminal.

7. The method according to claim 1, characterized in that, Before obtaining the log content of the target line of the test log, the method further includes: Query the test content included in the test log in reverse order to obtain the test results; If the test result does not indicate that the test was successful, obtain the log content of the target line of the test log.

8. The method according to claim 1, characterized in that, The calculation of the Jasccard similarity between the log content and each keyword includes: Based on the log content and keywords, a first set consisting of strings included in the log content and a second set consisting of strings included in each of the keywords are obtained; Based on the strings included in the first set and the second set respectively, obtain the intersection and union of the first set and the second set respectively; The Jasccard similarity between the log content and the keyword is calculated based on the number of strings included in the intersection and union of the two sets.

9. A computing device, comprising a memory and a processor, wherein the memory stores a computer program executable on the processor, characterized in that, When the processor executes the computer program, it implements the method of any one of claims 1 to 8.

Images