Fault log matching method and device, storage medium and electronic equipment

Abstract

The embodiment of the invention provides a fault log matching method and device, a storage medium and electronic equipment. The method comprises the following steps: acquiring a current fault log matched with a system fault event; a word segmentation result of the current fault log is obtained, the word segmentation result comprises at least one key object word segmentation, and at least one piece of index information is obtained according to the key object word segmentation; wherein the index information comprises a log identifier; determining a historical fault log matched with the word segmentation result according to the log identifier, and determining a historical log set based on the historical fault log; and determining a target log matched with the system fault event according to the historical log set. Through the above implementation mode, the technical problem that an existing fault log processing method is low in processing efficiency is solved.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computers, and in particular, to a fault log matching method and device, a storage medium, and an electronic device. Background Art

[0002] At present, server fault location mainly relies on the personal experience of operation and maintenance engineers to interpret fault logs. In this fault log interpretation method based on personal experience, facing a large number of log files, screening and judging based on personal experience alone is not only time-consuming and laborious, but also greatly increases the time for problem location when multiple servers are involved. In other words, the existing fault log processing method has the technical problem of low processing efficiency.

[0003] To address the above-mentioned problems, no effective solution has been proposed yet. Summary of the invention

[0004] The embodiments of the present application provide a fault log matching method and device, a storage medium, and an electronic device to at least solve the technical problem that the method for processing fault logs in the related art has low processing efficiency.

[0005] According to one aspect of an embodiment of the present application, a fault log matching method is provided, including: obtaining a current fault log that matches a system fault event; obtaining a word segmentation result of the current fault log, wherein the word segmentation result includes at least one key object word segmentation, and obtaining at least one index information based on the key object word segmentation; wherein the index information includes a log identifier; determining a historical fault log that matches the word segmentation result based on the log identifier, and determining a historical log set based on the historical fault log; determining a target log that matches the system fault event based on the historical log set.

[0006] According to another aspect of an embodiment of the present application, a fault log matching device is also provided, including:

[0007] A first acquisition unit is used to acquire a current fault log that matches a system fault event; a second acquisition unit is used to acquire a segmentation result of the current fault log, wherein the segmentation result includes at least one key object segmentation, and acquire at least one index information based on the key object segmentation; wherein the index information includes a log identifier; a first determination unit is used to determine a historical fault log that matches the segmentation result based on the log identifier, and determine a historical log set based on the historical fault log; a second determination unit is used to determine a target log that matches the system fault event based on the historical log set.

[0008] Optionally, the above-mentioned index information includes at least one of the above-mentioned log identifiers and frequency information corresponding to each of the at least one above-mentioned log identifiers. The above-mentioned log identifier included in the above-mentioned index information is used to indicate the historical fault log containing the above-mentioned key object segmentation words. The above-mentioned frequency information included in the above-mentioned index information is used to indicate the frequency of occurrence of the above-mentioned key object segmentation words in the above-mentioned historical fault logs. The above-mentioned second acquisition unit is used to: determine the target log that matches the above-mentioned segmentation result from the above-mentioned historical log set according to the above-mentioned frequency information corresponding to each of the above-mentioned multiple log identifiers.

[0009] Optionally, the second acquisition unit is used to: acquire current index information from multiple index information; acquire at least one log identifier included in the current index information; add at least one historical fault log indicated by at least one log identifier to the first historical log subset matching the current index information; and determine the historical log set based on the first historical log subset matching each of the multiple index information.

[0010] Optionally, the second acquisition unit is used to: traverse the historical fault logs included in each of the multiple first historical log subsets, and sequentially acquire the first frequencies corresponding to each of the multiple historical fault logs, wherein the first frequencies indicate the number of repetitions of the historical fault log in the multiple first historical log subsets; determine the multiple second historical log subsets included in the historical log set according to the first frequencies corresponding to each of the multiple historical fault logs, wherein the second historical log subset includes multiple second historical fault logs, and the first frequencies corresponding to the multiple second historical fault logs are the same.

[0011] Optionally, the second acquisition unit is used for one of the following: obtaining the log similarity between the current fault log and each of the multiple historical fault logs in the historical log set; determining the similarity weight corresponding to each of the multiple log similarities according to the frequency information corresponding to each of the multiple log identifiers; determining the target log matching the word segmentation result from the historical log set based on the log similarities and the similarity weights corresponding to each of the multiple historical fault logs; obtaining multiple second historical log subsets from the historical log set, and determining at least one candidate log from each of the multiple second historical log subsets according to the frequency information corresponding to each of the multiple log identifiers; determining the target log from at least one candidate log, wherein the second historical log subset includes multiple second historical fault logs, and the first frequencies corresponding to the multiple second historical fault logs are the same, and the first frequency is determined according to the number of repetitions of the log identifier in the multiple index information.

[0012] Optionally, the second acquisition unit is used to: acquire a current fault log subset from the plurality of second historical log subsets, and a set of object segmentations matching the current fault log subset, wherein the current object segmentation in the object segmentation set is the key object segmentation included in at least one of the historical fault logs in the current fault log subset; determine a first coefficient matching the current fault log subset according to the object segmentation set, wherein the first coefficient is determined by a second frequency corresponding to each of the plurality of current object segmentations in the object segmentation set, and the second frequency is the number of repetitions of the current object segmentation in the second historical log subset; respectively determine the a second coefficient corresponding to at least one of the above historical fault logs, wherein the second coefficient is determined by at least one of the above current object participles included in the above historical fault logs, and the number of repetitions of at least one of the above current object participles in the above historical fault logs; a target weight corresponding to at least one of the above historical fault logs is determined according to a ratio between the second coefficient corresponding to at least one of the above historical fault logs and the first coefficient; at least one of the above candidate logs is determined from the above current fault log subset according to a sorting result of the above target weight corresponding to at least one of the above historical fault logs, wherein the sorting result of the above target weight corresponding to the above candidate log is greater than or equal to the target order.

[0013] Optionally, the second acquisition unit is used for one of the following: determining a target historical log subset from the multiple second historical log subsets, wherein the first frequency corresponding to the historical fault log in the target historical log subset is higher than the first frequency corresponding to the historical fault log included in other second historical log subsets among the multiple second historical log subsets; determining the target log from at least one candidate log in the target historical log subset; determining a reference weight corresponding to at least one candidate log based on the first frequencies corresponding to each of the multiple second historical log subsets, wherein the reference weight is positively correlated with the first frequency; determining the target log from at least one candidate log based on the reference weight and target weight corresponding to each of the at least one candidate log, wherein the target weight is determined based on the number of repetitions of the key object segmentation included in the second historical log subset.

[0014] Optionally, the above-mentioned index information also includes distribution position information corresponding to at least one of the above-mentioned log identifiers, and the above-mentioned distribution position information is used to indicate the position of the above-mentioned key object segmentation in the above-mentioned historical fault log that matches it. The above-mentioned second acquisition unit is used to: determine the position weight assigned to at least one of the above-mentioned candidate logs according to the above-mentioned distribution position information corresponding to each of the above-mentioned candidate logs; determine the matching degree corresponding to at least one of the above-mentioned candidate logs according to the reference weight corresponding to each of the above-mentioned candidate logs, the above-mentioned target weight and the above-mentioned position weight; and determine the candidate log with the highest matching degree as the above-mentioned target log.

[0015] Optionally, the matching device for the above-mentioned fault log also includes: a word segmentation unit, used to obtain a first log corresponding to the current fault time node, wherein the timestamp corresponding to the log content included in the above-mentioned first log is within a first time length before the above-mentioned current fault time node; and obtain the above-mentioned current fault log of a second time length from the above-mentioned first log, wherein the above-mentioned second time length is less than or equal to the above-mentioned first time length.

[0016] Optionally, the above-mentioned word segmentation unit is used to: determine the timestamp corresponding to the last log content in the above-mentioned first log as a reference timestamp; based on the above-mentioned reference timestamp and reference duration, obtain the above-mentioned current fault log of the second duration from the above-mentioned first log, wherein the above-mentioned reference duration is less than or equal to the above-mentioned first duration, and greater than or equal to the above-mentioned second duration, the time difference between the current timestamp corresponding to the above-mentioned log content included in the above-mentioned current fault log and the above-mentioned reference timestamp is less than or equal to the above-mentioned reference duration, and the number of the above-mentioned log contents included in the above-mentioned current fault log is less than or equal to the target number.

[0017] Optionally, the above-mentioned word segmentation unit is used to: add the last log content in the above-mentioned first log to the above-mentioned current fault log, and obtain one of the above-mentioned log contents in reverse order according to the timestamps corresponding to the above-mentioned log contents in the above-mentioned first log as candidate log contents; when the time difference between the timestamp corresponding to the above-mentioned candidate log content and the above-mentioned reference timestamp corresponding to the last log content is less than or equal to the reference duration, and the number of the above-mentioned log contents included in the above-mentioned current fault log is less than or equal to the target number, the above-mentioned candidate log content is added to the above-mentioned current fault log.

[0018] Optionally, the above-mentioned word segmentation unit is used to: segment the current fault log content in the above-mentioned current fault log according to the target identifier included in the above-mentioned current fault log to obtain a first object word segmentation set; perform a word segmentation deduplication operation on the above-mentioned first object word segmentation set to obtain a second object word segmentation; perform a screening operation on the above-mentioned second object word segmentation according to a reference vocabulary to obtain the above-mentioned word segmentation result of the above-mentioned current fault log.

[0019] Optionally, the second acquisition unit is used for one of the following: performing a retrieval operation in a historical log collection according to the multiple key object segmentations in turn to obtain index information that matches each of the multiple key object segmentations; based on the multiple key object segmentations, obtaining index information that matches each of the multiple key object segmentations from an object segmentation information collection, wherein the object segmentation information collection is determined based on the preprocessing results of the historical log collection.

[0020] Optionally, the matching device for the above-mentioned fault log also includes: a log processing unit, used to obtain a first log corresponding to each of multiple historical fault time nodes within a target period, wherein the timestamp corresponding to the log content included in the above-mentioned first log is within a first time length before the above-mentioned historical fault time node; and obtain historical fault logs respectively from the above-mentioned first logs corresponding to each of multiple historical fault time nodes, wherein the second time length corresponding to the above-mentioned historical fault log is less than or equal to the above-mentioned first time length.

[0021] Optionally, the above-mentioned log processing unit is also used to: determine an object segmentation information set based on multiple historical fault logs included in the above-mentioned historical log set; and determine the index information corresponding to each of the historical fault segmentations in the above-mentioned object segmentation information set in turn, wherein the above-mentioned information includes at least one information item, and the above-mentioned information item includes the above-mentioned log identifier, the above-mentioned frequency information and the location information.

[0022] Optionally, the above-mentioned log processing unit is also used to: obtain processing description information matching the above-mentioned target log, wherein the above-mentioned processing description information includes at least one of the following: server model information, fault type information, fault cause information, and fault handling plan; and process the fault object indicated by the above-mentioned current fault log according to the above-mentioned processing description information.

[0023] According to another aspect of an embodiment of the present application, a computer-readable storage medium is further provided, in which a computer program is stored, wherein the computer program is configured to execute the above-mentioned fault log matching method or the above-mentioned performance indicator prediction model training method during runtime.

[0024] According to another aspect of the embodiments of the present application, a computer program product or a computer program is provided, the computer program product or the computer program including computer instructions, the computer instructions being stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device executes the above fault log matching method or the above performance indicator prediction model training method.

[0025] According to another aspect of an embodiment of the present application, there is also provided an electronic device, including a memory and a processor, wherein the memory stores a computer program, and the processor is configured to execute the above-mentioned fault log matching method or the above-mentioned performance indicator prediction model training method through the computer program.

[0026] Through the above-mentioned implementation mode of the present application, the current fault log matching the system fault event can be obtained first, and then the segmentation result of the current fault log can be obtained, and multiple index information can be obtained according to the segmentation of multiple key objects included in the segmentation result; in the case where multiple index information respectively include at least one log identifier, a historical log set matching the segmentation result is determined according to the historical fault logs indicated by the log identifiers included in each of the multiple index information; a target log matching the system fault event is determined according to the historical log set, and then a handling method for the current system fault event can be determined according to the target log matching the system fault event.

[0027] Through the above implementation of the present application, by analyzing the historical log set, the target log that matches the system fault event can be identified. Furthermore, based on the target log, the processing strategy for the current system fault event can be further determined. The implementation method described in the present application can automatically analyze and determine the corresponding target log in real time based on the received current fault log. This process avoids the tediousness of manually analyzing the fault log, effectively solves the problem of low fault log processing efficiency in the prior art, and achieves a technical achievement that significantly improves the fault log processing efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0029] Figure 1 It is a hardware structure block diagram of a server device of a fault log matching method according to an embodiment of the present application;

[0030] Figure 2 is a flow chart of a fault log matching method according to an embodiment of the present application;

[0031] Figure 3 is a schematic diagram of a fault log according to an embodiment of the present application;

[0032] Figure 4 is a flowchart of another fault log matching method according to an embodiment of the present application;

[0033] Figure 5 is a schematic diagram of a fault log matching method according to an embodiment of the present application;

[0034] Figure 6 is a schematic diagram of another fault log matching method according to an embodiment of the present application;

[0035] Figure 7 is a schematic diagram of another fault log matching method according to an embodiment of the present application;

[0036] Figure 8 is a structural schematic diagram of a fault log matching device according to an embodiment of the present application;

[0037] Fig. 9 It is a schematic diagram of the structure of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0038] The embodiments of the present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0039] It should be noted that the terms "first", "second", etc. in the specification and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0040] The method embodiments provided in the embodiments of the present application can be executed in a server device or a similar computing device. Taking running on a server device as an example, Figure 1 1 is a hardware structure block diagram of a server device of a fault log matching method according to an embodiment of the present application. Figure 1 As shown, the server device may include one or more ( Figure 1 Only one is shown) a processor 102 (the processor 102 may include but is not limited to a processing device such as a microprocessor MCU or a programmable logic device FPGA) and a memory 104 for storing data, wherein the above-mentioned server device may also include a transmission device 106 and an input / output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above server device. Figure 1 More or fewer components as shown, or with Figure 1 Different configurations shown.

[0041] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the data processing method of the memory in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, the above method is implemented. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some examples, the memory 104 may further include a memory remotely arranged relative to the processor 102, and these remote memories may be connected to the server device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0042] The transmission device 106 is used to receive or send data via a network. The specific example of the above network may include a wireless network provided by a communication provider of the server device. In one example, the transmission device 106 includes a network adapter (Network Interface Controller, referred to as NIC), which can be connected to other network devices through a base station so as to communicate with the Internet. In one example, the transmission device 106 can be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0043] As an optional implementation, Figure 2 As shown, the above fault log matching method can be applied to an edge device or a server node, and specifically may include the following steps:

[0044] S202, obtaining a current fault log matching the system fault event;

[0045] S204, obtaining the word segmentation result of the current fault log;

[0046] The segmentation result includes at least one key object segmentation, and at least one index information is obtained according to the key object segmentation; wherein the index information includes a log identifier;

[0047] S206, determining the historical fault logs matching the word segmentation result according to the log identifier, and determining the historical log set based on the historical fault logs;

[0048] S208: Determine a target log that matches the system failure event according to the historical log set.

[0049] It should be noted that the system failure event in the above step S202 may include but is not limited to one or more of a system crash event of a target system running on a server or a server cluster, a service interruption event of a server, a performance degradation event of a server, and the like.

[0050] Furthermore, when a system fault event is detected, a current fault log matching the system fault event can be obtained. In this embodiment, a fault log (Error Log or Fault Log) can be a series of log files recorded by a computer system, network or software application during operation, which record in detail the information of errors, anomalies, system failures or other unexpected events that occurred.

[0051] Optionally, the fault log may include one or more of the following information:

[0052] Timestamp: Records the exact time when a fault occurs, which helps determine the sequence and time of the faults.

[0053] Error Code: A unique identifier that identifies a specific type of error or failure.

[0054] Error message: A textual description of the error that occurred, which may include the severity and impact of the error.

[0055] Process information: The name of the process or service where the error occurred, which helps locate the context in which the problem occurred.

[0056] Stack trace: In software development, a stack trace provides a snapshot of the call stack at the time an error occurred, which is very useful for developers to debug their code.

[0057] System status: The system configuration, resource usage, or other relevant status information when the failure occurs.

[0058] For example Figure 3As shown, a specific fault log style is given. Multiple lines of log records are recorded in the fault log 302, and the log record 304 recorded therein is taken as an example for specific description. In the log record 304 "9 | 11 / 13 / 2019 | 10:30:01 | Power Unit PSU_Redundant | Fully Redundant", "9" is used to indicate the line number of the log record 304 in the current log, "11 / 13 / 2019" and "10:30:01" are used to indicate the timestamp corresponding to the log record 304, and "Power Unit PSU_Redundant | Fully Redundant" is used to indicate the status of the power supply unit (PSU), indicating that the power supply is fully redundant, that is, there are multiple power supplies to improve the reliability and fault tolerance of the system. Further, as shown in the 5th line of log record in the fault log 302, "11 / 13 / 2019 | 10:29:53 | System FirmwareError SYS_FW_Progress | No system memory installed | Asserted". Among them, "SystemFirmware Error" indicates that the current log record is specifically an error record. Further, the record "No system memory installed" indicates that the specific record content is "no system memory installed".

[0059] It should be noted that Figure 3 The fault log shown is only an exemplary description. The specific recording form and content of the fault log are not limited in the implementation mode of the present application.

[0060] In obtaining Figure 3 In the case of the current fault log shown, the word segmentation result of the current fault log can be obtained according to the above step S204, and multiple index information can be obtained according to the multiple key object word segmentations included in the word segmentation result.

[0061] It should be noted that in the above S204, the acquired fault log may be subjected to word segmentation processing. The above word segmentation processing may be a process of decomposing the text into separate words or phrases. Key object word segmentation can be used to indicate specific words or phrases in log analysis, such as specific error codes, service names or operation types.

[0062] In an optional implementation, the above-mentioned multiple key object segmentations may each correspond to an index information. In the above-mentioned implementation of the present application, the above-mentioned index information may include at least one log identifier for indicating a historical fault log. Then, as in the above-mentioned step S206, the above-mentioned index information will be used to search for relevant log entries in the historical data, and determine the historical log set that matches the segmentation result based on the historical fault logs obtained.

[0063] It should be noted that in the above implementation of the present application, the above index information can be used to indicate a mapping relationship between a key object segmentation and a log identifier. The above mapping relationship can include at least one of the following:

[0064] Mapping relationship 1: When the historical fault log includes the key object segmentation, the log identifier of the historical fault log is added to the index information of the key object segmentation;

[0065] It can be understood that in the above mapping relationship 1, the mapping relationship between the historical fault log and the key object segmentation word can be specifically a containment and contained relationship;

[0066] Mapping relationship 2: classify multiple historical fault logs to obtain multiple historical fault log sets; extract cluster description information corresponding to each of the multiple historical fault log sets; establish a mapping relationship between the key object segmentations included in the cluster description information and the historical fault logs in the corresponding historical fault log sets, and add the log identifiers of the historical fault logs with the mapping relationship to the index information of the above-mentioned key object segmentations.

[0067] It can be understood that in the above-mentioned mapping relationship 2, the mapping relationship between the historical fault log and the key object segmentation word can be specifically a corresponding relationship after cluster analysis.

[0068] The relationship between the two key object segmentations and the historical fault logs in the above implementation of the present application is only for illustrative purposes, and the present application does not limit the type of mapping relationship included in the specific implementation.

[0069] After the above historical log set is obtained, the target log matching the system failure event may be determined according to the above S208.

[0070] Optionally, the target log may be one of the historical log sets; in another optional implementation, the target log may be a log content determined based on the analysis results of multiple historical fault logs in the historical log set. The above analysis results may be determined by a clustering operation, or the log content may be determined based on a generative neural network model. For example, the historical log set may be input into a generative neural network model, and based on the question “Please cluster the provided log text and output the analysis results”, the output result of the generative neural network model may be determined as the target log.

[0071] Through the historical log set determined by the above implementation method of the present application, the target log that best matches the current system fault event can be identified. By obtaining the content contained in the above target log, key information about the current fault can be solved, such as the cause of the fault, the scope of impact, solutions or preventive measures. By comparing the current fault log with the historical log, the system can diagnose the problem more accurately and propose corresponding processing strategies.

[0072] Through the above implementation of the present application, the current fault log matching the system fault event can be first obtained, and then the segmentation result of the current fault log can be obtained, and multiple index information can be obtained according to the segmentation of multiple key objects included in the segmentation result; in the case where at least one log identifier is included in each of the multiple index information, a historical log set matching the segmentation result is determined according to the historical fault log indicated by the log identifier included in each of the multiple index information; the target log matching the system fault event is determined according to the historical log set, and then the current fault log and the historical fault log are analyzed and compared in an automated manner to improve the efficiency and accuracy of fault diagnosis. This method can significantly reduce the time and labor intensity of manual log analysis, while improving the speed and quality of fault handling.

[0073] It is understandable that in the event of a system failure event, if the full log related to the system failure event is obtained, since the full log contains not only the content of the current failure log, but also a large amount of content information unrelated to the current failure, it is necessary to accurately extract the log content related to the current failure.

[0074] Therefore, in an optional implementation, before the step S202 of obtaining the word segmentation result of the current fault log, the following is further included:

[0075] S1, obtaining a first log corresponding to a current fault time node, wherein a timestamp corresponding to log content included in the first log is within a first time period before the current fault time node;

[0076] S2, obtaining a current fault log of a second duration from the first log, wherein the second duration is less than or equal to the first duration.

[0077] It can be understood that the above-mentioned full log can be a first log corresponding to the current fault time node; then, the current fault log can be obtained from the first log through the above-mentioned step S2, and the second time length corresponding to the current fault log is shorter than the first time length of the first log, thereby effectively reducing the log content and improving the efficiency of log analysis.

[0078] The following further describes the method for obtaining the current fault log. In an optional implementation, the step of obtaining the current fault log of the second duration from the first log includes:

[0079] S1, determining the timestamp corresponding to the last log content in the first log as the reference timestamp;

[0080] S2, based on a reference timestamp and a reference duration, obtain a current fault log of a second duration from a first log, wherein the reference duration is less than or equal to the first duration and greater than or equal to the second duration, the time difference between the current timestamp and the reference timestamp corresponding to the log content included in the current fault log is less than or equal to the reference duration, and the number of log contents included in the current fault log is less than or equal to the target number.

[0081] It should be noted that in the above implementation of the present application, the last log content of the first log can be used as a benchmark to determine a reference log of reference length from back to front, that is, a method for filtering the content in the first log based on length; then, based on the above target number as the second filtering criterion for the log content, the current fault log whose length and the number of log contents meet the standards are filtered out.

[0082] It is understandable that, according to the formation principle of fault logs, it is easy for the same fault content to appear repeatedly. Therefore, the number of the above log contents can be used as a further screening condition to extract the current fault log from the full log.

[0083] The specific process of the method for obtaining the current fault log is further described below. In an optional implementation, the method of obtaining the current fault log of the second duration from the first log based on the reference timestamp and the reference duration includes:

[0084] S1, adding the last log content in the first log to the current fault log, and obtaining one log content in reverse order of the timestamp corresponding to the log content in the first log as the candidate log content;

[0085] S2, when the time difference between the timestamp corresponding to the candidate log content and the reference timestamp corresponding to the last log content is less than or equal to the reference duration, and the number of log contents included in the current fault log is less than or equal to the target number, the candidate log content is added to the current fault log.

[0086] It is understandable that in the above implementation of the present application, a candidate log can be created, and the log contents in the first log that meet the screening conditions can be added to the candidate log one by one, thereby completing the screening and determining of the current fault log from the first log. Figure 4 A specific process is described.

[0087] S402, obtaining full logs;

[0088] In step S402, the last line of log is extracted from the full log as the starting point. The full log includes all log information generated during the system operation.

[0089] S404, reading the last line of logs; it is understandable that the last line of logs is extracted from the full logs, which usually contains the latest system operation status information.

[0090] Execute S406 to determine whether the first line of the fault log exists; if the first line of the fault log exists, execute S408 to read the last line of the log; otherwise, obtain the last line of the log, and execute S416 to write the fault log;

[0091] After executing S408, execute S410 to determine whether the time interval is less than the target time threshold, that is, determine whether the timestamp of the last line of log currently obtained is less than the time threshold. If the determination is yes, continue to execute S412 to determine whether the number of fault logs is less than the quantity threshold, that is, determine whether the number of logs written in the fault log is less than the quantity threshold. If the determination is yes, obtain the last line of logs, execute S416, and write the fault log.

[0092] It is understandable that if the judgment results of the above S410 and S412 are no, the subsequent process is terminated and the fault log is determined as the current fault log. After executing step S416, continue to execute S418 to determine whether the number of fault logs is less than the quantity threshold. If the judgment is yes, continue to obtain the last line of log content of the full log and repeat the above process. If the judgment is no, end the process and determine the current fault log.

[0093] The above time threshold and content threshold are further explained below.

[0094] Since the server is a relatively complex hardware system, composed of a group of components, such as CPU, memory, hard disk, network card, RAID card, etc., the direct failure of the server is often not the root cause of the server failure. For example, the server downtime caused by CPU failure may be caused by hard disk damage, memory read and write errors, or even bus data transmission errors. These errors are generated linearly in time, so a time window is needed to completely extract the log content that may be related to this failure. For example, the time window can be set to S seconds, and the time interval of no more than S seconds is considered to be the fault log related to this failure.

[0095] For the content threshold, on the basis of the time window, we can further limit the maximum number of rows of log extraction. Based on experience, after some errors occur, error logs will be printed in an infinite loop. The content of these infinitely looped error logs is repetitive and cannot provide key information for retrieval. Therefore, when extracting fault content, we need to give a maximum threshold. When extracting fault logs, based on the time window, if the log exceeds the threshold, it should be discarded. This threshold is set to N.

[0096] Furthermore, based on the above-mentioned screening operation of time threshold and content threshold, Figure 4 In the illustrated implementation, a fault log extraction implementation scheme is provided, which can accurately extract log content related to a specific fault event from the full log by combining the time window (time interval S) and the content threshold (fault log number threshold N). This method can significantly improve the accuracy and efficiency of fault diagnosis, reduce the interference of irrelevant logs, and thus locate and solve problems more quickly.

[0097] After the current fault log matching the system fault event is obtained through the above implementation, the method for determining the word segmentation result in the above step S204 is further described below.

[0098] In an optional implementation, the above-mentioned obtaining the word segmentation result of the current fault log includes:

[0099] S1, segmenting the current fault log content in the current fault log according to the target identifier included in the current fault log to obtain a first object segmentation set;

[0100] S2, performing a segmentation removal operation on the first object segmentation set to obtain a second object segmentation;

[0101] S3, performing a screening operation on the second object segmentation according to the reference word library to obtain the segmentation result of the current fault log.

[0102] It is understandable that the above implementation can further segment the current fault log extracted in the previous step to determine multiple key object segmentations. Through the above implementation, effective key object segmentations can be determined, and then accurate index information can be determined.

[0103] Specifically, step S1 in the above formula can adopt a word and space combination segmentation method, that is, each English word or a specific abbreviated noun is segmented into an independent word. For example, the log content "By System BootInitiated SYS_Restart" can be segmented into four words "By, System, Boot, Initiated, SYS_Restart".

[0104] Furthermore, the English characters included in the current fault log may be uniformly converted to lowercase. For example, the above segmentation result "By, System, Boot, Initiated, SYS_Restart" may be converted to "by, system, boot, initiated, sys_restart".

[0105] Furthermore, irrelevant auxiliary words such as by, a, is, etc. may be removed. For example, the above example may be further converted into "system, boot, initiated, sys_restart". The four participles included in "system, boot, initiated, sys_restart" are then determined as four key object participles.

[0106] Through the above implementation of the present application, the fault log is converted into structured data through steps such as word segmentation, lowercase conversion and particle removal, so as to facilitate effective retrieval and analysis. This method can significantly improve the accuracy and efficiency of fault diagnosis, reduce the interference of irrelevant information, and thus locate and solve problems more quickly.

[0107] In the case where the above-mentioned multiple key object segmentations are obtained, the method of obtaining the index information in the above-mentioned step S204 is further described below.

[0108] In an optional implementation, the obtaining of multiple index information according to the multiple key object segmentation included in the segmentation result includes one of the following:

[0109] Method 1: Perform search operations in the historical log collection according to multiple key object segmentations in sequence to obtain index information that matches each of the multiple key object segmentations;

[0110] Method 2: Based on multiple key object segmentations, index information matching each of the multiple key object segmentations is obtained from an object segmentation information set, wherein the object segmentation information set is determined based on a preprocessing result of a historical log set.

[0111] It is understandable that in the first method, the historical log set can be directly searched based on multiple key object segmentations, and the corresponding index information can be determined based on the search results. In the second method, the index information corresponding to each of the multiple key object segmentations can be obtained from the object segmentation information set.

[0112] Specifically, when the log identifier in the index information is used to indicate that the historical fault log includes key object segmentation words, in the above-mentioned method one, a search can be performed based on the log content in the historical log collection based on multiple key object segmentations, and the log identifier of each retrieved historical fault log can be determined as the index information; in the above-mentioned method two, each historical fault log in the historical log collection can be firstly subjected to segmentation analysis, and the above-mentioned object segmentation information set can be determined based on the segmentation analysis results.

[0113] The following further describes the method for determining the above object segmentation information set. Before determining the object segmentation information set, the historical log set may be determined in the following manner.

[0114] In an optional implementation manner, before obtaining the word segmentation result of the current fault log, the method further includes:

[0115] S1, obtaining first logs corresponding to multiple historical fault time nodes within a target period, wherein the timestamp corresponding to the log content included in the first log is within a first time period before the historical fault time node;

[0116] S2, respectively obtaining historical fault logs from first logs corresponding to a plurality of historical fault time nodes, wherein a second duration corresponding to the historical fault log is less than or equal to the first duration.

[0117] It can be understood that in the above implementation of the present application, the method of determining multiple historical fault logs according to multiple fault history time nodes can be based on Figure 4 In the manner shown, the full log corresponding to each historical fault time node is processed to obtain historical fault logs corresponding to multiple historical fault time nodes, and then the multiple historical fault logs are determined as a historical log set.

[0118] After obtaining the historical fault log set, the object segmentation information set can be further determined in the following manner. In an optional implementation, the above-mentioned method based on multiple key object segmentations, before obtaining the index information matching each of the multiple key object segmentations from the object segmentation information set, further includes:

[0119] S1, determining an object segmentation set according to a plurality of historical fault logs included in a historical log set;

[0120] S2, sequentially determining the index information corresponding to each of the historical fault segmentations in the object segmentation information set, wherein the information includes at least one information item, and the information item includes a log identifier, frequency information, and location information.

[0121] It should be noted that the above method for determining the object segmentation information set can be to segment multiple historical fault logs in the historical log set in sequence according to the method in the above implementation method, extract key object segmentation processing. Then, the multiple key object segmentations corresponding to each historical fault log are aggregated, deduplicated, and then the above object segmentation information set is obtained.

[0122] Next, for each key object segmentation in the above object segmentation information set, the corresponding index information can be determined according to the log identifier of the corresponding historical fault log. In the above implementation, the above index information further includes frequency information and location information, wherein the frequency information included in the index information is used to indicate the frequency of occurrence of the key object segmentation in the historical fault log.

[0123] The following combination Figure 5 A specific object segmentation information set is described. Figure 5 The object segmentation information set shown includes an object segmentation set 502 and index information corresponding to each object segmentation in the object segmentation set 502. In the index information 504 corresponding to the object segmentation "system", the first information item "1, 3, M" and the second information item "2, 4, F" are included. The first information item "1, 3, M" indicates that the object segmentation "system" appears 3 times in the historical fault log marked as "1", and is mainly concentrated in the middle of the log; the second information item "2, 4, F" indicates that the object segmentation "system" appears 4 times in the historical fault log marked as "2", and is mainly concentrated in the front of the log.

[0124] Correspondingly, in the index information 506 corresponding to the object participle "boot", the first information item "1, 3, M" and the second information item "4, 5, B" are included. The first information item "1, 3, M" indicates that the object participle "boot" appears 3 times in the historical fault log identified as "1", and is mainly concentrated in the middle of the log; the second information item "4, 5, B" indicates that the object participle "boot" appears 5 times in the historical fault log identified as "4", and is mainly concentrated in the tail of the log.

[0125] It is understandable that when the object segmentation information set is determined through the above implementation, the object segmentation information set can be searched based on multiple key object segmentations of the current fault log to obtain index information corresponding to each of the multiple key object segmentations.

[0126] The following is a description of a further implementation method of determining the target log matching the system failure event in the historical log collection in step S208.

[0127] In an optional implementation, the above step S208, determining the target log matching the system failure event according to the historical log set, includes: determining the target log matching the system failure event from the historical log set according to frequency information corresponding to each of the multiple log identifiers.

[0128] It is understandable that in the implementation manner of the present application, based on the frequency information corresponding to each of the multiple log identifiers, a target log matching the word segmentation result can be determined from the historical log set.

[0129] The following are several optional methods for determining the target log. Method 1: Rule-based matching. In this embodiment, a set of rules can be defined to match historical logs based on the frequency and segmentation results of log identifiers. For example, if a log identifier appears frequently in historical logs and is highly correlated with the segmentation results of the current fault, then the log can be selected as the target log.

[0130] Method 2: Machine learning methods can be used. For example, machine learning algorithms (such as classification algorithms) can be used to automatically learn and identify log patterns related to specific faults. Historical log data is used to train the model, and the patterns learned by the model are used to predict and match new fault logs.

[0131] Method three is to use natural language processing (NLP) technology. For example, NLP technology can be used to understand and analyze the content of log text, extract key information, and compare it with historical logs. NLP technology can help identify semantic patterns in logs, thereby matching related logs more accurately.

[0132] It is understandable that the above embodiments can be used alone or in combination to improve the accuracy and efficiency of determining the target log from the historical log set. In this way, system failures can be diagnosed and resolved more quickly, reducing system downtime and maintenance costs.

[0133] In an optional implementation, the above-mentioned determining a historical log set matching the word segmentation result according to the historical fault logs indicated by the log identifiers respectively included in the plurality of index information includes: executing the following steps until the index information respectively matching the plurality of key object word segments is traversed:

[0134] S1, when current index information is obtained from multiple index information, obtaining at least one log identifier included in the current index information;

[0135] S2, adding at least one historical fault log indicated by at least one log identifier to a first historical log subset matching the current index information;

[0136] S3: When the traversal of the index information that matches the multiple key object segmentations is completed, a historical log set is determined according to the first historical log subsets that match the multiple index information.

[0137] like Figure 5 In the example, assuming that the current fault log contains multiple key object words "system" and "boot", the index information obtained includes Figure 5 The index information 504 and the index information 506 in the table are then traversed to determine the first historical log subset "1", "2" according to the index information 504 and the second historical log subset "1", "4" according to the index information 506, and then determine the historical fault logs indicated by "1", "2", and "4" as the determined historical log set.

[0138] In an optional implementation, when the above traversal of the index information that matches each of the multiple key object segmentations is completed, determining the historical log set according to the first historical log subsets that each of the multiple index information matches includes:

[0139] S1, traversing the historical fault logs respectively included in the plurality of first historical log subsets, and sequentially acquiring the first frequencies corresponding to the plurality of historical fault logs respectively, wherein the first frequencies indicate the number of repetitions of the historical fault logs in the plurality of first historical log subsets;

[0140] S2, according to the first frequencies corresponding to each of the multiple historical fault logs, determine the multiple second historical log subsets included in the historical log set according to the multiple historical fault logs, wherein the second historical log subset includes multiple second historical fault logs, and the first frequencies corresponding to the multiple second historical fault logs are the same.

[0141] It should be noted that in the implementation manner of the present application, when multiple first historical log subsets are obtained, the multiple historical fault logs included in the multiple first historical log subsets can be further divided according to the first frequency according to the corresponding occurrence frequencies of the historical fault logs included in the multiple first historical log subsets to obtain multiple second historical log subsets.

[0142] In a specific implementation, the first frequency may refer to the number of key object segmentations included in the historical fault logs. That is, the number of key object segmentations included in the historical log subsets in the second historical log subset after re-division is the same.

[0143] For example, when the segmentation result of the current fault log includes 10 key object segmentations, the historical fault logs can be layered according to the frequency of the key object segmentations in the historical fault logs. For example, in the first second historical log subset, the number of key object segmentations included in each historical fault log is 10; in the second second historical log subset, the number of key object segmentations included in each historical fault log is 9; in the third second historical log subset, the number of key object segmentations included in each historical fault log is 8... and so on.

[0144] In the case where multiple second historical log subsets are divided according to the above implementation, the target log can be determined based on the multiple second historical log subsets. For example, since the historical fault logs in the first second historical log subset all include all key object segmentations, the target log can be determined preferentially from the first second historical log subset.

[0145] In an optional implementation, the above-mentioned determining a target log matching the word segmentation result from the historical log set according to the frequency information corresponding to each of the multiple log identifiers includes one of the following:

[0146] Method 1: Obtain the log similarity corresponding to each of the current fault log and multiple historical fault logs in the historical log set; determine the similarity weight corresponding to each of the multiple log similarities according to the frequency information corresponding to each of the multiple log identifiers; based on the log similarities and similarity weights corresponding to each of the multiple historical fault logs, determine the target log that matches the word segmentation result from the historical log set;

[0147] In the above method 1, the log similarity between the current fault log and the multiple historical fault logs in the historical log set can be obtained first, and then the updated similarity weight is determined according to the log similarity and the corresponding frequency information, and then the target log is determined according to the similarity weight.

[0148] It is understandable that in the implementation of the present application, log similarity and frequency information can be used as two factors to determine the similarity weight. For example, the product of log similarity and the number of frequencies indicated in the frequency information can be determined as the similarity weight.

[0149] The following specifically describes a method for obtaining log similarities between a current fault log and a plurality of historical fault logs in a historical log set.

[0150] First, the current fault log is segmented and converted into a set of keywords or phrases. Then, each log entry in the historical log set is segmented and preprocessed in the same way.

[0151] Next, a text similarity algorithm (such as cosine similarity, Jaccard similarity, etc.) can be used to calculate the similarity between the current fault log and each log in the historical log set.

[0152] Next, the frequency weight is determined according to the frequency information indicated in the index information. The higher the frequency, the greater the frequency weight.

[0153] Finally, the similarity of each historical log can be multiplied by its corresponding frequency weight to obtain the weighted similarity, and the log with the highest weighted similarity is selected from the historical log set as the target log.

[0154] Method 2: obtaining multiple second historical log subsets from the historical log set, and determining at least one candidate log from the multiple second historical log subsets according to the frequency information corresponding to each of the multiple log identifiers; determining a target log from the at least one candidate log, wherein the second historical log subset includes multiple second historical fault logs, and the first frequencies corresponding to the multiple second historical fault logs are the same, and the first frequency is determined according to the number of repetitions of the log identifier in the multiple index information.

[0155] In the above-mentioned method 2, for example, when the segmentation result of the current fault log includes 10 key object segmentations, the historical fault logs can be layered according to the frequency of the key object segmentations in the historical fault logs. For example, in the first second historical log subset, the number of key object segmentations included in each historical fault log is 10; in the second second historical log subset, the number of key object segmentations included in each historical fault log is 9; in the third second historical log subset, the number of key object segmentations included in each historical fault log is 8... and so on.

[0156] In the case where multiple second historical log subsets are divided according to the above implementation, the target log can be determined based on the multiple second historical log subsets. For example, since the historical fault logs in the first second historical log subset include all the key object segmentations, the target log can be preferentially determined from the first second historical log subset. Specifically, the frequency weights of the various historical fault logs in the first second historical log subset can be determined in turn based on the frequency information included in the above index information, and the target log can be determined from the first second historical log subset based on the frequency weights.

[0157] A specific method for determining the target log is described below. In an optional implementation, the above-mentioned determining at least one candidate log from the plurality of second historical log subsets respectively includes:

[0158] S1, obtaining a current fault log subset from a plurality of second historical log subsets, and an object segmentation set matching the current fault log subset, wherein the current object segmentation in the object segmentation set is a key object segmentation included in at least one historical fault log in the current fault log subset;

[0159] S2, determining a first coefficient matching the current fault log subset according to the object segmentation set, wherein the first coefficient is determined by a second frequency corresponding to each of the multiple current object segmentations in the object segmentation set, and the second frequency is the number of repetitions of the current object segmentation in the second historical log subset;

[0160] S3, respectively determining a second coefficient corresponding to at least one historical fault log in the current fault log subset, wherein the second coefficient is determined by at least one current object participle included in the historical fault log and the number of repetitions of the at least one current object participle in the historical fault log;

[0161] S4, determining a target weight corresponding to each of the at least one historical fault logs according to a ratio between the second coefficient and the first coefficient corresponding to each of the at least one historical fault logs;

[0162] S5, determining at least one candidate log from the current fault log subset according to the sorting result of the target weight corresponding to each of the at least one historical fault logs, wherein the sorting result of the target weight corresponding to the candidate log is greater than or equal to the target order.

[0163] Specifically, for example Figure 6 As shown, the current fault log extracted in the above implementation mode is segmented, and it is assumed that the number of segmented words (ie, key object segmented words) obtained after segmentation is N.

[0164] Then, if Figure 6 In the above example, the object segmentation information set can be matched according to the index information of each segmentation (i.e., the key object segmentation), and the matching can be performed according to the matching degree N, N-1, N-2, ..., 1. The fault logs respectively represent the fault logs containing all N words, the fault logs containing N-1 words, the fault logs containing N-2 words (i.e., multiple second historical log subsets are obtained), and so on.

[0165] exist Figure 6 In , for each level of historical fault logs, the fault log containing N words is ranked higher than the fault log containing N-1 words, that is, N>N-1>N-2>…>1.

[0166] In the same layer, that is, if there are M fault logs containing N words at the same time, the sorting algorithm between them is as follows. The first fault log is recorded as L1, the second fault log is recorded as L2, and the Mth fault log records L M ;

[0167] In the first fault log, the number of the first search term is recorded as L1W1, so the total number of times N terms appear in M ​​logs is: TW = L1W1 + L1W2 + ... + L1W N +…+L M W1+…+L M W N (i.e. the first coefficient).

[0168] Furthermore, the sorting weight of each fault log is: W=(L x W1+L x W2+…+L X W N ) / TW. Among them, L x W1+L x W2+…+L X W N That is a specific second coefficient.

[0169] The target logs may be determined according to the above sorting weights by sorting from large to small in the same layer according to the size of W; and finally, different layers and sorting results of each layer are displayed on the basis of the layers, and the higher the matching degree is, the higher the matching degree is.

[0170] In an optional implementation manner, determining the target log from the at least one candidate log includes one of the following:

[0171] Method 1: determining a target historical log subset from a plurality of second historical log subsets, wherein a first frequency corresponding to a historical fault log in the target historical log subset is higher than a first frequency corresponding to a historical fault log included in other second historical log subsets in the plurality of second historical log subsets; determining a target log from at least one candidate log in the target historical log subset;

[0172] In the above method 1, the historical fault log with the highest ranking among the multiple historical fault logs at the highest level may be determined as the target log;

[0173] Method 2: Determine a reference weight corresponding to at least one candidate log according to the first frequencies corresponding to each of the multiple second historical log subsets, wherein the reference weight is positively correlated with the first frequency; determine a target log from at least one candidate log according to the reference weight and target weight corresponding to each of the at least one candidate log, wherein the target weight is determined according to the number of repetitions of the key object segmentation included in the second historical log subset.

[0174] In the above method 2, after determining the sorting weight of each fault log based on the above method, you can further configure the hierarchical weight for each level; then further determine the target weight based on the sorting weight and hierarchical weight of each fault log, and then determine the target log based on the sorting result of the target weight.

[0175] In an optional implementation manner, the step of determining the target log from at least one candidate log includes:

[0176] S1, determining a location weight assigned to at least one candidate log according to distribution location information corresponding to each of the at least one candidate log;

[0177] S2, determining a matching degree corresponding to each of the at least one candidate log according to a reference weight, a target weight and a position weight corresponding to each of the at least one candidate log;

[0178] S3, determine the candidate log with the highest matching degree as the target log.

[0179] It is understandable that in the implementation manner of the present application, reference weight information can be further determined based on the position information carried in the index information of each key object segmentation, and then the target log can be determined by combining the reference weight, target weight and position weight.

[0180] Specifically, in Figure 6 In , for each level of historical fault logs, the fault log containing N words is ranked higher than the fault log containing N-1 words, that is, N>N-1>N-2>…>1.

[0181] In the same layer, that is, if there are M fault logs containing N words at the same time, the sorting algorithm between them is as follows. The first fault log is recorded as L1, the second fault log is recorded as L2, and the Mth fault log records L M ;

[0182] In the first fault log, the number of the first search term is recorded as L1W1, so the total number of times N terms appear in M ​​logs is: TW = L1W1 + L1W2 + ... + L1W N +…+L M W1+…+L M W N (i.e. the first coefficient).

[0183] Furthermore, the sorting weight of each fault log is: W=(L x W1+L x W2+…+L X W N ) / TW. Among them, L x W1+L x W2+…+L X W N That is a specific second coefficient.

[0184] Furthermore, the reference weight determined based on the location information of each fault log can be obtained, and the above-mentioned sorting weight can be updated according to the reference weight to obtain the updated sorting weight. In a specific manner, the distribution of the location information included in the multiple index information corresponding to a historical fault log can be counted respectively, and the location weight can be determined based on the information indicating the distribution, wherein the weight value of the location weight can be proportional to the distribution concentration of the location information included in the multiple index information.

[0185] Then, in the same layer, the updated sorting weight W is used to sort from large to small; finally, on the basis of the stratification, different strata and the sorting results of each layer are displayed, and the closer to the front, the higher the matching degree.

[0186] In an optional implementation, after determining the target log matching the word segmentation result from the historical log set according to the frequency information corresponding to each of the multiple log identifiers, the method further includes:

[0187] S1, obtaining processing description information matching the target log, wherein the processing description information includes at least one of the following: server model information, fault type information, fault cause information, and fault handling solution;

[0188] S2: Process the fault object indicated by the current fault log according to the processing description information.

[0189] In the implementation mode of the present application, during the server operation and maintenance process, after handling hardware failures, the operation and maintenance engineers will gradually accumulate some typical failure cases, which need to include failure logs and case handling details, such as machine models, failure classifications, failure causes, solutions, etc. These contents are stored in a standardized format to establish a standard failure case library, so that similar cases can be quickly matched based on new failure logs in the future, providing failure case references for the operation and maintenance engineers. Then, when the target log is obtained, the relevant processing description information corresponding to the target log is further obtained, and the fault object in the system failure event is processed by the processing method indicated by the processing description information.

[0190] For example Figure 7 As shown in the figure, a fault case library can be built in advance, which mainly includes three parts: complete log, fault log, and case details. The structure of the case library is shown in the attached Figure 7 The complete log is the collected full server log content. The fault log format can be as follows Figure 3 As shown. Figure 7 In the case details, there are five elements: server model, fault type (memory, CPU, hard disk, network card...), fault cause analysis, and fault solution.

[0191] Through the above implementation of the present application, firstly, a fault case library can be constructed according to the above implementation, so that the historical operation and maintenance cases of the operation and maintenance engineers are stored in a unified and standardized structure, and the standardization of data facilitates subsequent extraction and retrieval; then, in the process of fault index construction, through word segmentation and index construction algorithms, it is possible to perform fast and accurate matching retrieval in a large number of logs; finally, through Figure 6 The fault retrieval algorithm shown can ensure that fault logs with high matching degree are sorted higher through word segmentation and same-layer weight sorting algorithm, that is, the higher the similarity with the search content, the more detailed information of the case can be extracted according to the structure in the case library for user reference.

[0192] The following describes a server fault rapid location system based on fault case library data involved in an embodiment of the present application.

[0193] In the implementation manner of the present application, the server fault rapid location system involved includes five modules, namely a standard case library, a fault log extraction device, a word segmentation device, a retrieval index construction device, and a retrieval matching and sorting device.

[0194] Among them, the standard case library is a database that is updated and maintained in real time based on historical fault logs. During the server operation and maintenance process, after handling hardware failures, the operation and maintenance engineers will gradually accumulate some typical failure cases. These failure cases need to include failure logs and case handling details, such as machine models, failure classifications, failure causes, solutions, etc. These contents are stored in a standardized format to establish a standard failure case library, so that similar cases can be quickly matched based on new failure logs in the future, providing failure case references for operation and maintenance engineers.

[0195] The above-mentioned fault log extraction device is used to extract fault logs. Operation and maintenance engineers collect server logs after a server failure, but server operation logs are often logs within a certain period, and most of the log content is not related to the current failure. There is a need for a solution to extract logs that are highly relevant to the current server failure and remove log content that is less relevant to the current server failure. Specifically, it can be used Figure 4 In the manner shown, historical fault logs are extracted, as well as current fault logs.

[0196] The above-mentioned word segmentation device is used to determine multiple key object word segments that match the current fault log. Word segmentation is the basis for establishing a search index and retrieval. The construction of the query index and the processing of query questions are all based on the word segmentation device. The word segmentation device cuts the extracted current fault log or historical fault log into keywords and removes some irrelevant auxiliary words such as time, a, by, etc. that are not very helpful for retrieval. Reasonable word segmentation is the basis for the subsequent construction of the search index.

[0197] The above-mentioned retrieval index construction device is used to obtain index information. Based on the word segmentation results in the above-mentioned implementation method, a retrieval index is constructed. The retrieval index is a key element for quickly retrieving similar cases. The structure of the index device mainly includes a keyword list, a key log list corresponding to each keyword where the keyword appears, the number of occurrences N, and the position P of the occurrence. The number of occurrences N and the position P of the occurrence can be used for the relevance ranking calculation of the retrieval results.

[0198] Finally, the above-mentioned retrieval matching and sorting device is used to determine the target log from multiple historical fault logs. By inputting the search content (for example, it can be the current fault log), the search content is segmented through the word segmentation device, and the search content word segmentation list L is retrieved. Similarity matching and weight sorting are performed between L and the index, and finally the search result is obtained.

[0199] Through the above implementation of the present application, in the preprocessing stage, a fault case library can be first constructed. The core idea of ​​the fault case library is to systematically and structuredly store and manage historical fault information and corresponding solutions. The construction of the case library is based on the collection, organization and analysis of a large amount of real fault data, covering various component fault types, fault descriptions, fault causes and corresponding solution steps.

[0200] Next, a fault index is constructed. In order to achieve efficient and accurate retrieval of the fault case library, the present invention introduces a retrieval index construction algorithm to index the fault case library. The index is used to quickly match key features in the log with historical fault cases in the case library, thereby helping the system to efficiently locate cases that match the current fault.

[0201] In the matching stage, log matching can be performed based on the fault retrieval algorithm. When a server fails, the system will generate corresponding log records. Traditional keyword matching and rule engine methods have obvious limitations when processing these logs, such as the inability to effectively identify complex log structures and difficulty in performing association analysis. Therefore, the implementation method of the present application improves the matching efficiency and accuracy of fault logs and case libraries through an optimized fault retrieval algorithm.

[0202] It should be noted that, for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that the present application is not limited by the described order of actions, because according to the present application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by the present application.

[0203] According to another aspect of the embodiment of the present application, a data processing device in a memory for implementing the above fault log matching method is also provided. Figure 8 As shown, the device comprises:

[0204] A first acquisition unit 802 is used to acquire a current fault log matching a system fault event;

[0205] The second acquisition unit 804 is used to acquire the word segmentation result of the current fault log, wherein the word segmentation result includes at least one key object word segmentation, and acquire at least one index information according to the key object word segmentation; wherein the index information includes a log identifier;

[0206] A first determining unit 806 is used to determine the historical fault logs matching the above word segmentation result according to the above log identifier, and determine the historical log set based on the above historical fault logs;

[0207] The second determining unit 808 is configured to determine a target log matching the system failure event according to the historical log set.

[0208] Optionally, the above-mentioned index information includes at least one of the above-mentioned log identifiers and frequency information corresponding to each of the at least one above-mentioned log identifiers. The above-mentioned log identifier included in the above-mentioned index information is used to indicate the historical fault log containing the above-mentioned key object segmentation words. The above-mentioned frequency information included in the above-mentioned index information is used to indicate the frequency of occurrence of the above-mentioned key object segmentation words in the above-mentioned historical fault logs. The above-mentioned second acquisition unit 804 is used to: determine the target log that matches the above-mentioned segmentation result from the above-mentioned historical log set according to the above-mentioned frequency information corresponding to each of the above-mentioned multiple log identifiers.

[0209] Optionally, the second acquisition unit 804 is used to: acquire current index information from multiple index information; acquire at least one log identifier included in the current index information; add at least one historical fault log indicated by at least one log identifier to the first historical log subset matching the current index information; and determine the historical log set based on the first historical log subsets matching each of the multiple index information.

[0210] Optionally, the second acquisition unit 804 is used to: traverse the historical fault logs included in each of the multiple first historical log subsets, and sequentially acquire the first frequencies corresponding to each of the multiple historical fault logs, wherein the first frequencies indicate the number of repetitions of the historical fault log in the multiple first historical log subsets; determine the multiple second historical log subsets included in the historical log set according to the first frequencies corresponding to each of the multiple historical fault logs, wherein the second historical log subset includes multiple second historical fault logs, and the first frequencies corresponding to the multiple second historical fault logs are the same.

[0211] Optionally, the second acquisition unit 804 is used for one of the following: obtaining the log similarity between the current fault log and each of the multiple historical fault logs in the historical log set; determining the similarity weight corresponding to each of the multiple log similarities according to the frequency information corresponding to each of the multiple log identifiers; determining the target log matching the word segmentation result from the historical log set based on the log similarities and the similarity weights corresponding to each of the multiple historical fault logs; obtaining multiple second historical log subsets from the historical log set, and determining at least one candidate log from each of the multiple second historical log subsets according to the frequency information corresponding to each of the multiple log identifiers; determining the target log from at least one candidate log, wherein the second historical log subset includes multiple second historical fault logs, and the first frequencies corresponding to the multiple second historical fault logs are the same, and the first frequency is determined according to the number of repetitions of the log identifier in the multiple index information.

[0212] Optionally, the second acquisition unit 804 is used to: acquire a current fault log subset from the plurality of second historical log subsets, and a set of object segmentations matching the current fault log subset, wherein the current object segmentation in the object segmentation set is the key object segmentation included in at least one of the historical fault logs in the current fault log subset; determine a first coefficient matching the current fault log subset according to the object segmentation set, wherein the first coefficient is determined by the second frequency corresponding to each of the plurality of current object segmentations in the object segmentation set, and the second frequency is the number of repetitions of the current object segmentation in the second historical log subset; respectively determine the current fault log subsets; a second coefficient corresponding to at least one of the historical fault logs, wherein the second coefficient is determined by at least one of the current object participles included in the historical fault logs and the number of repetitions of at least one of the current object participles in the historical fault logs; a target weight corresponding to at least one of the historical fault logs is determined according to a ratio between the second coefficient corresponding to at least one of the historical fault logs and the first coefficient; at least one of the candidate logs is determined from the current fault log subset according to a sorting result of the target weight corresponding to at least one of the historical fault logs, wherein the sorting result of the target weight corresponding to the candidate log is greater than or equal to the target order.

[0213] Optionally, the second acquisition unit 804 is used for one of the following: determining a target historical log subset from the plurality of second historical log subsets, wherein the first frequency corresponding to the historical fault log in the target historical log subset is higher than the first frequency corresponding to the historical fault log included in other second historical log subsets among the plurality of second historical log subsets; determining the target log from at least one candidate log in the target historical log subset; determining a reference weight corresponding to at least one candidate log according to the first frequencies corresponding to each of the plurality of second historical log subsets, wherein the reference weight is positively correlated with the first frequency; determining the target log from at least one candidate log according to the reference weight and target weight corresponding to each of the at least one candidate log, wherein the target weight is determined according to the number of repetitions of the key object segmentation included in the second historical log subset.

[0214] Optionally, the above-mentioned index information also includes distribution position information corresponding to at least one of the above-mentioned log identifiers, and the above-mentioned distribution position information is used to indicate the position of the above-mentioned key object segmentation in the above-mentioned historical fault log that matches it. The above-mentioned second acquisition unit 804 is used to: determine the position weight assigned to at least one of the above-mentioned candidate logs according to the above-mentioned distribution position information corresponding to each of the above-mentioned candidate logs; determine the matching degree corresponding to at least one of the above-mentioned candidate logs according to the reference weight corresponding to each of the above-mentioned candidate logs, the above-mentioned target weight and the above-mentioned position weight; and determine the candidate log with the highest matching degree as the above-mentioned target log.

[0215] Optionally, the matching device for the above-mentioned fault log also includes: a word segmentation unit, used to obtain a first log corresponding to the current fault time node, wherein the timestamp corresponding to the log content included in the above-mentioned first log is within a first time length before the above-mentioned current fault time node; and obtain the above-mentioned current fault log of a second time length from the above-mentioned first log, wherein the above-mentioned second time length is less than or equal to the above-mentioned first time length.

[0216] Optionally, the above-mentioned word segmentation unit is used to: determine the timestamp corresponding to the last log content in the above-mentioned first log as a reference timestamp; based on the above-mentioned reference timestamp and reference duration, obtain the above-mentioned current fault log of the second duration from the above-mentioned first log, wherein the above-mentioned reference duration is less than or equal to the above-mentioned first duration, and greater than or equal to the above-mentioned second duration, the time difference between the current timestamp corresponding to the above-mentioned log content included in the above-mentioned current fault log and the above-mentioned reference timestamp is less than or equal to the above-mentioned reference duration, and the number of the above-mentioned log contents included in the above-mentioned current fault log is less than or equal to the target number.

[0217] Optionally, the above-mentioned word segmentation unit is used to: add the last log content in the above-mentioned first log to the above-mentioned current fault log, and obtain one of the above-mentioned log contents in reverse order according to the timestamps corresponding to the above-mentioned log contents in the above-mentioned first log as candidate log contents; when the time difference between the timestamp corresponding to the above-mentioned candidate log content and the above-mentioned reference timestamp corresponding to the last log content is less than or equal to the reference duration, and the number of the above-mentioned log contents included in the above-mentioned current fault log is less than or equal to the target number, the above-mentioned candidate log content is added to the above-mentioned current fault log.

[0218] Optionally, the above-mentioned word segmentation unit is used to: segment the current fault log content in the above-mentioned current fault log according to the target identifier included in the above-mentioned current fault log to obtain a first object word segmentation set; perform a word segmentation deduplication operation on the above-mentioned first object word segmentation set to obtain a second object word segmentation; perform a screening operation on the above-mentioned second object word segmentation according to a reference vocabulary to obtain the above-mentioned word segmentation result of the above-mentioned current fault log.

[0219] Optionally, the second acquisition unit 804 is used for one of the following: performing a search operation in the historical log collection according to the multiple key object segmentations in turn to obtain index information that matches each of the multiple key object segmentations; based on the multiple key object segmentations, obtaining index information that matches each of the multiple key object segmentations from an object segmentation information collection, wherein the object segmentation information collection is determined based on the preprocessing results of the historical log collection.

[0220] Optionally, the matching device for the above-mentioned fault log also includes: a log processing unit, used to obtain a first log corresponding to each of multiple historical fault time nodes within a target period, wherein the timestamp corresponding to the log content included in the above-mentioned first log is within a first time length before the above-mentioned historical fault time node; and obtain historical fault logs respectively from the above-mentioned first logs corresponding to each of multiple historical fault time nodes, wherein the second time length corresponding to the above-mentioned historical fault log is less than or equal to the above-mentioned first time length.

[0221] Optionally, the above-mentioned log processing unit is also used to: determine an object segmentation information set based on multiple historical fault logs included in the above-mentioned historical log set; and determine the index information corresponding to each of the historical fault segmentations in the above-mentioned object segmentation information set in turn, wherein the above-mentioned information includes at least one information item, and the above-mentioned information item includes the above-mentioned log identifier, the above-mentioned frequency information and the location information.

[0222] Optionally, the above-mentioned log processing unit is also used to: obtain processing description information matching the above-mentioned target log, wherein the above-mentioned processing description information includes at least one of the following: server model information, fault type information, fault cause information, and fault handling plan; and process the fault object indicated by the above-mentioned current fault log according to the above-mentioned processing description information.

[0223] According to another aspect of the embodiment of the present application, an electronic device for implementing the matching method of the fault log in the memory is also provided. The electronic device may be Figure 1 The terminal device or server shown in the figure. This embodiment is described by taking the electronic device as a mobile phone or a computer as an example. Fig. 9 As shown, the electronic device includes a memory 902 and a processor 904. The memory 902 stores a computer program, and the processor 904 is configured to execute the steps in any of the above method embodiments through the computer program.

[0224] Optionally, in this embodiment, the electronic device may be located in at least one network device among a plurality of network devices of a computer network.

[0225] Optionally, in this embodiment, the processor may be configured to perform the following steps through a computer program:

[0226] S1, obtain the current fault log matching the system fault event;

[0227] S2, obtaining the word segmentation result of the current fault log, and obtaining multiple index information according to the multiple key object word segmentations included in the word segmentation result;

[0228] S3, in the case where the plurality of index information respectively include at least one log identifier, determining a historical log set matching the word segmentation result according to the historical fault logs indicated by the log identifiers respectively included in the plurality of index information;

[0229] S4: Determine a target log matching the system failure event according to the historical log set.

[0230] Alternatively, a person skilled in the art may understand that: Fig. 9 The structure shown is for illustration only, and the electronic device may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (Mobile Internet Devices, MID), a PAD, or other terminal devices. Fig. 9 The structure of the electronic device is not limited. Fig. 9 More or fewer components (such as network interfaces, etc.) as shown in, or with Fig. 9 Different configurations shown.

[0231] Among them, the memory 902 can be used to store software programs and modules, such as the program instructions / modules corresponding to the fault log matching method and device in the embodiment of the present application. The processor 904 executes various functional applications and data processing by running the software programs and modules stored in the memory 902, that is, to implement the above-mentioned fault log matching method. The memory 902 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 902 may further include a memory remotely located relative to the processor 904, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned networks include, but are not limited to, the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. Among them, the memory 902 can be specifically, but not limited to, used for historical fault logs, index information and other information. As an example, such as Fig. 9 As shown, the memory 902 may include, but is not limited to, the first acquisition unit 802, the second acquisition unit 804, the first determination unit 806, and the second determination unit 808 in the matching device for the fault log. In addition, other module units in the matching device for the fault log may also be included but are not limited to the above, which will not be repeated in this example.

[0232] Optionally, the transmission device 906 is used to receive or send data via a network. Specific examples of the network may include a wired network and a wireless network. In one example, the transmission device 906 includes a network adapter (Network Interface Controller, NIC), which can be connected to other network devices and routers via a network cable so as to communicate with the Internet or a local area network. In one example, the transmission device 906 is a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0233] In addition, the electronic device further includes: a display 908 for displaying the target page; and a connection bus 99 for connecting various module components in the electronic device.

[0234] In other embodiments, the terminal device or server may be a node in a distributed system, wherein the distributed system may be a blockchain system, and the blockchain system may be a distributed system formed by connecting the multiple nodes through network communication. The nodes may form a point-to-point network, and any form of computing device, such as a server, terminal or other electronic device, may become a node in the blockchain system by joining the point-to-point network.

[0235] According to one aspect of the present application, a computer-readable storage medium is provided, and a processor of a computer device reads the computer instruction from the computer-readable storage medium, and the processor executes the computer instruction, so that the computer device executes the method provided in the above various optional implementations;

[0236] Optionally, in this embodiment, the computer-readable storage medium may be configured to store a computer program for performing the following steps:

[0237] S1, obtain the current fault log matching the system fault event;

[0238] S2, obtaining a word segmentation result of the current fault log, wherein the word segmentation result includes at least one key object word segmentation, and obtaining at least one index information according to the key object word segmentation; wherein the index information includes a log identifier;

[0239] S3, determining the historical fault logs matching the word segmentation results according to the log identifier, and determining the historical log set based on the historical fault logs;

[0240] S4, determining a target log matching the system failure event based on the historical log set.

[0241] Optionally, in the embodiments of the present application, the term "module" or "unit" refers to a computer program or a part of a computer program that has a predetermined function and works together with other related parts to achieve a predetermined goal, and can be implemented in whole or in part by using software, hardware (such as processing circuits or memories), or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the function of the module or unit.

[0242] Optionally, in this embodiment, a person of ordinary skill in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing hardware related to the terminal device through a program, and the program may be stored in a computer-readable storage medium, and the storage medium may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0243] If the integrated units in the above embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product, which is stored in a storage medium and includes several instructions for enabling one or more computer devices (which can be personal computers, servers or network devices, etc.) to execute all or part of the steps of the methods of each embodiment of the present application.

[0244] In the above embodiments of the present application, the description of each embodiment has its own emphasis. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0245] In the several embodiments provided in the present application, it should be understood that the disclosed client can be implemented in other ways. Among them, the device embodiments described above are only schematic, for example, the division of units is only a logical function division, and there may be other division methods in actual implementation, for example, multiple units or components can be combined or integrated into another system, or some features can be ignored or not executed. Another point is that the mutual coupling or direct coupling or communication connection shown or discussed can be through some interfaces, indirect coupling or communication connection of units or modules, which can be electrical or other forms.

[0246] The units described as separate components may or may not be physically separated, and the components shown as units may or may not be physical units, that is, they may be located in one place or distributed on multiple network units. Some or all of the units may be selected according to actual needs to achieve the purpose of the solution of this embodiment.

[0247] In addition, each functional unit in each embodiment of the present application may be integrated into one processing unit, or each unit may exist physically separately, or two or more units may be integrated into one unit. The above-mentioned integrated unit may be implemented in the form of hardware or in the form of software functional units.

[0248] The above are only preferred implementations of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

[0249] It should be noted that the above modules can be implemented by software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0250] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored, wherein the computer program is configured to execute the steps of any of the above method embodiments when running.

[0251] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk or an optical disk.

[0252] An embodiment of the present application further provides an electronic device, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0253] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0254] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any of the above method embodiments are implemented.

[0255] An embodiment of the present application further provides another computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps in any of the above method embodiments are implemented.

[0256] The embodiments of the present application also provide a computer program, which includes computer instructions, which are stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps in any one of the above method embodiments.

[0257] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail herein.

[0258] Obviously, those skilled in the art should understand that the above modules or steps of the present application can be implemented by a general computing device, they can be concentrated on a single computing device, or distributed on a network composed of multiple computing devices, they can be implemented by a program code executable by a computing device, so that they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be executed in a different order from that herein, or they can be made into individual integrated circuit modules, or multiple modules or steps therein can be made into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0259] The above are only preferred embodiments of the present application and are not intended to limit the present application. For those skilled in the art, the present application may have various modifications and variations. Any modification, equivalent replacement, improvement, etc. made within the principles of the present application shall be included in the protection scope of the present application.

Claims

1. A fault log matching method, characterized in that: include: Get the current fault log that matches the system fault event; Obtaining a word segmentation result of the current fault log, wherein the word segmentation result includes at least one key object word segmentation, and obtaining at least one index information according to the key object word segmentation; wherein the index information includes a log identifier; Determine a historical fault log matching the word segmentation result according to the log identifier, and determine a historical log set based on the historical fault log; A target log matching the system failure event is determined according to the historical log set.

2. The method according to claim 1, characterized in that The index information includes at least one of the log identifiers and frequency information corresponding to the at least one log identifier, wherein the log identifier is used to indicate a historical fault log containing the key object segmentation word, and the frequency information is used to indicate the frequency of occurrence of the key object segmentation word in the historical fault log. The determining, according to the historical log set, a target log matching the system fault event comprises: According to the frequency information corresponding to each of the plurality of log identifiers, a target log matching the system failure event is determined from the historical log set.

3. The method according to claim 2, characterized in that The step of determining a historical fault log matching the word segmentation result according to the log identifier, and determining a historical log set based on the historical fault log, includes: Acquire current index information from the plurality of index information; Acquire at least one of the log identifiers included in the current index information; Adding at least one of the historical fault logs indicated by at least one of the log identifiers to a first historical log subset matching the current index information; The historical log set is determined according to the first historical log subsets that are matched by each of the plurality of index information.

4. The method according to claim 3, characterized in that Determining the historical log set according to the first historical log subsets that are matched by each of the plurality of index information includes: Traversing the historical fault logs respectively included in the plurality of first historical log subsets, and sequentially acquiring first frequencies corresponding to the plurality of historical fault logs respectively, wherein the first frequencies indicate the number of repetitions of the historical fault logs in the plurality of first historical log subsets; According to the first frequencies corresponding to each of the multiple historical fault logs, multiple second historical log subsets included in the historical log set are determined according to the multiple historical fault logs, wherein the second historical log subset includes multiple second historical fault logs, and the first frequencies corresponding to the multiple second historical fault logs are the same.

5. The method according to claim 2, characterized in that: Determining a target log matching the system failure event from the historical log set according to the frequency information corresponding to each of the plurality of log identifiers includes one of the following: Obtaining the log similarity corresponding to each of the current fault log and the plurality of historical fault logs in the historical log set; determining the similarity weight corresponding to each of the plurality of log similarities according to the frequency information corresponding to each of the plurality of log identifiers; determining the target log matching the system fault event from the historical log set based on the log similarities and the similarity weights corresponding to each of the plurality of historical fault logs; Acquire multiple second historical log subsets from the historical log set, and determine at least one candidate log from the multiple second historical log subsets according to the frequency information corresponding to each of the multiple log identifiers; determine the target log from at least one of the candidate logs, wherein the second historical log subset includes multiple second historical fault logs, and the first frequencies corresponding to the multiple second historical fault logs are the same, and the first frequency is determined according to the number of repetitions of the log identifier in the multiple index information.

6. The method according to claim 5, characterized in that The step of respectively determining at least one candidate log from the plurality of second historical log subsets comprises: Acquire a current fault log subset from a plurality of the second historical log subsets, and an object segmentation set matching the current fault log subset, wherein the current object segmentation in the object segmentation set is the key object segmentation included in at least one of the historical fault logs in the current fault log subset; Determine a first coefficient matching the current fault log subset according to the object segmentation set, wherein the first coefficient is determined by a second frequency corresponding to each of a plurality of the current object segmentations in the object segmentation set, and the second frequency is the number of repetitions of the current object segmentation in the second historical log subset; Respectively determine a second coefficient corresponding to at least one of the historical fault logs in the current fault log subset, wherein the second coefficient is determined by at least one of the current object participles included in the historical fault logs and the number of repetitions of at least one of the current object participles in the historical fault logs; determining a target weight corresponding to at least one of the historical fault logs according to a ratio between the second coefficient corresponding to at least one of the historical fault logs and the first coefficient; At least one candidate log is determined from the current fault log subset according to a sorting result of the target weight corresponding to each of the at least one historical fault logs, wherein the sorting result of the target weight corresponding to the candidate log is greater than or equal to the target order.

7. The method according to claim 5, characterized in that The determining the target log from at least one of the candidate logs includes one of the following: Determine a target historical log subset from a plurality of the second historical log subsets, wherein the first frequency corresponding to the historical fault log in the target historical log subset is higher than the first frequency corresponding to the historical fault log included in other second historical log subsets of the plurality of the second historical log subsets; determine the target log from at least one of the candidate logs in the target historical log subset; According to the first frequency corresponding to each of the plurality of second historical log subsets, a reference weight corresponding to each of the at least one candidate log is determined, wherein the reference weight is positively correlated with the first frequency; according to the reference weight and the target weight corresponding to each of the at least one candidate log, the target log is determined from the at least one candidate log, wherein the target weight is determined according to the number of repetitions of the key object segmentation included in the second historical log subset.

8. The method according to claim 7, characterized in that The index information also includes distribution position information corresponding to at least one of the log identifiers, and the distribution position information is used to indicate the position of the key object segmentation in the historical fault log that matches it. The determining the target log from at least one of the candidate logs includes: Determine a location weight assigned to at least one of the candidate logs according to the distribution location information corresponding to each of the at least one candidate logs; Determine a matching degree corresponding to at least one of the candidate logs according to the reference weight corresponding to each of the at least one candidate log, the target weight and the position weight; The candidate log with the highest matching degree is determined as the target log.

9. The method according to claim 2, characterized in that: Before obtaining the word segmentation result of the current fault log, the method further includes: Obtain a first log corresponding to the current fault time node, wherein a timestamp corresponding to the log content included in the first log is within a first time period before the current fault time node; The current fault log of a second duration is obtained from the first log, wherein the second duration is less than or equal to the first duration.

10. The method according to claim 9, characterized in that The obtaining the current fault log of the second duration from the first log includes: Determine the timestamp corresponding to the last log content in the first log as a reference timestamp; Based on the reference timestamp and reference duration, the current fault log of the second duration is obtained from the first log, wherein the reference duration is less than or equal to the first duration and greater than or equal to the second duration, the time difference between the current timestamp corresponding to the log content included in the current fault log and the reference timestamp is less than or equal to the reference duration, and the quantity of the log content included in the current fault log is less than or equal to the target quantity.

11. The method according to claim 10, characterized in that The acquiring the current fault log of the second duration from the first log based on the reference timestamp and the reference duration includes: Add the last log content in the first log to the current fault log, and obtain one log content in reverse order of the timestamps corresponding to the log contents in the first log as candidate log content; When the time difference between the timestamp corresponding to the candidate log content and the reference timestamp corresponding to the last log content is less than or equal to the reference duration, and the number of log contents included in the current fault log is less than or equal to the target number, the candidate log content is added to the current fault log.

12. The method according to claim 9, characterized in that The obtaining of the word segmentation result of the current fault log includes: According to the target identifier included in the current fault log, the current fault log content in the current fault log is segmented to obtain a first object segmentation set; Performing a segmentation deduplication operation on the first object segmentation set to obtain a second object segmentation; A screening operation is performed on the second object segmentation according to the reference word library to obtain the segmentation result of the current fault log.

13. The method according to claim 10, characterized in that The acquiring at least one index information according to the key object segmentation includes one of the following: According to the multiple key object segmentations, a search operation is performed in the historical log set in sequence to obtain index information that matches each of the multiple key object segmentations; Based on the multiple key object segmentations, index information matching each of the multiple key object segmentations is obtained from an object segmentation information set, wherein the object segmentation information set is determined according to a preprocessing result of the historical log set.

14. The method according to claim 13, characterized in that Before obtaining the word segmentation result of the current fault log, the method further includes: Obtaining first logs corresponding to each of a plurality of historical fault time nodes within a target period, wherein a timestamp corresponding to the log content included in the first log is within a first time period before the historical fault time node; From the first logs corresponding to each of a plurality of historical fault time nodes, historical fault logs are respectively obtained, wherein a second duration corresponding to the historical fault log is less than or equal to the first duration.

15. The method according to claim 13, characterized in that Before acquiring index information matching each of the plurality of key object segmentations from the object segmentation information set based on the plurality of key object segmentations, the method further includes: Determine an object segmentation set according to a plurality of historical fault logs included in the historical log set; The index information corresponding to each of the historical fault segmentations in the object segmentation set is determined in sequence, wherein the index information includes at least one information item, and the information item includes the log identifier, the frequency information and the location information.

16. The method according to claim 10, characterized in that After determining the target log matching the system failure event according to the historical log set, the method further includes: Acquire processing description information matching the target log, wherein the processing description information includes at least one of the following: server model information, fault type information, fault cause information, and fault handling solution; The fault object indicated by the current fault log is processed according to the processing description information.

17. A fault log matching device, characterized in that: include: A first acquisition unit, used to acquire a current fault log matching a system fault event; A second acquisition unit is used to acquire a word segmentation result of the current fault log, wherein the word segmentation result includes at least one key object word segmentation, and acquire at least one index information according to the key object word segmentation; wherein the index information includes a log identifier; A first determining unit, configured to determine, according to the log identifier, a historical fault log matching the word segmentation result, and determine a historical log set based on the historical fault log; A second determining unit is configured to determine a target log matching the system failure event according to the historical log set.

18. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the method described in any one of claims 1 to 16 when executed by a processor.

19. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that: When the processor executes the computer program, the steps of the method described in any one of claims 1 to 16 are implemented.

20. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method described in any one of claims 1 to 16 are implemented.

Images