Fault log matching method and device, storage medium and electronic device

Abstract

The embodiment of the present application provides a fault log matching method, device storage medium and electronic device. The method includes: obtaining a current fault log that matches a system fault event; obtaining a word segmentation result of the current fault log, wherein the word segmentation result includes at least one key object word segmentation, and obtaining at least one index information based on the key object word segmentation; wherein the index information includes a log identifier; determining a historical fault log that matches the word segmentation result based on the log identifier, and determining a historical log set based on the historical fault log; determining a target log that matches the system fault event based on the historical log set. The above-mentioned implementation of the present application solves the technical problem of low processing efficiency in the existing fault log processing method.

Description

Technical Field

[0001] The embodiments of the present application relate to the field of computers, and more specifically, to a fault log matching method and device, a storage medium, and an electronic device. Background Art

[0002] Currently, server fault location primarily relies on the personal experience of operations engineers to interpret fault logs. This experience-based approach to fault log interpretation is not only time-consuming and laborious when faced with massive log files, but also significantly increases the time required to locate the problem when multiple servers are involved. This means that existing fault log processing methods suffer from low processing efficiency.

[0003] To address the above-mentioned problems, no effective solutions have been proposed so far. Summary of the Invention

[0004] The embodiments of the present application provide a fault log matching method and device, a storage medium, and an electronic device to at least solve the technical problem of low processing efficiency in the method for processing fault logs in the related art.

[0005] According to one aspect of an embodiment of the present application, a fault log matching method is provided, including: obtaining a current fault log that matches a system fault event; obtaining a word segmentation result of the above-mentioned current fault log, wherein the above-mentioned word segmentation result includes at least one key object word segmentation, and obtaining at least one index information based on the above-mentioned key object word segmentation; wherein the above-mentioned index information includes a log identifier; determining a historical fault log that matches the above-mentioned word segmentation result based on the above-mentioned log identifier, and determining a historical log set based on the above-mentioned historical fault log; determining a target log that matches the above-mentioned system fault event based on the above-mentioned historical log set.

[0006] According to another aspect of an embodiment of the present application, a fault log matching device is provided, including:

[0007] The first acquisition unit is used to obtain the current fault log that matches the system fault event; the second acquisition unit is used to obtain the word segmentation result of the above-mentioned current fault log, wherein the above-mentioned word segmentation result includes at least one key object word segmentation, and obtain at least one index information based on the above-mentioned key object word segmentation; wherein the above-mentioned index information includes a log identifier; the first determination unit is used to determine the historical fault log that matches the above-mentioned word segmentation result according to the above-mentioned log identifier, and determine the historical log set based on the above-mentioned historical fault log; the second determination unit is used to determine the target log that matches the above-mentioned system fault event according to the above-mentioned historical log set.

[0008] Optionally, the above-mentioned index information includes at least one of the above-mentioned log identifiers and frequency information corresponding to each of the at least one above-mentioned log identifiers. The above-mentioned log identifiers included in the above-mentioned index information are used to indicate the historical fault log containing the above-mentioned key object segmentation words. The above-mentioned frequency information included in the above-mentioned index information is used to indicate the frequency of occurrence of the above-mentioned key object segmentation words in the above-mentioned historical fault logs. The above-mentioned second acquisition unit is used to: determine the target log that matches the above-mentioned segmentation result from the above-mentioned historical log set based on the above-mentioned frequency information corresponding to each of the above-mentioned multiple log identifiers.

[0009] Optionally, the above-mentioned second acquisition unit is used to: obtain current index information from multiple above-mentioned index information; obtain at least one above-mentioned log identifier included in the above-mentioned current index information; add at least one above-mentioned historical fault log indicated by at least one above-mentioned log identifier to the first historical log subset matching the above-mentioned current index information; determine the above-mentioned historical log set based on the above-mentioned first historical log subset matching each of the multiple above-mentioned index information.

[0010] Optionally, the second acquisition unit is used to: traverse the historical fault logs included in each of the multiple first historical log subsets, and sequentially acquire the first frequencies corresponding to each of the multiple historical fault logs, wherein the first frequencies indicate the number of repetitions of the historical fault log in the multiple first historical log subsets; determine the multiple second historical log subsets included in the historical log set based on the first frequencies corresponding to each of the multiple historical fault logs, wherein the second historical log subset includes multiple second historical fault logs, and the first frequencies corresponding to the multiple second historical fault logs are the same.

[0011] Optionally, the second acquisition unit is used for one of the following: obtaining the log similarity between the current fault log and each of the multiple historical fault logs in the historical log set; determining the similarity weight corresponding to each of the multiple log similarities based on the frequency information corresponding to each of the multiple log identifiers; determining the target log that matches the word segmentation result from the historical log set based on the log similarities and the similarity weight corresponding to each of the multiple historical fault logs; obtaining multiple second historical log subsets from the historical log set, and determining at least one candidate log from each of the multiple second historical log subsets based on the frequency information corresponding to each of the multiple log identifiers; determining the target log from at least one candidate log, wherein the second historical log subset includes multiple second historical fault logs, and the first frequencies corresponding to the multiple second historical fault logs are the same, and the first frequency is determined based on the number of repetitions of the log identifier in the multiple index information.

[0012] Optionally, the second acquisition unit is used to: acquire a current fault log subset from a plurality of the second historical log subsets, and a set of object segmentations that matches the current fault log subset, wherein the current object segmentation in the object segmentation set is the key object segmentation included in at least one of the historical fault logs in the current fault log subset; determine a first coefficient that matches the current fault log subset based on the object segmentation set, wherein the first coefficient is determined by the second frequency corresponding to each of the plurality of current object segmentations in the object segmentation set, and the second frequency is the number of repetitions of the current object segmentation in the second historical log subset; respectively determine the a second coefficient corresponding to at least one of the above-mentioned historical fault logs, wherein the second coefficient is determined by at least one of the above-mentioned current object participles included in the above-mentioned historical fault logs, and the number of repetitions of at least one of the above-mentioned current object participles in the above-mentioned historical fault logs; determining the target weight corresponding to at least one of the above-mentioned historical fault logs according to the ratio between the second coefficient corresponding to at least one of the above-mentioned historical fault logs and the first coefficient; determining at least one of the above-mentioned candidate logs from the above-mentioned current fault log subset according to the sorting result of the above-mentioned target weight corresponding to at least one of the above-mentioned historical fault logs, wherein the sorting result of the above-mentioned target weight corresponding to the above-mentioned candidate log is greater than or equal to the target order.

[0013] Optionally, the second acquisition unit is used for one of the following: determining a target historical log subset from the plurality of second historical log subsets, wherein the first frequency corresponding to the historical fault log in the target historical log subset is higher than the first frequency corresponding to the historical fault log included in other second historical log subsets in the plurality of second historical log subsets; determining the target log from at least one candidate log in the target historical log subset; determining a reference weight corresponding to at least one candidate log based on the first frequencies corresponding to each of the plurality of second historical log subsets, wherein the reference weight is positively correlated with the first frequency; determining the target log from at least one candidate log based on the reference weight and target weight corresponding to each of the candidate logs, wherein the target weight is determined based on the number of repetitions of the key object segmentation included in the second historical log subset.

[0014] Optionally, the above-mentioned index information also includes distribution position information corresponding to at least one of the above-mentioned log identifiers, and the above-mentioned distribution position information is used to indicate the position of the above-mentioned key object segmentation in the above-mentioned historical fault log that matches it. The above-mentioned second acquisition unit is used to: determine the position weight assigned to at least one of the above-mentioned candidate logs based on the above-mentioned distribution position information corresponding to each of the above-mentioned candidate logs; determine the matching degree corresponding to at least one of the above-mentioned candidate logs based on the reference weight corresponding to each of the above-mentioned candidate logs, the above-mentioned target weight and the above-mentioned position weight; and determine the candidate log with the highest matching degree as the above-mentioned target log.

[0015] Optionally, the matching device for the above-mentioned fault log also includes: a word segmentation unit, used to obtain a first log corresponding to the current fault time node, wherein the timestamp corresponding to the log content included in the above-mentioned first log is within a first time length before the above-mentioned current fault time node; and obtain the above-mentioned current fault log of a second time length from the above-mentioned first log, wherein the above-mentioned second time length is less than or equal to the above-mentioned first time length.

[0016] Optionally, the above-mentioned word segmentation unit is used to: determine the timestamp corresponding to the last log content in the above-mentioned first log as a reference timestamp; based on the above-mentioned reference timestamp and reference duration, obtain the above-mentioned current fault log of the second duration from the above-mentioned first log, wherein the above-mentioned reference duration is less than or equal to the above-mentioned first duration, and greater than or equal to the above-mentioned second duration, the time difference between the current timestamp corresponding to the above-mentioned log content included in the above-mentioned current fault log and the above-mentioned reference timestamp is less than or equal to the above-mentioned reference duration, and the number of the above-mentioned log contents included in the above-mentioned current fault log is less than or equal to the target number.

[0017] Optionally, the above-mentioned word segmentation unit is used to: add the last log content in the above-mentioned first log to the above-mentioned current fault log, and obtain one log content in reverse order according to the timestamps corresponding to the above-mentioned log contents in the above-mentioned first log as candidate log content; when the time difference between the timestamp corresponding to the above-mentioned candidate log content and the above-mentioned reference timestamp corresponding to the last log content is less than or equal to the reference duration, and the number of the above-mentioned log contents included in the above-mentioned current fault log is less than or equal to the target number, the above-mentioned candidate log content is added to the above-mentioned current fault log.

[0018] Optionally, the above-mentioned word segmentation unit is used to: segment the current fault log content in the above-mentioned current fault log according to the target identifier included in the above-mentioned current fault log to obtain a first object word segmentation set; perform a word segmentation deduplication operation on the above-mentioned first object word segmentation set to obtain a second object word segmentation; perform a screening operation on the above-mentioned second object word segmentation according to a reference vocabulary to obtain the above-mentioned word segmentation result of the above-mentioned current fault log.

[0019] Optionally, the above-mentioned second acquisition unit is used for one of the following: performing a retrieval operation in the historical log collection according to the multiple above-mentioned key object segmentations in sequence to obtain index information that matches each of the multiple above-mentioned key object segmentations; based on the multiple above-mentioned key object segmentations, obtaining index information that matches each of the multiple above-mentioned key object segmentations from the object segmentation information collection, wherein the above-mentioned object segmentation information collection is determined according to the preprocessing results of the above-mentioned historical log collection.

[0020] Optionally, the matching device for the above-mentioned fault logs also includes: a log processing unit, used to obtain a first log corresponding to each of multiple historical fault time nodes within a target period, wherein the timestamp corresponding to the log content included in the above-mentioned first log is within a first time length before the above-mentioned historical fault time node; and obtain historical fault logs respectively from the above-mentioned first logs corresponding to each of multiple historical fault time nodes, wherein the second time length corresponding to the above-mentioned historical fault log is less than or equal to the above-mentioned first time length.

[0021] Optionally, the above-mentioned log processing unit is also used to: determine the object segmentation information set based on the multiple historical fault logs included in the above-mentioned historical log set; and determine the index information corresponding to each historical fault segmentation in the above-mentioned object segmentation information set in turn, wherein the above-mentioned information includes at least one information item, and the above-mentioned information item includes the above-mentioned log identifier, the above-mentioned frequency information and the location information.

[0022] Optionally, the above-mentioned log processing unit is also used to: obtain processing description information matching the above-mentioned target log, wherein the above-mentioned processing description information includes at least one of the following: server model information, fault type information, fault cause information, and fault handling solution; and process the fault object indicated by the above-mentioned current fault log according to the above-mentioned processing description information.

[0023] According to another aspect of an embodiment of the present application, a computer-readable storage medium is further provided, in which a computer program is stored, wherein the computer program is configured to execute the above-mentioned fault log matching method or the above-mentioned performance indicator prediction model training method during runtime.

[0024] According to another aspect of an embodiment of the present application, a computer program product or computer program is provided, comprising computer instructions stored in a computer-readable storage medium. A processor of a computer device reads the computer instructions from the computer-readable storage medium and executes the computer instructions, causing the computer device to perform the above-described fault log matching method or the above-described performance indicator prediction model training method.

[0025] According to another aspect of an embodiment of the present application, an electronic device is also provided, including a memory and a processor, wherein a computer program is stored in the memory, and the processor is configured to execute the above-mentioned fault log matching method or the above-mentioned performance indicator prediction model training method through the computer program.

[0026] Through the above-mentioned implementation mode of the present application, the current fault log that matches the system fault event can be obtained first, and then the word segmentation result of the current fault log can be obtained, and multiple index information can be obtained based on the word segmentation of multiple key objects included in the word segmentation result; in the case where multiple index information respectively include at least one log identifier, the historical log set that matches the word segmentation result is determined based on the historical fault logs indicated by the log identifiers included in each of the multiple index information; the target log that matches the system fault event is determined based on the historical log set, and then the handling method of the current system fault event can be determined based on the target log that matches the system fault event.

[0027] Through the above-mentioned implementation method of the present application, by analyzing the historical log collection, it is possible to identify the target log that matches the system failure event. Furthermore, based on the target log, it is possible to further determine the processing strategy for the current system failure event. The implementation method described in the present application can automatically analyze and determine the corresponding target log in real time based on the current fault log received. This process avoids the tedious manual analysis of fault logs, effectively solves the problem of low fault log processing efficiency in the prior art, and achieves a technical achievement that significantly improves the fault log processing efficiency. BRIEF DESCRIPTION OF THE DRAWINGS

[0028] The drawings described herein are used to provide a further understanding of the present application and constitute a part of the present application. The illustrative embodiments of the present application and their descriptions are used to explain the present application and do not constitute an improper limitation on the present application. In the drawings:

[0029] Figure 1 This is a hardware structure block diagram of a server device for a fault log matching method according to an embodiment of the present application;

[0030] Figure 2 is a flow chart of a fault log matching method according to an embodiment of the present application;

[0031] Figure 3 is a schematic diagram of a fault log according to an embodiment of the present application;

[0032] Figure 4 is a flowchart of another fault log matching method according to an embodiment of the present application;

[0033] Figure 5 is a schematic diagram of a fault log matching method according to an embodiment of the present application;

[0034] Figure 6 is a schematic diagram of another fault log matching method according to an embodiment of the present application;

[0035] Figure 7 is a schematic diagram of another fault log matching method according to an embodiment of the present application;

[0036] Figure 8 1 is a structural diagram of a fault log matching device according to an embodiment of the present application;

[0037] Figure 9 It is a structural diagram of an electronic device according to an embodiment of the present application. DETAILED DESCRIPTION

[0038] The embodiments of the present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0039] It should be noted that the terms "first", "second", etc. in the description and claims of this application and the above-mentioned drawings are used to distinguish similar objects, and are not necessarily used to describe a specific order or sequence.

[0040] The method embodiments provided in the embodiments of the present application can be executed in a server device or a similar computing device. Taking running on a server device as an example, Figure 1 This is a hardware structure diagram of a server device for a fault log matching method according to an embodiment of the present application. Figure 1 As shown, the server device may include one or more ( Figure 1 Only one is shown) a processor 102 (the processor 102 may include but is not limited to a microprocessor MCU or a programmable logic device FPGA and other processing devices) and a memory 104 for storing data. The above-mentioned server device may also include a transmission device 106 and an input and output device 108 for communication functions. It can be understood by those skilled in the art that Figure 1 The structure shown is only for illustration and does not limit the structure of the above server device. Figure 1 More or fewer components than shown, or with Figure 1 Different configurations shown.

[0041] The memory 104 can be used to store computer programs, for example, software programs and modules of application software, such as the computer program corresponding to the data processing method of the memory in the embodiment of the present application. The processor 102 executes various functional applications and data processing by running the computer program stored in the memory 104, that is, implementing the above method. The memory 104 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 104 may further include a memory remotely located relative to the processor 102, and these remote memories may be connected to a server device via a network. Examples of the above-mentioned network include, but are not limited to, the Internet, an intranet, a local area network, a mobile communication network, and combinations thereof.

[0042] Transmission device 106 is used to receive or transmit data via a network. A specific example of the aforementioned network may include a wireless network provided by a communication provider of the server device. In one embodiment, transmission device 106 includes a network interface controller (NIC), which can be connected to other network devices via a base station to enable communication with the Internet. In another embodiment, transmission device 106 may be a radio frequency (RF) module, which is used to communicate with the Internet wirelessly.

[0043] As an optional implementation, Figure 2 As shown, the above fault log matching method can be applied to an edge device or a server node, and specifically may include the following steps:

[0044] S202, obtaining a current fault log that matches the system fault event;

[0045] S204, obtaining the word segmentation result of the current fault log;

[0046] The word segmentation result includes at least one key object word segmentation, and at least one index information is obtained according to the key object word segmentation; wherein the index information includes a log identifier;

[0047] S206, determining historical fault logs that match the word segmentation result according to the log identifier, and determining a historical log set based on the historical fault logs;

[0048] S208: Determine a target log that matches the system failure event based on the historical log set.

[0049] It should be noted that the system failure event in the above step S202 may include but is not limited to one or more of a system crash event of a target system running on a server or a server cluster, a service interruption event of a server, and a performance degradation event of a server.

[0050] Furthermore, if a system failure event is detected, a current fault log matching the system failure event can be obtained. In this embodiment, a fault log (Error Log or Fault Log) can be a series of log files recorded by a computer system, network, or software application during operation, which records detailed information about errors, exceptions, system failures, or other unexpected events.

[0051] Optionally, the fault log may include one or more of the following information:

[0052] Timestamp: Records the specific time when the fault occurs, which helps to determine the sequence and time point of the fault occurrence.

[0053] Error Code: A unique identifier that identifies a specific type of error or failure.

[0054] Error message: A textual description of the error that occurred, which may include the severity and impact of the error.

[0055] Process information: The name of the process or service where the error occurred, which helps locate the context of the problem.

[0056] Stack trace: In software development, a stack trace provides a snapshot of the call stack at the time an error occurred, which is very useful for developers to debug their code.

[0057] System status: The system configuration, resource usage, or other relevant status information when the failure occurs.

[0058] For example Figure 3As shown, a specific fault log format is provided. Fault log 302 contains multiple log lines, with log record 304 being used as an example for detailed description. In log record 304, "9 | 11 / 13 / 2019 | 10:30:01 | Power Unit PSU_Redundant | Fully Redundant," "9" indicates the line number of log record 304 within the current log, "11 / 13 / 2019" and "10:30:01" indicate the timestamps corresponding to log record 304, and "Power Unit PSU_Redundant | Fully Redundant" indicates the status of the power supply unit (PSU), indicating that the power supply is fully redundant, with multiple power supplies, to improve system reliability and fault tolerance. Furthermore, as shown in log record line 5 of fault log 302, "11 / 13 / 2019 | 10:29:53 | System FirmwareError SYS_FW_Progress | No system memory installed | Asserted" is displayed. Among them, "System Firmware Error" indicates that the current log record is specifically an error record. Furthermore, the record "No system memory installed" indicates that the specific record content is "no system memory is installed."

[0059] It should be noted that Figure 3 The fault log shown is only an example. The specific recording form and content of the fault log are not limited in the implementation of this application.

[0060] In obtaining Figure 3 In the case of the current fault log shown, the word segmentation result of the current fault log can be obtained according to the above step S204, and multiple index information can be obtained according to the multiple key object word segmentations included in the word segmentation result.

[0061] It should be noted that in S204 above, the acquired fault log may be subjected to word segmentation. The word segmentation process may be the process of breaking down text into individual words or phrases. Key object word segmentation can be used to indicate specific words or phrases in log analysis, such as specific error codes, service names, or operation types.

[0062] In an optional embodiment, each of the multiple key object segmentations may correspond to an index information. In the above embodiment of the present application, the index information may include at least one log identifier for indicating a historical fault log. Then, as in step S206 above, the index information may be used to search for relevant log entries in the historical data, and determine a historical log set that matches the segmentation result based on the acquired historical fault logs.

[0063] It should be noted that in the above embodiment of the present application, the above index information can be used to indicate a mapping relationship between a key object segmentation and a log identifier. The above mapping relationship can include at least one of the following:

[0064] Mapping relationship 1: When the historical fault log includes a key object segmentation, the log identifier of the historical fault log is added to the index information of the key object segmentation;

[0065] It can be understood that in the above mapping relationship 1, the mapping relationship between the historical fault log and the key object segmentation can be specifically a containment and contained relationship;

[0066] Mapping relationship 2: Classify multiple historical fault logs to obtain multiple historical fault log sets; extract the cluster description information corresponding to each of the multiple historical fault log sets; establish a mapping relationship between the key object segmentation included in the cluster description information and the historical fault logs in the corresponding historical fault log set, and add the log identifier of the historical fault log with the mapping relationship to the index information of the above-mentioned key object segmentation.

[0067] It can be understood that, in the above-mentioned second mapping relationship, the mapping relationship between the historical fault log and the key object segmentation can be specifically a corresponding relationship after cluster analysis.

[0068] The relationship between the two key object segmentations and the historical fault logs in the above-mentioned embodiments of the present application is merely an example, and the present application does not limit the type of mapping relationship included in the specific embodiments.

[0069] After obtaining the above historical log set, the target log matching the system failure event may be determined according to the above S208.

[0070] Optionally, the target log may be one of the historical log sets; in another optional embodiment, the target log may be a log content determined based on the analysis results of multiple historical fault logs in the historical log set. The above analysis results may be determined by a clustering operation, or the log content may be determined based on a generative neural network model. For example, the historical log set may be input into a generative neural network model, and based on the question "Please perform cluster analysis on the provided log text and output the analysis results", the output result of the generative neural network model may be determined as the target log.

[0071] By using the historical log collection determined by the above-mentioned implementation method of this application, it is possible to identify the target log that best matches the current system failure event. By obtaining the content contained in the above-mentioned target log, key information for resolving the current failure, such as the cause of the failure, the scope of impact, and solutions or preventive measures, can be obtained. By comparing the current failure log with the historical logs, the system can more accurately diagnose the problem and propose appropriate treatment strategies.

[0072] Through the above-mentioned implementation of the present application, the current fault log that matches the system fault event can be first obtained, and then the word segmentation result of the current fault log can be obtained, and multiple index information can be obtained based on the word segmentation of multiple key objects included in the word segmentation result; when the multiple index information respectively include at least one log identifier, the historical log set that matches the word segmentation result is determined based on the historical fault logs indicated by the log identifiers included in each of the multiple index information; the target log that matches the system fault event is determined based on the historical log set, and then the current fault log and the historical fault log are analyzed and compared in an automated manner to improve the efficiency and accuracy of fault diagnosis. This method can significantly reduce the time and labor intensity of manual log analysis, while improving the speed and quality of fault handling.

[0073] It is understandable that in the event of a system failure event, if the full log related to the system failure event is obtained, since the full log contains not only the content of the current failure log, but also a large amount of content information unrelated to the current failure, it is necessary to accurately extract the log content related to the current failure.

[0074] Therefore, in an optional implementation, before the above step S202, obtaining the word segmentation result of the current fault log, further includes:

[0075] S1, obtaining a first log corresponding to a current fault time node, wherein a timestamp corresponding to log content included in the first log is within a first time period before the current fault time node;

[0076] S2. Obtain a current fault log of a second duration from the first log, where the second duration is less than or equal to the first duration.

[0077] It can be understood that the above-mentioned full log can be a first log corresponding to the current fault time node; then, the current fault log can be obtained from the first log through the above-mentioned step S2, and the second time length corresponding to the current fault log is shorter than the first time length of the first log, thereby effectively reducing the log content and improving the efficiency of log analysis.

[0078] The following further describes a method for obtaining the current fault log. In an optional embodiment, obtaining the current fault log of the second duration from the first log includes:

[0079] S1, determining the timestamp corresponding to the last log content in the first log as the reference timestamp;

[0080] S2. Based on the reference timestamp and the reference duration, obtain the current fault log of the second duration from the first log, wherein the reference duration is less than or equal to the first duration and greater than or equal to the second duration, the time difference between the current timestamp and the reference timestamp corresponding to the log content included in the current fault log is less than or equal to the reference duration, and the number of log contents included in the current fault log is less than or equal to the target number.

[0081] It should be noted that in the above-mentioned embodiment of the present application, the last log content of the first log can be used as a benchmark to determine the reference log of the reference length from back to front, that is, a method for filtering the content in the first log based on the length; then, based on the above-mentioned target number as the second filtering criterion for the log content, the current fault log whose length and the number of log contents meet the standards are filtered out.

[0082] It is understandable that, based on the principle of fault log generation, it is easy for the same fault content to appear repeatedly. Therefore, the number of log contents can be used as a further screening condition to extract the current fault log from the full log.

[0083] The specific process of obtaining the current fault log is further described below. In an optional embodiment, the above-mentioned method of obtaining the current fault log of the second duration from the first log based on the reference timestamp and the reference duration includes:

[0084] S1: Add the last log content in the first log to the current fault log, and obtain one log content in reverse order of the timestamp corresponding to the log content in the first log as the candidate log content;

[0085] S2, when the time difference between the timestamp corresponding to the candidate log content and the reference timestamp corresponding to the last log content is less than or equal to the reference duration, and the number of log contents included in the current fault log is less than or equal to the target number, the candidate log content is added to the current fault log.

[0086] It is understandable that in the above embodiment of the present application, a candidate log can be created, and the log contents in the first log that meet the screening conditions can be added to the candidate log one by one, thereby completing the screening and determining of the current fault log from the first log. Figure 4 A specific process is described.

[0087] S402, obtain full logs;

[0088] In step S402, the last line of the log is extracted from the full log as the starting point. The full log contains all log information generated during the system operation.

[0089] S404, reading the last line of logs. It is understandable that the last line of logs is extracted from the full logs, which usually contains the latest system operation status information.

[0090] Execute S406 to determine whether the first line of the fault log exists. If so, execute S408 to read the last line of the log. Otherwise, obtain the last line of the log and execute S416 to write the log.

[0091] After executing S408, it is determined whether the time interval is less than the target time threshold in S410. That is, it is determined whether the timestamp of the last log line currently obtained is less than the time threshold. If so, it is determined whether the number of fault log entries is less than the quantity threshold in S412. That is, it is determined whether the number of log entries written in the fault log is less than the quantity threshold. If so, it is determined whether the last log line is obtained and S416 is executed to write the fault log.

[0092] It is understood that if the judgment results of S410 and S412 above are negative, the subsequent process is terminated and the fault log is determined as the current fault log. After executing step S416, the process continues to determine whether the number of fault log entries is less than the quantity threshold in S418. If the judgment is positive, the last line of the full log is obtained and the above process is repeated. If the judgment is negative, the process ends and the current fault log is determined.

[0093] The above time threshold and content threshold are further explained below.

[0094] Because servers are relatively complex hardware systems composed of a set of components, such as the CPU, memory, hard drive, network card, and RAID card, direct server failures are often not the root cause. For example, a server downtime caused by a CPU failure could be caused by hard drive damage, memory read / write errors, or even bus data transmission errors. These errors occur linearly over time, so a time window is required to fully extract log content that may be related to the failure. For example, the time window can be set to S seconds, and logs with a time interval of no more than S seconds are considered to be related to the failure.

[0095] For the content threshold, based on the time window, we can further limit the maximum number of lines of log extraction. Based on experience, after some errors occur, error logs will be printed in an endless loop. These endlessly looping error logs have repetitive content and cannot provide key information for retrieval. Therefore, when extracting fault content, we need to set a maximum threshold. When extracting fault logs, based on the time window, if the logs exceed this threshold, they should be discarded. This threshold is set to N.

[0096] Furthermore, based on the above-mentioned screening operation of time threshold and content threshold, Figure 4 The illustrated implementation provides a fault log extraction solution. By combining a time window (interval S) and a content threshold (fault log entry threshold N), it accurately extracts log content related to a specific fault event from the full log. This approach significantly improves the accuracy and efficiency of fault diagnosis, reduces interference from irrelevant logs, and enables faster problem location and resolution.

[0097] After the current fault log matching the system fault event is obtained through the above implementation, the method for determining the word segmentation result in the above step S204 is further described below.

[0098] In an optional implementation, the above-mentioned obtaining of the word segmentation result of the current fault log includes:

[0099] S1, segmenting the current fault log content in the current fault log according to the target identifier included in the current fault log to obtain a first object segmentation set;

[0100] S2, performing a segmentation deduplication operation on the first object segmentation set to obtain the second object segmentation;

[0101] S3, performing a screening operation on the second object segmentation according to the reference word library to obtain a segmentation result of the current fault log.

[0102] It is understandable that the above embodiment can further segment the current fault log extracted in the previous step to determine multiple key object segmentations. Through the above embodiment, effective key object segmentations can be determined, and then accurate index information can be determined.

[0103] Specifically, step S1 of the above formula can adopt a word and space combination segmentation method, that is, each English word or a specific abbreviated noun is segmented into an independent word. For example, the log content "By System Boot Initiated SYS_Restart" can be segmented into four words "By, System, Boot, Initiated, SYS_Restart".

[0104] Furthermore, all English characters in the current fault log may be converted to lowercase. For example, the segmentation result "By, System, Boot, Initiated, SYS_Restart" may be converted to "by, system, boot, initiated, sys_restart".

[0105] Furthermore, irrelevant particles such as by, a, is, etc. can be removed. For example, the above example can be further converted into "system, boot, initiated, sys_restart". The four participles included in "system, boot, initiated, sys_restart" are then determined as four key object participles.

[0106] Through the above-mentioned implementation of this application, fault logs are converted into structured data through steps such as word segmentation, lowercase conversion, and particle removal, allowing for efficient retrieval and analysis. This approach can significantly improve the accuracy and efficiency of fault diagnosis, reduce the interference of irrelevant information, and thus more quickly locate and resolve problems.

[0107] In the case where the above-mentioned multiple keyword segmentations are obtained, the method of obtaining the index information in the above-mentioned step S204 is further described below.

[0108] In an optional embodiment, the above-mentioned obtaining of multiple index information based on the multiple key object segmentation results includes one of the following:

[0109] Method 1: Perform a search operation in the historical log collection based on multiple key object segmentations in sequence to obtain index information that matches each of the multiple key object segmentations;

[0110] Method 2: Based on multiple key object segmentations, index information matching each of the multiple key object segmentations is obtained from the object segmentation information set, wherein the object segmentation information set is determined based on the preprocessing result of the historical log set.

[0111] It is understandable that in the first method described above, it is possible to directly search based on multiple key object segmentations in the historical log collection, and determine the corresponding index information based on the search results. In the second method described above, it is possible to obtain the index information corresponding to each of the multiple key object segmentations from the object segmentation information collection.

[0112] Specifically, when the log identifier in the index information is used to indicate that the historical fault log includes key object segmentation words, in the above-mentioned method one, the historical log collection can be searched based on the log content based on multiple key object segmentations, and the log identifier of each retrieved historical fault log can be determined as the index information; in the above-mentioned method two, each historical fault log in the historical log collection can be first subjected to segmentation analysis, and the above-mentioned object segmentation information collection can be determined based on the segmentation analysis results.

[0113] The following further describes the method for determining the object segmentation information set. Before determining the object segmentation information set, the historical log set can be determined in the following manner.

[0114] In an optional implementation, before obtaining the word segmentation result of the current fault log, the following step is further included:

[0115] S1, obtaining first logs corresponding to multiple historical failure time nodes within a target period, wherein the timestamps corresponding to the log contents included in the first logs are within a first time period before the historical failure time nodes;

[0116] S2: Obtain historical fault logs from first logs corresponding to multiple historical fault time nodes, respectively, wherein the second duration corresponding to the historical fault logs is less than or equal to the first duration.

[0117] It is understandable that in the above embodiment of the present application, the method of determining multiple historical fault logs according to multiple fault history time nodes can be based on Figure 4 In the manner shown, the full log corresponding to each historical fault time node is processed to obtain historical fault logs corresponding to multiple historical fault time nodes, and then the multiple historical fault logs are determined as a historical log set.

[0118] After obtaining the historical fault log set, the object segmentation information set can be further determined in the following manner. In an optional embodiment, the above-mentioned method based on multiple key object segmentations, before obtaining the index information matching each of the multiple key object segmentations from the object segmentation information set, further includes:

[0119] S1, determining an object segmentation set based on multiple historical fault logs included in the historical log set;

[0120] S2, sequentially determining index information corresponding to each historical fault segmentation in the object segmentation information set, wherein the information includes at least one information item, and the information item includes a log identifier, frequency information, and location information.

[0121] It should be noted that the above method for determining the object segmentation information set can be to sequentially segment multiple historical fault logs in the historical log set according to the method described in the aforementioned embodiment, extract key object segmentation processing, and then aggregate the multiple key object segmentations corresponding to each historical fault log, remove duplicates, and thus obtain the above object segmentation information set.

[0122] Next, for each key object segmentation in the above object segmentation information set, the corresponding index information can be determined based on the log identifier of the corresponding historical fault log. In the above embodiment, the above index information further includes frequency information and location information, wherein the frequency information included in the index information is used to indicate the frequency of occurrence of the key object segmentation in the historical fault log.

[0123] The following combination Figure 5 A specific object segmentation information set is described. Figure 5 The object segmentation information set shown includes object segmentation set 502 and index information corresponding to each object segmentation in object segmentation set 502. Index information 504 corresponding to the object segmentation "system" includes a first information item "1, 3, M" and a second information item "2, 4, F." The first information item "1, 3, M" indicates that the object segmentation "system" appeared three times in the historical fault log identified as "1," primarily concentrated in the middle of the log; the second information item "2, 4, F" indicates that the object segmentation "system" appeared four times in the historical fault log identified as "2," primarily concentrated in the front of the log.

[0124] Correspondingly, in the index information 506 corresponding to the object participle "boot", it includes the first information item "1, 3, M" and the second information item "4, 5, B". The first information item "1, 3, M" indicates that the object participle "boot" appeared 3 times in the historical fault log identified as "1", and is mainly concentrated in the middle position of the log; the second information item "4, 5, B" indicates that the object participle "boot" appeared 5 times in the historical fault log identified as "4", and is mainly concentrated in the tail position of the log.

[0125] It is understandable that when the object segmentation information set is determined through the above implementation, the object segmentation information set can be searched based on multiple key object segmentations of the current fault log to obtain index information corresponding to each of the multiple key object segmentations.

[0126] The following describes a further implementation of the above step S208 of collecting historical logs to determine a target log that matches the system failure event.

[0127] In an optional embodiment, the above step S208, determining the target log that matches the system failure event based on the historical log set, includes: determining the target log that matches the system failure event from the historical log set based on frequency information corresponding to each of the multiple log identifiers.

[0128] It is understandable that in the embodiments of the present application, a target log that matches the word segmentation result can be determined from the historical log set based on the frequency information corresponding to each of the multiple log identifiers.

[0129] The following are several optional methods for determining target logs. Method 1: Rule-based matching. In this implementation, a set of rules can be defined to match historical logs based on the frequency and word segmentation results of log identifiers. For example, if a log identifier appears frequently in historical logs and is highly correlated with the word segmentation results of the current fault, then that log can be selected as the target log.

[0130] The second approach is to use machine learning. For example, machine learning algorithms (such as classification algorithms) can be used to automatically learn and identify log patterns associated with specific faults. Historical log data is used to train the model, and the learned patterns are used to predict and match new fault logs.

[0131] Method three involves using natural language processing (NLP) technology. For example, NLP can be used to understand and analyze log text content, extract key information, and compare it with historical logs. NLP can help identify semantic patterns in logs, enabling more accurate matching of related logs.

[0132] It is understood that the above embodiments can be used alone or in combination to improve the accuracy and efficiency of identifying target logs from a collection of historical logs. In this way, system failures can be diagnosed and resolved more quickly, reducing system downtime and maintenance costs.

[0133] In an optional embodiment, determining the historical log set that matches the word segmentation result based on the historical fault logs indicated by the log identifiers included in each of the multiple index information includes: executing the following steps until traversing the index information that matches each of the multiple key object word segments:

[0134] S1, when current index information is obtained from multiple index information, obtaining at least one log identifier included in the current index information;

[0135] S2, adding at least one historical fault log indicated by at least one log identifier to a first historical log subset matching the current index information;

[0136] S3: When traversing the index information that matches each of the multiple key object segmentations is completed, determine a historical log set according to the first historical log subsets that match each of the multiple index information.

[0137] like Figure 5 In the example, assuming that the current fault log contains multiple key object words "system" and "boot", the index information obtained includes Figure 5 The index information 504 and the index information 506 in the data file are traversed. The first historical log subset "1" and "2" are determined based on the index information 504, and the second historical log subset "1" and "4" are determined based on the index information 506. The historical fault logs indicated by "1", "2", and "4" are then determined as the determined historical log set.

[0138] In an optional embodiment, when the above traversal of the index information that matches each of the multiple key object segmentations is completed, determining the historical log set according to the first historical log subset that matches each of the multiple index information includes:

[0139] S1, traversing historical fault logs respectively included in a plurality of first historical log subsets, and sequentially obtaining first frequencies corresponding to the plurality of historical fault logs, wherein the first frequencies indicate the number of repetitions of the historical fault log in the plurality of first historical log subsets;

[0140] S2. According to the first frequencies corresponding to each of the multiple historical fault logs, determine the multiple second historical log subsets included in the historical log set according to the multiple historical fault logs, wherein the second historical log subset includes multiple second historical fault logs, and the first frequencies corresponding to the multiple second historical fault logs are the same.

[0141] It should be noted that in the implementation manner of the present application, when multiple first historical log subsets are obtained, the multiple historical fault logs included in the multiple first historical log subsets can be further divided according to the first frequency according to the corresponding occurrence frequency of the historical fault logs included in the multiple first historical log subsets to obtain multiple second historical log subsets.

[0142] In a specific embodiment, the first frequency may refer to the number of key object segmentations included in the historical fault logs. That is, the number of key object segmentations included in the historical log subsets in the second historical log subset after re-division is the same.

[0143] For example, if the segmentation results of the current fault log include 10 key object segmentations, the historical fault logs can be stratified based on the frequency of the key object segmentations in the historical fault logs. For example, in the first second historical log subset, each historical fault log includes 10 key object segmentations; in the second second historical log subset, each historical fault log includes 9 key object segmentations; in the third second historical log subset, each historical fault log includes 8 key object segmentations, and so on.

[0144] When multiple second historical log subsets are divided according to the above embodiment, the target log can be determined based on the multiple second historical log subsets. For example, since the historical fault logs in the first second historical log subset all include all key object segmentations, the target log can be determined preferentially from the first second historical log subset.

[0145] In an optional embodiment, the above-mentioned determining a target log matching the word segmentation result from the historical log set based on the frequency information corresponding to each of the multiple log identifiers includes one of the following:

[0146] Method 1: Obtain log similarities between the current fault log and multiple historical fault logs in the historical log set; determine similarity weights corresponding to the multiple log similarities based on frequency information corresponding to the multiple log identifiers; and determine a target log that matches the word segmentation result from the historical log set based on the log similarities and similarity weights corresponding to the multiple historical fault logs.

[0147] In the first method described above, the log similarity between the current fault log and multiple historical fault logs in the historical log set can be obtained. Then, based on the log similarity and the corresponding frequency information, an updated similarity weight is determined. The target log is then determined based on the similarity weight.

[0148] It is understood that in the embodiments of the present application, log similarity and frequency information can be used as two factors to determine the similarity weight. For example, the product of log similarity and the number of frequencies indicated in the frequency information can be determined as the similarity weight.

[0149] The following specifically describes a method for obtaining log similarities between a current fault log and multiple historical fault logs in a historical log set.

[0150] First, the current fault log is segmented and converted into a set of keywords or phrases. Then, the same segmentation and preprocessing is performed on each log entry in the historical log set.

[0151] Then, a text similarity algorithm (such as cosine similarity, Jaccard similarity, etc.) can be used to calculate the similarity between the current fault log and each log in the historical log set.

[0152] Next, the frequency weight is determined based on the frequency information indicated in the index information. The higher the frequency, the greater the frequency weight.

[0153] Finally, the similarity of each historical log can be multiplied by its corresponding frequency weight to obtain the weighted similarity. The log with the highest weighted similarity is selected from the historical log set as the target log.

[0154] Method 2: Obtain multiple second historical log subsets from the historical log set, and determine at least one candidate log from each of the multiple second historical log subsets based on the frequency information corresponding to each of the multiple log identifiers; determine the target log from the at least one candidate log, wherein the second historical log subset includes multiple second historical fault logs, and the first frequencies corresponding to the multiple second historical fault logs are the same, and the first frequency is determined based on the number of repetitions of the log identifier in the multiple index information.

[0155] In the second method described above, for example, if the segmentation results of the current fault log include 10 key object segmentations, the historical fault logs can be stratified based on the frequency of the key object segmentations in the historical fault logs. For example, in the first second historical log subset, each historical fault log includes 10 key object segmentations; in the second second historical log subset, each historical fault log includes 9 key object segmentations; in the third second historical log subset, each historical fault log includes 8 key object segmentations, and so on.

[0156] In the case where multiple second historical log subsets are divided according to the above embodiment, the target log can be determined based on the multiple second historical log subsets. For example, since the historical fault logs in the first second historical log subset include all key object segmentations, the target log can be determined preferentially from the first second historical log subset. Specifically, the frequency weights of the various historical fault logs in the first second historical log subset can be determined in sequence based on the frequency information included in the above index information, and the target log can be determined from the first second historical log subset based on the frequency weights.

[0157] The following describes a specific method for determining the target log. In an optional embodiment, the above-mentioned method of determining at least one candidate log from the plurality of second historical log subsets includes:

[0158] S1, obtaining a current fault log subset from a plurality of second historical log subsets, and a set of object segmentations matching the current fault log subset, wherein the current object segmentation in the object segmentation set is a key object segmentation included in at least one historical fault log in the current fault log subset;

[0159] S2, determining a first coefficient that matches the current fault log subset based on the object segmentation set, wherein the first coefficient is determined by the second frequency corresponding to each of the multiple current object segmentations in the object segmentation set, and the second frequency is the number of repetitions of the current object segmentation in the second historical log subset;

[0160] S3, respectively determining a second coefficient corresponding to at least one historical fault log in the current fault log subset, wherein the second coefficient is determined by at least one current object segmentation included in the historical fault log and the number of repetitions of the at least one current object segmentation in the historical fault log;

[0161] S4, determining a target weight corresponding to each of the at least one historical fault logs according to a ratio between the second coefficient and the first coefficient corresponding to each of the at least one historical fault logs;

[0162] S5. Determine at least one candidate log from the current fault log subset based on the sorting result of the target weight corresponding to each of the at least one historical fault logs, wherein the sorting result of the target weight corresponding to the candidate log is greater than or equal to the target order.

[0163] Specifically, for example Figure 6 As shown, the current fault log extracted in the above implementation manner is segmented, and it is assumed that the number of segmented words (ie, key object segmented words) obtained after segmentation is N.

[0164] Then, if Figure 6 In the example, the object segmentation information set can be matched based on the index information of each segmentation (i.e., the key object segmentation), and the matching is performed according to the matching degree N, N-1, N-2, ..., 1. These represent the fault log containing all N words, the fault log containing N-1 words, the fault log containing N-2 words (i.e., multiple second historical log subsets are obtained), and so on.

[0165] exist Figure 6 In , for historical fault logs at each level, the fault log containing N words ranks higher than the fault log containing N-1 words, that is, N>N-1>N-2>…>1.

[0166] In the same layer, if there are M fault logs containing N words at the same time, the sorting algorithm between them is as follows. The first fault log is recorded as L1, the second fault log is recorded as L2, and the Mth fault log records L M ;

[0167] In the first fault log, the number of the first search term is recorded as L1W1, so the total number of times N terms appear in M ​​logs is: TW = L1W1 + L1W2 + ... + L1W N +…+L M W1+…+L M W N (i.e. the first coefficient).

[0168] Furthermore, the sorting weight of each fault log is: W=(L x W1+L x W2+…+L X W N ) / TW. Among them, L x W1+L x W2+…+L X W N That is a specific second coefficient.

[0169] The target logs can be determined based on the sorting weights as follows: in the same layer, the logs are sorted from largest to smallest by the size of W; finally, based on the stratification, different layers and the sorting results of each layer are displayed, with the higher the matching degree, the higher the ranking.

[0170] In an optional implementation, determining the target log from the at least one candidate log includes one of the following:

[0171] Method 1: Determine a target historical log subset from multiple second historical log subsets, wherein a first frequency corresponding to a historical fault log in the target historical log subset is higher than a first frequency corresponding to a historical fault log included in other second historical log subsets in the multiple second historical log subsets; determine a target log from at least one candidate log in the target historical log subset;

[0172] In the above-mentioned method 1, the historical fault log with the highest ranking among the multiple historical fault logs at the highest level may be determined as the target log;

[0173] Method 2: Determine a reference weight corresponding to at least one candidate log based on the first frequencies corresponding to each of the multiple second historical log subsets, wherein the reference weight is positively correlated with the first frequency; determine a target log from at least one candidate log based on the reference weight and target weight corresponding to each of the at least one candidate log, wherein the target weight is determined based on the number of repetitions of the key object segmentation included in the second historical log subset.

[0174] In the above-mentioned method 2, after determining the sorting weight of each fault log based on the above-mentioned method, you can further configure the hierarchical weight for each level; then further determine the target weight based on the sorting weight and hierarchical weight of each fault log, and then determine the target log based on the sorting result of the target weight.

[0175] In an optional implementation, determining the target log from at least one candidate log includes:

[0176] S1, determining a location weight assigned to at least one candidate log according to distribution location information corresponding to each of the at least one candidate log;

[0177] S2, determining a matching degree corresponding to each of the at least one candidate log according to a reference weight, a target weight, and a position weight corresponding to each of the at least one candidate log;

[0178] S3, determine the candidate log with the highest matching degree as the target log.

[0179] It is understandable that in the implementation manner of the present application, reference weight information can be further determined based on the position information carried in the index information of each key object segmentation, and then the target log can be determined by combining the reference weight, target weight and position weight.

[0180] Specifically, in Figure 6 In , for historical fault logs at each level, the fault log containing N words ranks higher than the fault log containing N-1 words, that is, N>N-1>N-2>…>1.

[0181] In the same layer, if there are M fault logs containing N words at the same time, the sorting algorithm between them is as follows. The first fault log is recorded as L1, the second fault log is recorded as L2, and the Mth fault log records L M ;

[0182] In the first fault log, the number of the first search term is recorded as L1W1, so the total number of times N terms appear in M ​​logs is: TW = L1W1 + L1W2 + ... + L1W N +…+L M W1+…+L M W N (i.e. the first coefficient).

[0183] Furthermore, the sorting weight of each fault log is: W=(L x W1+L x W2+…+L X W N ) / TW. Among them, L x W1+L x W2+…+L X W N That is a specific second coefficient.

[0184] Furthermore, a reference weight determined based on the location information of each fault log can be obtained, and the ranking weight can be updated based on the reference weight to obtain an updated ranking weight. In a specific embodiment, the distribution of the location information included in the multiple index information corresponding to a historical fault log can be counted separately, and the location weight can be determined based on the information indicating the distribution, wherein the weight value of the location weight can be proportional to the distribution concentration of the location information included in the multiple index information.

[0185] Then, in the same layer, the updated sorting weight W is used to sort from large to small; finally, based on the stratification, different layers and the sorting results of each layer are displayed, and the closer to the front, the higher the matching degree.

[0186] In an optional embodiment, after determining the target log that matches the word segmentation result from the historical log set based on the frequency information corresponding to each of the multiple log identifiers, the method further includes:

[0187] S1, obtaining processing description information matching the target log, wherein the processing description information includes at least one of the following: server model information, fault type information, fault cause information, and fault handling solution;

[0188] S2: Process the fault object indicated by the current fault log according to the processing description information.

[0189] In the implementation of the present application, during the server operation and maintenance process, after handling hardware failures, the operation and maintenance engineers will gradually accumulate a number of typical failure cases. These failure cases need to include failure logs and case handling details, such as machine model, failure classification, failure cause, and solution. These contents are stored in a standardized format to establish a standard failure case library, so that similar cases can be quickly matched based on new failure logs in the future, providing failure case references for the operation and maintenance engineers. Then, when the target log is obtained, the relevant processing description information corresponding to the target log is further obtained, and the fault object in the system failure event is processed according to the processing method indicated by the processing description information.

[0190] For example Figure 7 As shown, a fault case library can be built in advance, which mainly includes three parts: complete log, fault log, and case details. The case library structure is shown in the attached Figure 7 As shown. The complete log is the collected full server log content. The fault log format can be as follows Figure 3 As shown. Figure 7 In the case details, there are five elements: server model, fault type (memory, CPU, hard disk, network card...), fault cause analysis, and fault solution.

[0191] Through the above implementation of the present application, first, a fault case library can be constructed according to the above implementation, so that the historical operation and maintenance cases of the operation and maintenance engineers can be stored in a unified and standardized structure, and the standardization of data facilitates subsequent extraction and retrieval; then, in the process of fault index construction, through word segmentation and index construction algorithms, it is possible to perform fast and accurate matching retrieval in a large number of logs; finally, through Figure 6 The fault retrieval algorithm shown can ensure that fault logs with high matching degrees are ranked higher through word segmentation and the same-layer weight sorting algorithm, that is, the higher the similarity with the search content, the more detailed case information can be extracted based on the structure in the case library for user reference.

[0192] The following describes a server fault rapid location system based on fault case library data involved in an embodiment of the present application.

[0193] In the implementation manner of the present application, the server fault rapid location system involved includes five modules, namely a standard case library, a fault log extraction device, a word segmentation device, a retrieval index construction device, and a retrieval matching and sorting device.

[0194] The standard case library is a database maintained and updated in real time based on historical fault logs. During server maintenance, after resolving hardware failures, maintenance engineers will gradually accumulate a collection of typical failure cases. These failure cases must include the failure log and case handling details, such as the machine model, failure classification, cause, and solution. This information is stored in a standardized format to establish a standard failure case library. This allows for rapid matching of similar cases based on new failure logs, providing maintenance engineers with reference cases.

[0195] The above-mentioned fault log extraction device is used to extract fault logs. Operation and maintenance engineers collect server logs after a server failure occurs, but the server operation logs are often logs within a certain period, and most of the log content is not related to the current failure. There is a need for a solution to extract logs that are highly relevant to the current server failure and remove log content that is less relevant to the current server failure. Specifically, it can be used Figure 4 In the manner shown, historical fault logs are extracted, as well as current fault logs.

[0196] The above-mentioned word segmentation device is used to determine multiple key object word segments that match the current fault log. Word segmentation is the foundation for establishing a search index and retrieval. The construction of the query index and the processing of query questions are all based on the word segmentation device. The word segmentation device divides the extracted current fault log or historical fault log into individual keywords and eliminates irrelevant auxiliary words such as time, a, and by that are not helpful for retrieval. Reasonable word segmentation is the foundation for the subsequent construction of the search index.

[0197] The retrieval index construction device is used to obtain index information. Based on the word segmentation results in the above embodiment, a retrieval index is constructed. The retrieval index is a key element for quickly searching for similar cases. The structure of the index device mainly includes a keyword list, a list of key logs corresponding to each keyword, the number of occurrences N, and the position P of the occurrence. The number of occurrences N and the position P of the occurrence can be used to calculate the relevance ranking of the retrieval results.

[0198] Finally, the search, matching, and ranking device is used to identify the target log from multiple historical fault logs. The search content (e.g., the current fault log) is input, and the word segmentation device performs word segmentation on the search content, generating a list of search content segments L. This list is then matched against the index for similarity and weighted sorting, ultimately yielding the search results.

[0199] Through the above-described implementation of this application, during the preprocessing phase, a fault case library can be constructed. The core concept of this fault case library is to systematically and structuredly store and manage historical fault information and corresponding solutions. This case library is built based on the collection, organization, and analysis of a large amount of real-world fault data, covering various component fault types, fault descriptions, fault causes, and corresponding resolution steps.

[0200] Next, a fault index is constructed. In order to achieve efficient and accurate retrieval of the fault case library, the present invention introduces a retrieval index construction algorithm to index the fault case library. The index is used to quickly match the key features in the log with the historical fault cases in the case library, thereby helping the system to efficiently locate cases that match the current fault.

[0201] During the matching phase, log matching can be performed based on a fault retrieval algorithm. When a server failure occurs, the system generates a corresponding log record. Traditional keyword matching and rule engine methods exhibit significant limitations when processing these logs, such as the inability to effectively identify complex log structures and difficulty performing correlation analysis. Therefore, the embodiments of this application improve the efficiency and accuracy of matching fault logs with the case library through an optimized fault retrieval algorithm.

[0202] It should be noted that for the aforementioned method embodiments, for the sake of simplicity, they are all expressed as a series of action combinations, but those skilled in the art should be aware that this application is not limited by the order of the actions described, because according to this application, certain steps can be performed in other orders or simultaneously. Secondly, those skilled in the art should also be aware that the embodiments described in the specification are all preferred embodiments, and the actions and modules involved are not necessarily required by this application.

[0203] According to another aspect of the embodiment of the present application, a data processing device in memory for implementing the above-mentioned fault log matching method is also provided. Figure 8 As shown, the device includes:

[0204] A first acquiring unit 802 is configured to acquire a current fault log that matches a system fault event;

[0205] The second acquisition unit 804 is configured to acquire a word segmentation result of the current fault log, wherein the word segmentation result includes at least one key object word segmentation, and acquire at least one index information based on the key object word segmentation; wherein the index information includes a log identifier;

[0206] A first determining unit 806 is configured to determine, according to the log identifier, a historical fault log that matches the word segmentation result, and determine a historical log set based on the historical fault log;

[0207] The second determining unit 808 is configured to determine a target log matching the system failure event according to the historical log set.

[0208] Optionally, the above-mentioned index information includes at least one of the above-mentioned log identifiers and frequency information corresponding to each of the at least one above-mentioned log identifiers. The above-mentioned log identifiers included in the above-mentioned index information are used to indicate the historical fault log containing the above-mentioned key object segmentation words. The above-mentioned frequency information included in the above-mentioned index information is used to indicate the frequency of occurrence of the above-mentioned key object segmentation words in the above-mentioned historical fault logs. The above-mentioned second acquisition unit 804 is used to: determine the target log that matches the above-mentioned segmentation result from the above-mentioned historical log set based on the above-mentioned frequency information corresponding to each of the multiple above-mentioned log identifiers.

[0209] Optionally, the second acquisition unit 804 is used to: obtain current index information from multiple index information; obtain at least one log identifier included in the current index information; add at least one historical fault log indicated by at least one log identifier to the first historical log subset matching the current index information; and determine the historical log set based on the first historical log subset matching each of the multiple index information.

[0210] Optionally, the second acquisition unit 804 is used to: traverse the historical fault logs included in each of the multiple first historical log subsets, and sequentially acquire the first frequencies corresponding to each of the multiple historical fault logs, wherein the first frequencies indicate the number of repetitions of the historical fault log in the multiple first historical log subsets; determine the multiple second historical log subsets included in the historical log set based on the first frequencies corresponding to each of the multiple historical fault logs, wherein the second historical log subset includes multiple second historical fault logs, and the first frequencies corresponding to the multiple second historical fault logs are the same.

[0211] Optionally, the second acquisition unit 804 is used for one of the following: obtaining the log similarity between the current fault log and each of the multiple historical fault logs in the historical log set; determining the similarity weight corresponding to each of the multiple log similarities based on the frequency information corresponding to each of the multiple log identifiers; determining the target log that matches the word segmentation result from the historical log set based on the log similarities and the similarity weight corresponding to each of the multiple historical fault logs; obtaining multiple second historical log subsets from the historical log set, and determining at least one candidate log from each of the multiple second historical log subsets based on the frequency information corresponding to each of the multiple log identifiers; determining the target log from at least one candidate log, wherein the second historical log subset includes multiple second historical fault logs, and the first frequencies corresponding to the multiple second historical fault logs are the same, and the first frequency is determined based on the number of repetitions of the log identifier in the multiple index information.

[0212] Optionally, the second acquisition unit 804 is used to: acquire a current fault log subset from a plurality of the second historical log subsets, and a set of object segmentations that matches the current fault log subset, wherein the current object segmentation in the object segmentation set is the key object segmentation included in at least one of the historical fault logs in the current fault log subset; determine a first coefficient that matches the current fault log subset based on the object segmentation set, wherein the first coefficient is determined by the second frequency corresponding to each of the plurality of current object segmentations in the object segmentation set, and the second frequency is the number of repetitions of the current object segmentation in the second historical log subset; respectively determine the current fault log subset The second coefficient corresponding to at least one of the above-mentioned historical fault logs is determined, wherein the second coefficient is determined by at least one of the above-mentioned current object participles included in the above-mentioned historical fault logs, and the number of repetitions of at least one of the above-mentioned current object participles in the above-mentioned historical fault logs; the target weight corresponding to at least one of the above-mentioned historical fault logs is determined according to the ratio between the second coefficient corresponding to at least one of the above-mentioned historical fault logs and the first coefficient; at least one of the above-mentioned candidate logs is determined from the above-mentioned current fault log subset according to the sorting result of the above-mentioned target weight corresponding to at least one of the above-mentioned historical fault logs, wherein the sorting result of the above-mentioned target weight corresponding to the above-mentioned candidate log is greater than or equal to the target order.

[0213] Optionally, the second acquisition unit 804 is used for one of the following: determining a target historical log subset from the plurality of second historical log subsets, wherein the first frequency corresponding to the historical fault log in the target historical log subset is higher than the first frequency corresponding to the historical fault log included in other second historical log subsets in the plurality of second historical log subsets; determining the target log from at least one candidate log in the target historical log subset; determining a reference weight corresponding to at least one candidate log based on the first frequencies corresponding to each of the plurality of second historical log subsets, wherein the reference weight is positively correlated with the first frequency; determining the target log from at least one candidate log based on the reference weight and target weight corresponding to each of the candidate logs, wherein the target weight is determined based on the number of repetitions of the key object segmentation included in the second historical log subset.

[0214] Optionally, the above-mentioned index information also includes distribution position information corresponding to at least one of the above-mentioned log identifiers, and the above-mentioned distribution position information is used to indicate the position of the above-mentioned key object segmentation in the above-mentioned historical fault log that matches it. The above-mentioned second acquisition unit 804 is used to: determine the position weight assigned to at least one of the above-mentioned candidate logs based on the above-mentioned distribution position information corresponding to each of the above-mentioned candidate logs; determine the matching degree corresponding to at least one of the above-mentioned candidate logs based on the reference weight corresponding to each of the above-mentioned candidate logs, the above-mentioned target weight and the above-mentioned position weight; and determine the candidate log with the highest matching degree as the above-mentioned target log.

[0215] Optionally, the matching device for the above-mentioned fault log also includes: a word segmentation unit, used to obtain a first log corresponding to the current fault time node, wherein the timestamp corresponding to the log content included in the above-mentioned first log is within a first time length before the above-mentioned current fault time node; and obtain the above-mentioned current fault log of a second time length from the above-mentioned first log, wherein the above-mentioned second time length is less than or equal to the above-mentioned first time length.

[0216] Optionally, the above-mentioned word segmentation unit is used to: determine the timestamp corresponding to the last log content in the above-mentioned first log as a reference timestamp; based on the above-mentioned reference timestamp and reference duration, obtain the above-mentioned current fault log of the second duration from the above-mentioned first log, wherein the above-mentioned reference duration is less than or equal to the above-mentioned first duration, and greater than or equal to the above-mentioned second duration, the time difference between the current timestamp corresponding to the above-mentioned log content included in the above-mentioned current fault log and the above-mentioned reference timestamp is less than or equal to the above-mentioned reference duration, and the number of the above-mentioned log contents included in the above-mentioned current fault log is less than or equal to the target number.

[0217] Optionally, the above-mentioned word segmentation unit is used to: add the last log content in the above-mentioned first log to the above-mentioned current fault log, and obtain one log content in reverse order according to the timestamps corresponding to the above-mentioned log contents in the above-mentioned first log as candidate log content; when the time difference between the timestamp corresponding to the above-mentioned candidate log content and the above-mentioned reference timestamp corresponding to the last log content is less than or equal to the reference duration, and the number of the above-mentioned log contents included in the above-mentioned current fault log is less than or equal to the target number, the above-mentioned candidate log content is added to the above-mentioned current fault log.

[0218] Optionally, the above-mentioned word segmentation unit is used to: segment the current fault log content in the above-mentioned current fault log according to the target identifier included in the above-mentioned current fault log to obtain a first object word segmentation set; perform a word segmentation deduplication operation on the above-mentioned first object word segmentation set to obtain a second object word segmentation; perform a screening operation on the above-mentioned second object word segmentation according to a reference vocabulary to obtain the above-mentioned word segmentation result of the above-mentioned current fault log.

[0219] Optionally, the second acquisition unit 804 is used for one of the following: performing a retrieval operation in the historical log collection according to the multiple key object segmentations in sequence to obtain index information that matches each of the multiple key object segmentations; based on the multiple key object segmentations, obtaining index information that matches each of the multiple key object segmentations from the object segmentation information collection, wherein the object segmentation information collection is determined based on the preprocessing results of the historical log collection.

[0220] Optionally, the matching device for the above-mentioned fault logs also includes: a log processing unit, used to obtain a first log corresponding to each of multiple historical fault time nodes within a target period, wherein the timestamp corresponding to the log content included in the above-mentioned first log is within a first time length before the above-mentioned historical fault time node; and obtain historical fault logs respectively from the above-mentioned first logs corresponding to each of multiple historical fault time nodes, wherein the second time length corresponding to the above-mentioned historical fault log is less than or equal to the above-mentioned first time length.

[0221] Optionally, the above-mentioned log processing unit is also used to: determine the object segmentation information set based on the multiple historical fault logs included in the above-mentioned historical log set; and determine the index information corresponding to each historical fault segmentation in the above-mentioned object segmentation information set in turn, wherein the above-mentioned information includes at least one information item, and the above-mentioned information item includes the above-mentioned log identifier, the above-mentioned frequency information and the location information.

[0222] Optionally, the above-mentioned log processing unit is also used to: obtain processing description information matching the above-mentioned target log, wherein the above-mentioned processing description information includes at least one of the following: server model information, fault type information, fault cause information, and fault handling solution; and process the fault object indicated by the above-mentioned current fault log according to the above-mentioned processing description information.

[0223] According to another aspect of the embodiment of the present application, an electronic device for implementing the matching method of the fault log in the memory is also provided. The electronic device may be Figure 1 The terminal device or server shown in the figure. This embodiment is described by taking the electronic device as a mobile phone or a computer as an example. Figure 9 As shown, the electronic device includes a memory 902 and a processor 904. The memory 902 stores a computer program, and the processor 904 is configured to execute the steps in any of the above method embodiments through the computer program.

[0224] Optionally, in this embodiment, the electronic device may be located in at least one network device among a plurality of network devices of a computer network.

[0225] Optionally, in this embodiment, the processor may be configured to execute the following steps through a computer program:

[0226] S1, obtain the current fault log that matches the system fault event;

[0227] S2, obtaining the word segmentation result of the current fault log, and obtaining multiple index information according to the multiple key object word segmentations included in the word segmentation result;

[0228] S3, when the plurality of index information respectively include at least one log identifier, determining a set of historical logs that matches the word segmentation result according to the historical fault logs indicated by the log identifiers included in the plurality of index information;

[0229] S4: Determine a target log that matches the system failure event based on the historical log set.

[0230] Alternatively, those skilled in the art will appreciate that Figure 9 The structure shown is for illustration only, and the electronic device may also be a smart phone (such as an Android phone, an iOS phone, etc.), a tablet computer, a PDA, a mobile Internet device (MID), a PAD, or other terminal devices. Figure 9 It does not limit the structure of the above electronic device. For example, the electronic device may also include Figure 9 More or fewer components (such as network interfaces, etc.) as shown in, or with Figure 9 Different configurations shown.

[0231] Among them, the memory 902 can be used to store software programs and modules, such as the program instructions / modules corresponding to the fault log matching method and device in the embodiment of the present application. The processor 904 executes various functional applications and data processing by running the software programs and modules stored in the memory 902, that is, realizing the above-mentioned fault log matching method. The memory 902 may include a high-speed random access memory, and may also include a non-volatile memory, such as one or more magnetic storage devices, flash memory, or other non-volatile solid-state memory. In some instances, the memory 902 may further include a memory remotely located relative to the processor 904, and these remote memories may be connected to the terminal via a network. Examples of the above-mentioned networks include but are not limited to the Internet, corporate intranets, local area networks, mobile communication networks, and combinations thereof. Among them, the memory 902 can be used specifically but not limited to historical fault logs, index information and other information. As an example, if Figure 9 As shown, the memory 902 may include, but is not limited to, the first acquisition unit 802, the second acquisition unit 804, the first determination unit 806, and the second determination unit 808 in the fault log matching device. In addition, it may also include, but is not limited to, other module units in the fault log matching device, which will not be repeated in this example.

[0232] Optionally, the transmission device 906 is configured to receive or transmit data via a network. Specific examples of the aforementioned network may include wired networks and wireless networks. In one embodiment, the transmission device 906 includes a network interface controller (NIC), which can be connected to other network devices and a router via a network cable to enable communication with the Internet or a local area network. In one embodiment, the transmission device 906 is a radio frequency (RF) module configured to communicate with the Internet wirelessly.

[0233] In addition, the electronic device further includes: a display 908 for displaying the target page; and a connection bus 99 for connecting various module components in the electronic device.

[0234] In other embodiments, the terminal device or server may be a node in a distributed system, wherein the distributed system may be a blockchain system, and the blockchain system may be a distributed system formed by connecting multiple nodes via network communication. The nodes may form a point-to-point network, and any computing device, such as a server, terminal, or other electronic device, may become a node in the blockchain system by joining the point-to-point network.

[0235] According to one aspect of the present application, a computer-readable storage medium is provided. A processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the methods provided in the various optional implementations described above.

[0236] Optionally, in this embodiment, the computer-readable storage medium may be configured to store a computer program for performing the following steps:

[0237] S1, obtain the current fault log that matches the system fault event;

[0238] S2, obtaining a word segmentation result of the current fault log, wherein the word segmentation result includes at least one key object word segmentation, and obtaining at least one index information according to the key object word segmentation; wherein the index information includes a log identifier;

[0239] S3: Determine the historical fault log that matches the word segmentation result based on the log identifier, and determine the historical log set based on the historical fault log;

[0240] S4, determining a target log that matches the system failure event based on the historical log set.

[0241] Optionally, in the embodiments of the present application, the term "module" or "unit" refers to a computer program or portion of a computer program that has a predetermined function and works together with other related parts to achieve a predetermined goal. It can be implemented in whole or in part using software, hardware (such as processing circuits or memory), or a combination thereof. Similarly, a processor (or multiple processors or memories) can be used to implement one or more modules or units. In addition, each module or unit can be part of an overall module or unit that includes the functionality of the module or unit.

[0242] Optionally, in this embodiment, a person of ordinary skill in the art may understand that all or part of the steps in the various methods of the above embodiments may be completed by instructing hardware related to the terminal device through a program, and the program may be stored in a computer-readable storage medium, which may include: a flash drive, a read-only memory (ROM), a random access memory (RAM), a magnetic disk or an optical disk, etc.

[0243] If the integrated units in the above embodiments are implemented in the form of software functional units and sold or used as independent products, they can be stored in the above-mentioned computer-readable storage medium. Based on this understanding, the technical solution of the present application, or the part that contributes to the prior art, or all or part of the technical solution can be embodied in the form of a software product. The computer software product is stored in a storage medium and includes a number of instructions for causing one or more computer devices (which may be personal computers, servers, or network devices, etc.) to execute all or part of the steps of the methods of each embodiment of the present application.

[0244] In the above embodiments of the present application, the description of each embodiment has its own focus. For parts that are not described in detail in a certain embodiment, please refer to the relevant description of other embodiments.

[0245] In the several embodiments provided in this application, it should be understood that the disclosed client can be implemented in other ways. The device embodiments described above are merely illustrative. For example, the division of units is merely a logical functional division. In actual implementation, there may be other division methods, such as combining or integrating multiple units or components into another system, or ignoring or not implementing some features. Furthermore, the mutual coupling or direct coupling or communication connection shown or discussed may be through some interface, indirect coupling or communication connection of units or modules, and may be electrical or other forms.

[0246] Units described as separate components may or may not be physically separate, and components shown as units may or may not be physical units, that is, they may be located in one place or distributed across multiple network units. Some or all of these units may be selected to achieve the purpose of this embodiment according to actual needs.

[0247] In addition, the functional units in the various embodiments of the present application may be integrated into a single processing unit, or each unit may exist physically separately, or two or more units may be integrated into a single unit. The aforementioned integrated units may be implemented in the form of hardware or software functional units.

[0248] The above is only a preferred embodiment of the present application. It should be pointed out that for ordinary technicians in this technical field, several improvements and modifications can be made without departing from the principles of the present application. These improvements and modifications should also be regarded as the scope of protection of the present application.

[0249] It should be noted that the above modules can be implemented through software or hardware. For the latter, it can be implemented in the following ways, but not limited to: the above modules are all located in the same processor; or the above modules are located in different processors in any combination.

[0250] An embodiment of the present application further provides a computer-readable storage medium, in which a computer program is stored. The computer program is configured to execute the steps of any of the above method embodiments when run.

[0251] In an exemplary embodiment, the computer-readable storage medium may include, but is not limited to, various media that can store computer programs, such as a USB flash drive, a read-only memory (ROM), a random access memory (RAM), a mobile hard disk, a magnetic disk, or an optical disk.

[0252] An embodiment of the present application further provides an electronic device, comprising a memory and a processor, wherein the memory stores a computer program, and the processor is configured to run the computer program to execute the steps in any one of the above method embodiments.

[0253] In an exemplary embodiment, the electronic device may further include a transmission device and an input / output device, wherein the transmission device is connected to the processor, and the input / output device is connected to the processor.

[0254] An embodiment of the present application further provides a computer program product, which includes a computer program. When the computer program is executed by a processor, the steps in any of the above method embodiments are implemented.

[0255] An embodiment of the present application further provides another computer program product, including a non-volatile computer-readable storage medium, wherein the non-volatile computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the steps of any of the above method embodiments are implemented.

[0256] An embodiment of the present application also provides a computer program, which includes computer instructions, which are stored in a computer-readable storage medium; a processor of a computer device reads the computer instructions from the computer-readable storage medium, and the processor executes the computer instructions, so that the computer device performs the steps of any of the above method embodiments.

[0257] For specific examples in this embodiment, reference may be made to the examples described in the above embodiments and exemplary implementation modes, and this embodiment will not be described in detail here.

[0258] Obviously, those skilled in the art should understand that the modules or steps of the present application described above can be implemented using a general-purpose computing device, they can be concentrated on a single computing device, or distributed across a network composed of multiple computing devices, they can be implemented using program code executable by the computing device, and thus, they can be stored in a storage device and executed by the computing device, and in some cases, the steps shown or described can be performed in a different order than herein, or they can be fabricated into separate integrated circuit modules, or multiple modules or steps can be fabricated into a single integrated circuit module for implementation. Thus, the present application is not limited to any specific combination of hardware and software.

[0259] The above are only preferred embodiments of the present application and are not intended to limit the present application. For those skilled in the art, various modifications and variations of the present application are possible. Any modifications, equivalent substitutions, improvements, etc. made within the principles of the present application shall be included in the scope of protection of the present application.

Claims

1. A fault log matching method, characterized in that: include: Get the current fault log that matches the system fault event; Obtaining a word segmentation result of the current fault log, wherein the word segmentation result includes at least one key object word segmentation, and obtaining at least one index information based on the key object word segmentation; wherein the index information includes at least one log identifier and frequency information corresponding to the at least one log identifier, the log identifier is used to indicate a historical fault log containing the key object word segmentation, the frequency information is used to indicate the frequency of occurrence of the key object word segmentation in the historical fault log, and the key object word segmentation includes an error code, a service name, or an operation type; Determine, according to the log identifier, a historical fault log that matches the word segmentation result, and determine a historical log set based on the historical fault log; According to the frequency information corresponding to at least one of the log identifiers, a target log matching the system failure event is determined from the historical log set.

2. The method according to claim 1, characterized in that The determining, according to the log identifier, a historical fault log that matches the word segmentation result, and determining a historical log set based on the historical fault log includes: Acquire current index information from the plurality of index information; Obtaining at least one log identifier included in the current index information; adding at least one of the historical fault logs indicated by at least one of the log identifiers to a first historical log subset matching the current index information; The historical log set is determined according to the first historical log subsets that are matched by each of the plurality of index information.

3. The method according to claim 2, characterized in that Determining the historical log set according to the first historical log subsets that are matched by each of the plurality of index information includes: Traversing the historical fault logs respectively included in the plurality of first historical log subsets, and sequentially obtaining first frequencies corresponding to the plurality of historical fault logs, wherein the first frequencies indicate the number of repetitions of the historical fault log in the plurality of first historical log subsets; According to the first frequencies corresponding to each of the multiple historical fault logs, multiple second historical log subsets included in the historical log set are determined according to the multiple historical fault logs, wherein the second historical log subset includes multiple second historical fault logs, and the first frequencies corresponding to the multiple second historical fault logs are the same.

4. The method according to claim 1, wherein Determining, from the historical log set, a target log that matches the system failure event based on the frequency information corresponding to at least one of the log identifiers, includes one of the following: Obtaining log similarities between the current fault log and each of the plurality of historical fault logs in the historical log set; determining similarity weights corresponding to each of the plurality of log similarities based on the frequency information corresponding to each of the at least one log identifier; and determining the target log matching the system fault event from the historical log set based on the log similarities and the similarity weights corresponding to each of the plurality of historical fault logs; Acquire multiple second historical log subsets from the historical log set, and determine at least one candidate log from each of the multiple second historical log subsets based on the frequency information corresponding to at least one log identifier; determine the target log from at least one candidate log, wherein the second historical log subset includes multiple second historical fault logs, and the first frequency corresponding to the multiple second historical fault logs is the same, and the first frequency is determined based on the number of repetitions of the log identifier in the multiple index information.

5. The method according to claim 4, characterized in that The determining of at least one candidate log from each of the plurality of second historical log subsets includes: Obtaining a current fault log subset from a plurality of the second historical log subsets, and a set of object segmentations matching the current fault log subset, wherein the current object segmentation in the object segmentation set is the key object segmentation included in at least one of the historical fault logs in the current fault log subset; Determining a first coefficient that matches the current fault log subset from the object segmentation set, wherein the first coefficient is determined based on a second frequency corresponding to each of a plurality of the current object segmentations in the object segmentation set, and the second frequency is the number of repetitions of the current object segmentation in the second historical log subset; Determining a second coefficient corresponding to each of at least one of the historical fault logs in the current fault log subset, wherein the second coefficient is determined based on at least one current object participle included in the historical fault log and the number of repetitions of the at least one current object participle in the historical fault log; determining a target weight corresponding to at least one of the historical fault logs according to a ratio between the second coefficient and the first coefficient corresponding to at least one of the historical fault logs; At least one candidate log is determined from the current fault log subset based on a ranking result of the target weight corresponding to each of the at least one historical fault logs, wherein the ranking result of the target weight corresponding to the candidate log is greater than or equal to a target order.

6. The method according to claim 4, characterized in that Determining the target log from at least one candidate log includes one of the following: Determining a target historical log subset from the plurality of second historical log subsets, wherein the first frequency corresponding to the historical fault log in the target historical log subset is higher than the first frequency corresponding to the historical fault log included in other second historical log subsets within the plurality of second historical log subsets; determining the target log from at least one candidate log in the target historical log subset; Based on the first frequency corresponding to each of the plurality of second historical log subsets, a reference weight corresponding to each of the at least one candidate log is determined, wherein the reference weight is positively correlated with the first frequency; based on the reference weight and target weight corresponding to each of the at least one candidate log, the target log is determined from the at least one candidate log, wherein the target weight is determined based on the number of repetitions of the key object segmentation included in the second historical log subset.

7. The method according to claim 6, characterized in that The index information also includes distribution position information corresponding to at least one of the log identifiers, and the distribution position information is used to indicate the position of the key object segmentation in the historical fault log that matches it. The determining the target log from at least one candidate log includes: Determining a location weight assigned to at least one of the candidate logs according to the distribution location information corresponding to each of the at least one candidate logs; Determining a matching degree corresponding to at least one of the candidate logs according to a reference weight, the target weight, and the position weight corresponding to at least one of the candidate logs; The candidate log with the highest matching degree is determined as the target log.

8. The method according to claim 1, characterized in that Before obtaining the word segmentation result of the current fault log, the method further includes: Obtain a first log corresponding to the current fault time node, wherein a timestamp corresponding to log content included in the first log is within a first time period before the current fault time node; The current fault log of a second duration is obtained from the first log, wherein the second duration is less than or equal to the first duration.

9. The method according to claim 8, characterized in that The obtaining the current fault log of the second duration from the first log includes: Determine the timestamp corresponding to the last log content in the first log as a reference timestamp; Based on the reference timestamp and reference duration, the current fault log of the second duration is obtained from the first log, wherein the reference duration is less than or equal to the first duration and greater than or equal to the second duration, the time difference between the current timestamp corresponding to the log content included in the current fault log and the reference timestamp is less than or equal to the reference duration, and the quantity of the log content included in the current fault log is less than or equal to the target quantity.

10. The method according to claim 9, characterized in that The acquiring, based on the reference timestamp and the reference duration, the current fault log of the second duration from the first log includes: Add the last log content in the first log to the current fault log, and obtain one log content in reverse order of the timestamps corresponding to the log contents in the first log as candidate log content; If the time difference between the timestamp corresponding to the candidate log content and the reference timestamp corresponding to the last log content is less than or equal to the reference duration, and the number of log contents included in the current fault log is less than or equal to the target number, the candidate log content is added to the current fault log.

11. The method according to claim 8, characterized in that The obtaining of the word segmentation result of the current fault log includes: Segmenting the current fault log content in the current fault log according to the target identifier included in the current fault log to obtain a first object segmentation set; Performing a segmentation deduplication operation on the first object segmentation set to obtain a second object segmentation; A filtering operation is performed on the second object segmentation according to a reference word library to obtain the segmentation result of the current fault log.

12. The method according to claim 11, characterized in that The acquiring of at least one index information according to the keyword segmentation includes one of the following: Performing a search operation in the historical log set according to the multiple key object segmentations in sequence to obtain index information that matches each of the multiple key object segmentations; Based on the multiple key object segmentations, index information matching each of the multiple key object segmentations is obtained from an object segmentation information set, wherein the object segmentation information set is determined according to a preprocessing result of the historical log set.

13. The method according to claim 12, characterized in that Before obtaining the word segmentation result of the current fault log, the method further includes: Obtaining first logs corresponding to multiple historical failure time nodes within a target period, wherein the timestamps corresponding to the log contents included in the first logs are within a first time period before the historical failure time nodes; A historical fault log is obtained from each of the first logs corresponding to a plurality of historical fault time nodes, wherein a second duration corresponding to the historical fault log is less than or equal to the first duration.

14. The method according to claim 12, characterized in that Before acquiring index information matching each of the plurality of key object segmentations from the object segmentation information set based on the plurality of key object segmentations, the method further includes: Determining an object segmentation set according to a plurality of historical fault logs included in the historical log set; The index information corresponding to each of the historical fault segmentations in the object segmentation set is determined in sequence, wherein the index information includes at least one information item, and the information item includes the log identifier, the frequency information, and the location information.

15. The method according to claim 9, characterized in that After determining a target log matching the system failure event from the historical log set, the method further includes: Acquire processing description information matching the target log, wherein the processing description information includes at least one of the following: server model information, fault type information, fault cause information, and fault handling solution; The fault object indicated by the current fault log is processed according to the processing description information.

16. A fault log matching device, characterized in that: include: A first acquiring unit, configured to acquire a current fault log matching a system fault event; a second acquisition unit, configured to acquire a word segmentation result of the current fault log, wherein the word segmentation result includes at least one key object word segmentation, and acquire at least one index information based on the key object word segmentation; wherein the index information includes at least one log identifier and frequency information corresponding to the at least one log identifier, wherein the log identifier is used to indicate a historical fault log containing the key object word segmentation, and the frequency information is used to indicate the frequency of occurrence of the key object word segmentation in the historical fault log, wherein the key object word segmentation includes an error code, a service name, or an operation type; a first determining unit, configured to determine, according to the log identifier, a historical fault log that matches the word segmentation result, and determine a historical log set based on the historical fault log; The second determining unit is configured to determine, from the historical log set, a target log that matches the system failure event according to the frequency information corresponding to at least one of the log identifiers.

17. A computer-readable storage medium, characterized in that The computer-readable storage medium stores a computer program, wherein the computer program implements the steps of the method according to any one of claims 1 to 15 when executed by a processor.

18. An electronic device comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, wherein: When the processor executes the computer program, the steps of the method according to any one of claims 1 to 15 are implemented.

19. A computer program product comprising a computer program, characterized in that When the computer program is executed by a processor, the steps of the method according to any one of claims 1 to 15 are implemented.

Images