System anomaly positioning notification method and device, computer device, and storage medium

Abstract

The application belongs to the technical field of computers and relates to a system abnormality positioning notification method and device, computer equipment and a storage medium, the method comprising: acquiring complete log information; acquiring target log information by screening log extraction parameters to perform multi-channel log analysis and integration to obtain a target analysis result; acquiring abnormality characteristic information and abnormality stack information according to the target analysis result, and acquiring code characteristics based on the abnormality characteristic information, accessing a code repository based on the abnormality stack information and the code characteristics to locate abnormality code and its position; acquiring code change history data of the abnormality code to locate developer information before the abnormality occurs, and taking the corresponding developer as a target object; rating the abnormality according to the target analysis result, generating notification information according to the rating, the abnormality code and its position, and sending the notification information to the target object. The application can provide targeted notification and reminders, and improve the efficiency of solving abnormal problems.

Description

Technical Field

[0001] This application belongs to the field of computer technology, and specifically relates to a system anomaly location notification method, device, computer equipment, and storage medium. Background Technology

[0002] For software operation and maintenance tools, system anomaly location and notification management are required to help system administrators and relevant personnel to discover, locate and resolve system anomalies in a timely manner, and ensure the stable and secure operation of the system. The current system anomaly determination relies on parsing system logs, but the log parsing process is simple, has low accuracy, and cannot provide specific anomaly handling for specific objects. Summary of the Invention

[0003] The purpose of this application is to provide a system anomaly location notification method, device, computer equipment, and storage medium to solve the problems in the prior art where the log parsing process is simple, the accuracy is low, and it cannot provide targeted anomaly handling for specific objects.

[0004] To address the aforementioned technical problems, this application provides a system anomaly location notification method, which employs the following technical solution:

[0005] A system anomaly location and notification method, comprising:

[0006] Obtain the log information of the target system, determine the integrity of the log information, and if it is incomplete, obtain it again and temporarily store the complete log information at the target location.

[0007] Obtain log extraction parameters, screen target log information from the target location based on the log extraction parameters, perform multi-channel log parsing on the target log information, integrate the multi-channel parsing results, and obtain the target parsing result;

[0008] Based on the target parsing result, obtain abnormal feature information, obtain code features based on the abnormal feature information, read the abnormal stack information corresponding to the abnormal feature information, and access the code repository based on the abnormal stack information and the code features to locate the abnormal code and its location.

[0009] Obtain the code change history data of the abnormal code, locate the developer information before the abnormality occurred based on the code change history data, and take the corresponding developer as the target object.

[0010] The anomaly is rated based on the target parsing result, and a notification message is generated based on the rating, the anomaly code and its location, and the notification message is sent to the target object.

[0011] Furthermore, the step of performing multi-channel log parsing on the target log information includes:

[0012] A distributed computing framework is used to perform multi-channel parallel parsing on the target log information, extracting log features from the time dimension, spatial dimension, and business dimension to obtain multi-channel parsing results;

[0013] Prior to the step of integrating the multi-channel parsing results, the method further includes:

[0014] The initial multi-channel parsing results are cross-validated with historical anomaly data. A similarity calculation is used to determine if there is a discrepancy. If a discrepancy exists, the target log information is re-parsed, and invalid information in special cases is iteratively excluded until the multi-channel parsing results and the historical anomaly data are indistinguishable, thus obtaining the final multi-channel parsing results.

[0015] Furthermore, prior to the step of sending the notification information to the target object, the method further includes:

[0016] Access the anomaly case database based on the anomaly feature information, search the anomaly case database for a processing solution corresponding to the anomaly feature information, and if a processing solution is found, add the processing solution to the notification information.

[0017] After the step of sending the notification information to the target object, the method further includes: during the process of the target processing handling the exception, recording log information, the location information of the exception occurrence, the source code information that caused the exception, and the corresponding handling method, obtaining a new handling solution, and storing it in the exception case library.

[0018] Furthermore, the step of obtaining log extraction parameters and screening target log information from the target location based on the log extraction parameters includes:

[0019] Based on preset log extraction parameters, the original log information is obtained from the target location. Regular expression matching is used to filter out the log content that matches the log extraction parameters to obtain preliminary target log information.

[0020] The initial target log information is then filtered a second time. By setting keyword weights, the keyword score of each log is calculated. If the score exceeds a set threshold, the log is retained; otherwise, it is discarded to obtain accurate target log information.

[0021] Further, the step of accessing the code repository based on the exception stack information and the code characteristics to locate the exception code and its location includes:

[0022] Access the code repository based on the code characteristics;

[0023] Determine the exception code file name and line number based on the exception stack information, construct exception code location rules based on the exception code file name, and generate exception code query conditions;

[0024] A distributed computing framework is used to perform parallel retrieval of the code repository. The abnormal code query conditions are matched with the code files in the code repository to obtain a list of suspected abnormal code files.

[0025] The list of suspected abnormal code files is filtered a second time. Static code analysis technology is used to extract the features of each file in the list of suspected abnormal code files and calculate the similarity with the abnormal stack information. If the similarity exceeds a set threshold, it is determined to be an abnormal code file.

[0026] Based on the line number, locate the exception code and its specific location in the exception code file, and generate the exception code location result.

[0027] Furthermore, the step of obtaining the code change history data of the abnormal code, locating the developer information before the abnormality occurred based on the code change history data, and targeting the corresponding developers includes:

[0028] The version history data of the code is obtained through the API interface of the code repository. The version history data includes at least the code commit records, developers and commit times.

[0029] Based on the time point of the anomaly, search the iteration history data to locate multiple code commit records before the anomaly occurred;

[0030] Determine whether the interval between the submission time of each code submission record and the time when the exception occurred exceeds a set time threshold. For code submission records with an interval less than the set time threshold, mark them as suspected exception initiation points.

[0031] Obtain information on developers suspected of introducing anomalies, calculate a weighted score for each developer based on their code commit frequency, code commit volume, and historical anomaly rate, and identify developers whose scores exceed a set threshold as target objects.

[0032] Further, the step of rating the anomaly based on the target parsing result, generating notification information based on the rating, the anomaly code, and its location, and sending the notification information to the target object includes:

[0033] Based on the target analysis results, the severity and scope of the anomaly are determined, and a rule engine is used to classify and evaluate the anomaly to obtain the anomaly rating result.

[0034] Based on the anomaly rating results, a preset notification method strategy is matched to determine the appropriate notification channel;

[0035] The key segments of the abnormal code and their location information are extracted, and natural language generation technology is used to automatically construct abnormal notification information.

[0036] The generated exception notification information is matched with the notification channel, and the target object is distributed through the message queue of the notification channel.

[0037] To address the aforementioned technical problems, this application also provides a system anomaly location notification device, which employs the following technical solution:

[0038] A system anomaly location and notification device, the device comprising:

[0039] The log acquisition module is used to acquire log information of the target system, determine the integrity of the log information, and if it is incomplete, acquire it again and temporarily store the complete log information at the target location.

[0040] The log parsing module is used to obtain log extraction parameters, screen target log information from the target location based on the log extraction parameters, perform multi-channel log parsing on the target log information, integrate the multi-channel parsing results, and obtain the target parsing result.

[0041] An anomaly localization module is used to obtain anomaly feature information based on the target parsing result, obtain code features based on the anomaly feature information, read the anomaly stack information corresponding to the anomaly feature information, and access the code repository based on the anomaly stack information and the code features to locate the anomaly code and its location.

[0042] The object determination module is used to obtain the code change history data of the abnormal code, locate the developer information before the abnormality occurred based on the code change history data, and take the corresponding developer as the target object.

[0043] The notification sending module rates the anomaly based on the target parsing result, generates notification information based on the rate, the anomaly code and its location, and sends the notification information to the target object.

[0044] To address the aforementioned technical problems, this application also provides a computer device that employs the following technical solution:

[0045] A computer device includes a memory and a processor, the memory storing computer-readable instructions, wherein the processor, when executing the computer-readable instructions, implements the steps of the system anomaly location notification method as described in any of the preceding claims.

[0046] To address the aforementioned technical problems, this application also provides a computer-readable storage medium, employing the technical solution described below:

[0047] A computer-readable storage medium storing computer-readable instructions, which, when executed by a processor, implement the steps of the system anomaly location notification method as described in any one of the preceding descriptions.

[0048] Compared with the prior art, the embodiments of this application have the following main advantages:

[0049] This application obtains anomaly characteristic information by performing multi-channel parsing on complete log information, then determines the abnormal code based on the anomaly characteristic information, and by obtaining the code change history data of the abnormal code, it is possible to trace the developer information before the anomaly occurred, and provide targeted notifications and reminders, thereby improving the efficiency of anomaly problem resolution and ensuring the convenience of anomaly management. Attached Figure Description

[0050] To more clearly illustrate the solutions in this application, the accompanying drawings used in the description of the embodiments of this application will be briefly introduced below. Obviously, the accompanying drawings described below are some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0051] Figure 1 This is an exemplary system architecture diagram to which this application can be applied;

[0052] Figure 2 A flowchart of one embodiment of the system anomaly location notification method of this application;

[0053] Figure 3 This is a schematic diagram of the structure of one embodiment of the system anomaly location notification device of this application;

[0054] Figure 4 This is a schematic diagram of the structure of one embodiment of the computer device of this application. Detailed Implementation

[0055] Unless otherwise defined, all technical and scientific terms used herein have the same meaning as commonly understood by one of ordinary skill in the art to which this application pertains; the terminology used herein in the specification of the application is for the purpose of describing particular embodiments only and is not intended to be limiting of the application; the terms "comprising" and "having," and any variations thereof, in the specification, claims, and foregoing drawings of this application, are intended to cover non-exclusive inclusion. The terms "first," "second," etc., in the specification, claims, or foregoing drawings of this application are used to distinguish different objects, not to describe a particular order.

[0056] In this document, the term "embodiment" means that a particular feature, structure, or characteristic described in connection with an embodiment may be included in at least one embodiment of this application. The appearance of this phrase in various places throughout the specification does not necessarily refer to the same embodiment, nor is it a separate or alternative embodiment mutually exclusive with other embodiments. It will be explicitly and implicitly understood by those skilled in the art that the embodiments described herein can be combined with other embodiments.

[0057] To enable those skilled in the art to better understand the present application, the technical solutions in the embodiments of the present application will be clearly and completely described below with reference to the accompanying drawings.

[0058] like Figure 1 As shown, system architecture 100 may include terminal device 101, network 102, and server 103. Terminal device 101 may be a laptop 1011, tablet 1012, or mobile phone 1013. Network 102 is used as a medium to provide a communication link between terminal device 101 and server 103. Network 102 may include various connection types, such as wired, wireless communication links, or fiber optic cables.

[0059] Users can use terminal device 101 to interact with server 103 via network 102 to receive or send messages, etc. Various communication client applications, such as web browser applications and instant messaging tools, can be installed on terminal device 101.

[0060] Terminal device 101 can be any electronic device with a display screen and support web browsing. In addition to laptop computer 1011, tablet computer 1012 or mobile phone 1013, terminal device 101 can also be a laptop computer and a desktop computer.

[0061] Server 103 can be a server that provides various services, such as a backend server that provides support for the pages displayed on terminal device 101.

[0062] It should be understood that Figure 1The number of terminal devices 101, network 102, and server 103 shown is merely illustrative. Depending on implementation needs, there can be any number of terminal devices 101, network 102, and server 103.

[0063] Continue to refer to Figure 2 A flowchart of an embodiment of the system anomaly location notification method according to this application is shown. The system anomaly location notification method includes the following steps S201 to S208:

[0064] S201, Obtain the log information of the target system, determine the integrity of the log information, and if it is incomplete, obtain it again and temporarily store the complete log information at the target location.

[0065] S202, obtain log extraction parameters, screen target log information from the target location according to the log extraction parameters, perform multi-channel log parsing on the target log information, integrate the multi-channel parsing results, and obtain the target parsing result;

[0066] S203, obtain abnormal feature information based on the target parsing result, obtain code features based on the abnormal feature information, read the abnormal stack information corresponding to the abnormal feature information, and access the code repository based on the abnormal stack information and the code features to locate the abnormal code and its location.

[0067] S204, obtain the code iteration history data of the abnormal code, locate the developer information before the abnormality occurred based on the code iteration history data, and take the corresponding developer as the target object.

[0068] S205, the anomaly is rated according to the target parsing result, and a notification message is generated according to the rating, the anomaly code and its location, and the notification message is sent to the target object.

[0069] This application obtains anomaly characteristic information by performing multi-channel parsing on complete log information, then determines the abnormal code based on the anomaly characteristic information, and by obtaining the code change history data of the abnormal code, it is possible to trace the developer information before the anomaly occurred, and provide targeted notifications and reminders, thereby improving the efficiency of anomaly problem resolution and ensuring the convenience of anomaly management.

[0070] In step S2O1, the target system generates corresponding runtime logs for all programs during runtime. Based on preset log extraction rules, raw log information can be retrieved from the target system to obtain preliminary log information. The integrity of key information in this preliminary log information is then checked. If incomplete, the raw log information is retrieved again until complete log information is obtained and temporarily stored in a designated target location. Integrity verification of the log information ensures its lossless transmission and storage. For example, raw log information can be retrieved from the target system by extracting log timestamps, filtering out log content that meets extraction parameters to obtain preliminary log information, and checking for continuity and missing values ​​(e.g., timestamps). If incomplete, the information is retrieved again until complete log information is obtained and temporarily stored in caches such as Redis.

[0071] For step S2O2, when obtaining log extraction parameters, the time range, log level, keywords and other filtering conditions of the target log can be obtained through configuration files or user interface input, and the target log information can be obtained from the target location based on these log extraction parameters.

[0072] In one embodiment, the step of obtaining log extraction parameters and screening target log information from the target location based on the log extraction parameters includes:

[0073] Based on preset log extraction parameters, the original log information is obtained from the target location. Regular expression matching is used to filter out log content that matches the log extraction parameters to obtain preliminary target log information. The preliminary target log information is then filtered a second time by setting keyword weights and calculating the keyword score of each log. If the score exceeds a set threshold, the log is retained; otherwise, it is discarded to obtain accurate target log information.

[0074] In this embodiment, methods such as regular expression matching and keyword indexing can be used to extract information from the massive log data at the target location, quickly locate and extract the target log information, and trigger a secondary filtering process based on the extraction results. Specifically, according to preset log extraction parameters, such as keywords "abnormal" and "error", regular expressions are used to match the frequency of keyword occurrences in each log and perform weighted calculations to obtain the keyword score for each log. Logs with scores exceeding a threshold are retained.

[0075] In one embodiment, the step of performing multi-channel log parsing on the target log information includes: using a distributed computing framework to perform multi-channel parallel parsing on the target log information, extracting log features from time, space, and business dimensions to obtain multi-channel parsing results. For example, using the MapReduce distributed computing framework, the logs are parsed in multiple channels with a preset duration as the time window, the server IP address as the spatial dimension, and the business module as the business dimension to extract features such as timestamps, hostnames, and thread IDs.

[0076] Accordingly, before the step of integrating the multi-channel parsing results, the method further includes: cross-validating the initial multi-channel parsing results with historical abnormal data, determining whether there is a discrepancy through similarity calculation, and if there is a discrepancy, re-parseing the target log information, iteratively excluding invalid information in special cases, until there is no discrepancy between the multi-channel parsing results and the historical abnormal data, and obtaining the final multi-channel parsing results.

[0077] In this embodiment, historical anomaly data is acquired, and the multi-channel parsing results are compared with the historical anomaly data using feature matching. A similarity calculation is used to determine if any discrepancies exist. If a discrepancy exists, the target log information undergoes secondary parsing. Invalid information is excluded using rules, and this process is iteratively repeated until there is no discrepancy between the multi-channel parsing results and the historical anomaly data. Specifically, methods such as TF-IDF and Word2Vec can be used to vectorize the parsing results and the historical anomaly data. Cosine similarity calculation is used to determine if a discrepancy exists. If the similarity is lower than a preset value, a discrepancy is considered to exist. For cases where a discrepancy exists, secondary parsing can be performed by constructing an anomaly dictionary and optimizing parsing rules. Invalid information such as incorrect date formats and invalid characters is iteratively excluded. Finally, the parsed information is integrated and converted into the system's standard format for transmission.

[0078] For step S203, the code features in the code repository are matched with the exception feature information. At the same time, the location of the code that caused the exception is determined by analyzing information such as the file name and line number in the exception stack. Then, the location of the code in the code repository where the exception occurred is located.

[0079] In one embodiment, the step of accessing the code repository based on the exception stack information and the code features to locate the exception code and its location includes: accessing the code repository based on the code features; determining the exception code file name and line number based on the exception stack information, constructing exception code location rules based on the exception code file name, and generating exception code query conditions; performing parallel retrieval of the code repository using a distributed computing framework, matching the exception code query conditions with the code files in the code repository to obtain a list of suspected exception code files; performing secondary filtering on the list of suspected exception code files, extracting the features of each file in the list of suspected exception code files using static code analysis technology, calculating the similarity with the exception stack information, and determining that if the similarity exceeds a set threshold, it is an exception code file; locating the exception code and its specific location in the exception code file based on the line number, and generating an exception code location result. Specifically, this embodiment uses the MapReduce distributed computing framework to perform parallel retrieval of the code repository, uses the TF-IDF algorithm to calculate the similarity between the query conditions and the code files, selects files with a similarity greater than a preset value as suspected abnormal code files, and then performs static code analysis on the suspected abnormal code files. By extracting code features such as code complexity and cyclomatic complexity, the cosine similarity algorithm is used to calculate the similarity with the abnormal stack information. If the similarity exceeds the preset value, it is determined to be an abnormal code file. Then, the specific location of the abnormal code in the file is located according to the code line number in the abnormal stack.

[0080] This embodiment automates access to the code repository based on exception stack information and code characteristics, and uses a distributed computing framework to perform parallel retrieval of the code repository. This enables the rapid and accurate location of the specific line of code causing the exception. At the same time, it performs secondary filtering on the list of suspected abnormal code files. Through static code analysis technology and similarity calculation, it can accurately locate the position of the abnormal code, effectively reducing false positives and improving accuracy.

[0081] For step S204, the code change history is used to identify the personnel who handle the exception, which facilitates targeted notifications and reminders in the later stages and ensures the convenience of exception management.

[0082] In one embodiment, the step of obtaining the code update history data of the abnormal code, locating the developer information before the occurrence of the abnormality based on the code update history data, and identifying the corresponding developers as target objects includes: obtaining the version update history data of the code through the API interface of the code repository, wherein the update history data includes at least code commit records, developers, and commit times; searching in the update history data according to the time point of the abnormality occurrence to locate multiple code commit records before the abnormality occurrence; determining whether the interval between the commit time of each code commit record and the time point of the abnormality occurrence exceeds a set time threshold, and marking the code commit records with an interval less than the set time threshold as suspected abnormality initiation points; obtaining the developer information of the suspected abnormality initiation points, calculating a weight score for the developers based on their code commit frequency, code commit volume, and historical abnormality rate, and identifying developers whose scores exceed a set score threshold as target objects.

[0083] Specifically, this embodiment uses APIs provided by the code repository to obtain the version history data of the code. For example, code repositories such as GitHub, GitLab, and Gitee provide rich APIs that can be used to obtain data such as code commit records, developer information, and commit times. Code commit records contain the content of each code change and can trace the code modification history. Developer information can help understand which developers participated in the code modification, and the commit time records the time when each modification occurred. By calling the API, the version history data of a project in a code repository can be easily obtained. Searching through historical update data based on the time of an anomaly occurrence helps locate code commit records that may have caused the anomaly. By identifying multiple commit records with intervals less than a set threshold between their commit times and the anomaly occurrence, these are marked as potential anomaly initiation points, effectively narrowing the investigation scope and improving efficiency. Further analysis of developer information at these potential initiation points, specifically evaluating code quality based on metrics such as commit frequency, commit volume, and historical anomaly rate, calculates a weighted score for each developer. Developers whose scores exceed a set threshold are then identified as target individuals. This threshold can be adjusted based on actual circumstances and the team's code quality standards. This process quickly identifies developers who may have introduced the anomaly, facilitating subsequent code review and problem investigation.

[0084] For step S205, this embodiment targets the target parsing result obtained after parsing, and performs anomaly rating by extracting key information from the result. The anomaly rating can be used to determine the manner in which the notification occurs.

[0085] In one embodiment, the step of rating the anomaly based on the target parsing result, generating notification information based on the rating, the anomaly code, and its location, and sending the notification information to the target object includes: determining the severity and scope of the anomaly based on the target parsing result; using a rule engine to perform a graded evaluation of the anomaly to obtain an anomaly rating result; matching a preset notification method strategy based on the anomaly rating result to determine the appropriate notification channel; extracting key segments of the anomaly code and the location information of the key segments; automatically constructing anomaly notification information using natural language generation technology; matching the generated anomaly notification information with the notification channel; and distributing the anomaly notification information to the target object through the message queue of the notification channel. Specifically, based on the target analysis results, information such as the severity and scope of impact of the anomaly is extracted. A rule engine is used to classify and evaluate the anomaly, such as dividing the severity into levels and the scope of impact into three levels: individual, department, and company. A weighted calculation is used to obtain the anomaly rating result. Then, a preset notification strategy is matched based on the anomaly rating result; for example, anomalies rated 1-2 use email notifications, anomalies rated 3-4 use SMS + email, and anomalies rated 5 use telephone + SMS + email. Next, the location information of the anomaly code in the target analysis results is obtained. The anomaly code fragment and its context are accessed through the code repository API, key code fragments are extracted, and combined with anomaly stack information and anomaly rating, a sequence-to-sequence model is used to automatically generate anomaly notification information. Finally, the generated anomaly notification information is matched and distributed with notification channels. Furthermore, the sending status and receiving feedback of notification information can be monitored, and notifications that fail to send multiple times consecutively or are not read within a predetermined time can be retried or escalated. This embodiment not only improves the efficiency and accuracy of anomaly handling but also optimizes resource allocation.

[0086] In one embodiment, before sending the notification information to the target object, the method further includes: accessing an exception case library based on exception feature information, searching the exception case library for a processing solution corresponding to the exception feature information, and if such a solution exists, adding the processing solution to the notification information. This embodiment, by pre-searching for processing solutions in the exception case library, can directly provide solutions in the notification information, helping developers or other relevant personnel quickly understand and handle exception code. This avoids repetitive analysis and resolution processes caused by the repeated occurrence of the same or similar problems, saving time and resources and improving the system's usability.

[0087] Accordingly, after the step of sending the notification information to the target object, the method further includes: during the process of the target processing handling the exception, recording log information, the location information of the exception occurrence, the source code information that caused the exception, and the corresponding handling method, obtaining a new handling solution, and storing it in the exception case library. Specifically, this embodiment records the processing process to obtain a specific handling solution, and records log information, the location information of the exception occurrence, and the source code information that caused the exception, maps and associates them with the recorded handling solutions, generates search keywords, and stores them centrally. These keywords can be stored locally or on a cloud server. Later, when an exception is detected, the historical handling solutions stored locally or in the cloud are called by comparing the exception characteristics, and the handling solutions are synchronously sent to the developers. This provides a convenient auxiliary solution, accelerates the processing efficiency of high-frequency exception code, and improves the practicality of the system.

[0088] Those skilled in the art will understand that all or part of the processes in the methods of the above embodiments can be implemented by a computer program instructing related hardware. This computer program can be stored in a computer-readable storage medium, and when executed, it can include the processes of the embodiments of the methods described above. The aforementioned storage medium can be a non-volatile storage medium such as a magnetic disk, optical disk, or read-only memory (ROM), or random access memory (RAM).

[0089] It should be understood that although the steps in the flowcharts of the accompanying figures are shown sequentially as indicated by the arrows, these steps are not necessarily executed in the order indicated by the arrows. Unless explicitly stated herein, there is no strict order restriction on the execution of these steps, and they can be executed in other orders. Moreover, at least some steps in the flowcharts of the accompanying figures may include multiple sub-steps or multiple stages. These sub-steps or stages are not necessarily completed at the same time, but can be executed at different times, and their execution order is not necessarily sequential, but can be performed alternately or in turn with other steps or at least some of the sub-steps or stages of other steps.

[0090] Further reference Figure 3 As a response to the above Figure 2 The implementation of the method shown in this application provides an embodiment of a system anomaly location notification device, which is similar to... Figure 2 The method embodiments shown correspond to those described. For example... Figure 3As shown, the system anomaly location and notification device described in this embodiment includes: a log acquisition module 301, a log parsing module 302, an anomaly location module 303, an object determination module 304, and a notification sending module 305; wherein:

[0091] The log acquisition module 301 is used to acquire log information of the target system, determine the completeness of the log information, and if it is incomplete, acquire it again, temporarily store the complete log information in the target location, acquire log extraction parameters, and screen the target log information from the target location according to the log extraction parameters. The log parsing module 302 is used to perform multi-channel log parsing on the target log information, integrate the multi-channel parsing results, and obtain the target parsing result. The anomaly location module 303 is used to acquire anomaly feature information according to the target parsing result, acquire code features based on the anomaly feature information, read the anomaly stack information corresponding to the anomaly feature information, and access the code repository based on the anomaly stack information and the code features to locate the anomaly code and its location. The object determination module 304 is used to acquire the code change history data of the anomaly code, locate the developer information before the anomaly occurred based on the code change history data, and take the corresponding developer as the target object. The notification sending module 305 rates the anomaly according to the target parsing result, generates notification information according to the rate, the anomaly code and its location, and sends the notification information to the target object.

[0092] The system anomaly location and notification device provided in this application obtains anomaly feature information by performing multi-channel parsing on complete log information, then determines the anomaly code based on the anomaly feature information, and by obtaining the code change history data of the anomaly code, it can trace back to the developer information before the anomaly occurred, and provide targeted notifications and reminders, thereby improving the efficiency of anomaly problem resolution and ensuring the convenience of anomaly management.

[0093] In one embodiment, when the log acquisition module 301 acquires log extraction parameters and filters target log information from the target location based on the log extraction parameters, it is specifically used to: acquire original log information from the target location based on preset log extraction parameters; use regular expression matching to filter out log content that matches the log extraction parameters to obtain preliminary target log information; perform secondary filtering on the preliminary target log information; calculate the keyword score of each log by setting keyword weights; if the score exceeds a set threshold, the log is retained; otherwise, it is discarded to obtain accurate target log information.

[0094] In one embodiment, when the log parsing module 302 performs multi-channel log parsing on the target log information, it is specifically used to: use a distributed computing framework to perform multi-channel parallel parsing on the target log information, extract log features from the time dimension, spatial dimension, and business dimension, and obtain multi-channel parsing results.

[0095] Accordingly, before the log parsing module 302 integrates the multi-channel parsing results, it is further used to: cross-validate the initial multi-channel parsing results with historical abnormal data, determine whether there is a discrepancy through similarity calculation, and if there is a discrepancy, re-parse the target log information, iteratively exclude special invalid information, until the multi-channel parsing results and the historical abnormal data are indistinguishable, and obtain the final multi-channel parsing results.

[0096] In one embodiment, when the anomaly localization module 303 accesses the code repository based on the anomaly stack information and the code features to locate the anomaly code and its location, it is specifically configured to: access the code repository based on the code features; determine the anomaly code file name and line number based on the anomaly stack information, construct anomaly code localization rules based on the anomaly code file name, and generate anomaly code query conditions; perform parallel retrieval of the code repository using a distributed computing framework, match the anomaly code query conditions with the code files in the code repository, and obtain a list of suspected anomaly code files; perform secondary filtering on the list of suspected anomaly code files, extract the features of each file in the list of suspected anomaly code files using static code analysis technology, calculate the similarity with the anomaly stack information, and if the similarity exceeds a set threshold, determine it as an anomaly code file; locate the anomaly code and its specific location in the anomaly code file based on the line number, and generate an anomaly code localization result.

[0097] In one embodiment, when the object determination module 304 obtains the code iteration history data of the abnormal code and locates the developer information before the occurrence of the abnormality based on the code iteration history data, and selects the corresponding developer as the target object, it is specifically used as follows: obtaining the version iteration history data of the code through the API interface of the code repository, wherein the iteration history data includes at least code commit records, developers, and commit times; searching in the iteration history data according to the time point of the abnormality occurrence to locate multiple code commit records before the abnormality occurrence; determining whether the interval between the commit time of each code commit record and the time point of the abnormality occurrence exceeds a set time threshold, and marking the code commit records with an interval less than the set time threshold as suspected abnormality initiation points; obtaining the developer information of the suspected abnormality initiation points, calculating a weight score for the developers based on their code commit frequency, code commit volume, and historical abnormality rate, and identifying developers whose scores exceed a set score threshold as target objects.

[0098] In one embodiment, when the notification sending module 305 rates the anomaly based on the target parsing result, generates notification information based on the rate, the anomaly code, and its location, and sends the notification information to the target object, it specifically performs the following steps: determining the severity and scope of the anomaly based on the target parsing result; using a rule engine to perform a graded evaluation of the anomaly to obtain an anomaly rating result; matching a preset notification method strategy based on the anomaly rating result to determine the appropriate notification channel; extracting key fragments of the anomaly code and the location information of the key fragments and automatically constructing anomaly notification information using natural language generation technology; matching the generated anomaly notification information with the notification channel and distributing it to the target object through the message queue of the notification channel.

[0099] In one embodiment, before the notification sending module 305 sends the notification information to the target object, it is further configured to: access an anomaly case library based on the anomaly feature information, search in the anomaly case library for a processing solution corresponding to the anomaly feature information, and if such a solution exists, add the processing solution to the notification information.

[0100] Accordingly, the device also includes a case collection module (not shown), which is used to record log information, location information of the exception, source code information that caused the exception, and corresponding processing method during the process of the target processing handling the exception after the notification sending module 305 sends the notification information to the target object, so as to obtain a new processing solution and store it in the exception case library.

[0101] It should be noted that the beneficial effects of the system anomaly location notification device can be referred to the above method embodiments, and will not be elaborated here.

[0102] To address the aforementioned technical problems, embodiments of this application also provide a computer device. Please refer to [link / reference needed]. Figure 4 , Figure 4 This is a basic structural block diagram of the computer device in this embodiment.

[0103] The computer device 4 includes a memory 41, a processor 42, and a network interface 43 that are interconnected via a system bus. It should be noted that only the computer device 4 with memory 41, processor 42, and network interface 43 is shown in the figure; however, it should be understood that it is not required to implement all the components shown, and more or fewer components can be implemented alternatively. Those skilled in the art will understand that the computer device described here is a device capable of automatically performing numerical calculations and / or information processing according to pre-set or stored instructions. Its hardware includes, but is not limited to, microprocessors, application-specific integrated circuits (ASICs), programmable gate arrays (FPGAs), digital digital processors (DSPs), embedded devices, etc.

[0104] The computer device can be a desktop computer, laptop, handheld computer, or cloud server, etc. The computer device can interact with the user via a keyboard, mouse, remote control, touchpad, or voice control.

[0105] The memory 41 includes at least one type of readable storage medium, including flash memory, hard disk, multimedia card, card-type memory (e.g., SD or DX memory), random access memory (RAM), static random access memory (SRAM), read-only memory (ROM), electrically erasable programmable read-only memory (EEPROM), programmable read-only memory (PROM), magnetic memory, magnetic disk, optical disk, etc. In some embodiments, the memory 41 may be an internal storage unit of the computer device 4, such as the hard disk or memory of the computer device 4. In other embodiments, the memory 41 may also be an external storage device of the computer device 4, such as a plug-in hard disk, smart memory card (SMC), secure digital card (SD) card, flash card, etc., equipped on the computer device 4. Of course, the memory 41 may also include both the internal storage unit and its external storage device of the computer device 4. In this embodiment, the memory 41 is typically used to store the operating system and various application software installed on the computer device 4, such as the program code of the system anomaly location notification method. In addition, the memory 41 can also be used to temporarily store various types of data that have been output or will be output.

[0106] In some embodiments, the processor 42 may be a central processing unit (CPU), a controller, a microcontroller, a microprocessor, or other data processing chip. The processor 42 is typically used to control the overall operation of the computer device 4. In this embodiment, the processor 42 is used to run program code stored in the memory 41 or process data, for example, to run the program code for the system anomaly location notification method.

[0107] The network interface 43 may include a wireless network interface or a wired network interface, which is typically used to establish communication connections between the computer device 4 and other electronic devices.

[0108] This application also provides another embodiment, namely, providing a computer-readable storage medium storing computer-readable instructions that can be executed by at least one processor to cause the at least one processor to perform the steps of the system anomaly location notification method described above.

[0109] Through the above description of the embodiments, those skilled in the art can clearly understand that the methods of the above embodiments can be implemented by means of software plus necessary general-purpose hardware platforms. Of course, they can also be implemented by hardware, but in many cases the former is a better implementation method. Based on this understanding, the technical solution of this application, in essence, or the part that contributes to the prior art, can be embodied in the form of a software product. This computer software product is stored in a storage medium (such as ROM / RAM, magnetic disk, optical disk), and includes several instructions to cause a terminal device (which may be a mobile phone, computer, server, air conditioner, or network device, etc.) to execute the methods described in the various embodiments of this application.

[0110] Obviously, the embodiments described above are only some embodiments of this application, not all embodiments. The accompanying drawings show preferred embodiments of this application, but do not limit the patent scope of this application. This application can be implemented in many different forms; rather, the purpose of providing these embodiments is to provide a more thorough and comprehensive understanding of the disclosure of this application. Although this application has been described in detail with reference to the foregoing embodiments, those skilled in the art can still modify the technical solutions described in the foregoing specific embodiments, or make equivalent substitutions for some of the technical features. Any equivalent structures made using the content of this application's specification and drawings, directly or indirectly applied to other related technical fields, are similarly within the scope of patent protection of this application.

Claims

1. A system anomaly location and notification method, characterized in that, include: Obtain the log information of the target system, determine the integrity of the log information, and if it is incomplete, obtain it again and temporarily store the complete log information at the target location. Obtain log extraction parameters, screen target log information from the target location based on the log extraction parameters, perform multi-channel log parsing on the target log information, integrate the multi-channel parsing results, and obtain the target parsing result; Based on the target parsing result, obtain abnormal feature information, obtain code features based on the abnormal feature information, read the abnormal stack information corresponding to the abnormal feature information, and access the code repository based on the abnormal stack information and the code features to locate the abnormal code and its location. Obtain the code change history data of the abnormal code, locate the developer information before the abnormality occurred based on the code change history data, and take the corresponding developer as the target object. The anomaly is rated based on the target parsing result, and a notification message is generated based on the rating, the anomaly code and its location and sent to the target object. The step of obtaining the code change history data of the abnormal code, locating the developer information before the abnormality occurred based on the code change history data, and targeting the corresponding developers includes: The code repository's API interface is used to obtain the code version change history data, which includes at least code commit records, developers, and commit times. Based on the time point of the exception, the change history data is searched to locate multiple code commit records before the exception occurred. It is determined whether the interval between the commit time of each code commit record and the time point of the exception exceeds a set time threshold. Code commit records with an interval less than the set time threshold are marked as suspected exception initiation points. The developer information of the suspected exception initiation points is obtained, and a weighted score is calculated for the developers based on their code commit frequency, code commit volume, and historical exception rate. Developers whose scores exceed a set score threshold are identified as target objects.

2. The system anomaly location and notification method as described in claim 1, characterized in that, The steps for performing multi-channel log parsing on the target log information include: A distributed computing framework is used to perform multi-channel parallel parsing on the target log information, extracting log features from the time dimension, spatial dimension, and business dimension to obtain multi-channel parsing results; Prior to the step of integrating the multi-channel parsing results, the method further includes: The initial multi-channel parsing results are cross-validated with historical anomaly data. A similarity calculation is used to determine if there is a discrepancy. If a discrepancy exists, the target log information is re-parsed, and invalid information in special cases is iteratively excluded until the multi-channel parsing results and the historical anomaly data are indistinguishable, thus obtaining the final multi-channel parsing results.

3. The system anomaly location notification method as described in claim 1 or 2, characterized in that, Prior to the step of sending the notification information to the target object, the method further includes: Access the anomaly case database based on the anomaly feature information, search the anomaly case database for a processing solution corresponding to the anomaly feature information, and if a processing solution is found, add the processing solution to the notification information. After the step of sending the notification information to the target object, the method further includes: during the process of the target object handling the exception, recording log information, the location information of the exception occurrence, the source code information that caused the exception, and the corresponding handling method, obtaining a new handling solution, and storing it in the exception case library.

4. The system anomaly location and notification method as described in claim 3, characterized in that, The step of obtaining log extraction parameters and screening target log information from the target location based on the log extraction parameters includes: Based on preset log extraction parameters, the original log information is obtained from the target location. Regular expression matching is used to filter out the log content that matches the log extraction parameters to obtain preliminary target log information. The initial target log information is then filtered a second time. By setting keyword weights, the keyword score of each log is calculated. If the score exceeds a set threshold, the log is retained; otherwise, it is discarded to obtain accurate target log information.

5. The system anomaly location and notification method as described in claim 4, characterized in that, The step of accessing the code repository based on the exception stack information and the code characteristics to locate the exception code and its location includes: Access the code repository based on the code characteristics; Determine the exception code file name and line number based on the exception stack information, construct exception code location rules based on the exception code file name, and generate exception code query conditions; A distributed computing framework is used to perform parallel retrieval of the code repository. The abnormal code query conditions are matched with the code files in the code repository to obtain a list of suspected abnormal code files. The list of suspected abnormal code files is filtered a second time. Static code analysis technology is used to extract the features of each file in the list of suspected abnormal code files and calculate the similarity with the abnormal stack information. If the similarity exceeds a set threshold, it is determined to be an abnormal code file. Based on the line number, locate the exception code and its specific location in the exception code file, and generate the exception code location result.

6. The system anomaly location and notification method as described in claim 1, characterized in that, The step of rating the anomaly based on the target parsing result, generating notification information based on the rating, the anomaly code, and its location, and sending the notification information to the target object includes: Based on the target analysis results, the severity and scope of the anomaly are determined, and a rule engine is used to classify and evaluate the anomaly to obtain the anomaly rating result. Based on the anomaly rating results, a preset notification method strategy is matched to determine the appropriate notification channel; The key segments of the abnormal code and their location information are extracted, and natural language generation technology is used to automatically construct abnormal notification information. The generated exception notification information is matched with the notification channel, and the target object is distributed through the message queue of the notification channel.

7. A system anomaly location notification device, characterized in that, The device includes: The log acquisition module is used to acquire log information of the target system, determine the integrity of the log information, and if it is incomplete, acquire it again and temporarily store the complete log information at the target location. The log parsing module is used to obtain log extraction parameters, screen target log information from the target location based on the log extraction parameters, perform multi-channel log parsing on the target log information, integrate the multi-channel parsing results, and obtain the target parsing result. An anomaly localization module is used to obtain anomaly feature information based on the target parsing result, obtain code features based on the anomaly feature information, read the anomaly stack information corresponding to the anomaly feature information, and access the code repository based on the anomaly stack information and the code features to locate the anomaly code and its location. The object determination module is used to obtain the code update history data of the abnormal code, locate the developer information before the abnormality occurred based on the code update history data, and identify the corresponding developers as target objects. Specifically, it is used to obtain the version update history data of the code through the API interface of the code repository. The update history data includes at least code commit records, developers, and commit times. According to the time point of the abnormality, it searches in the update history data to locate multiple code commit records before the abnormality occurred. It determines whether the interval between the commit time of each code commit record and the time point of the abnormality exceeds a set time threshold. For code commit records with an interval less than the set time threshold, they are marked as suspected abnormality initiation points. It obtains the developer information of the suspected abnormality initiation points, calculates a weight score for the developers based on their code commit frequency, code commit volume, and historical abnormality rate, and identifies developers whose scores exceed a set score threshold as target objects. The notification sending module is used to rate the anomaly based on the target parsing result, generate notification information based on the rating, the anomaly code and its location, and send the notification information to the target object.

8. A computer device, characterized in that, The system includes a memory and a processor, wherein the memory stores computer-readable instructions, and the processor executes the computer-readable instructions to implement the system anomaly location notification method as described in any one of claims 1 to 6.

9. A computer-readable storage medium, characterized in that, The computer-readable storage medium stores computer-readable instructions, which, when executed by a processor, implement the system anomaly location notification method as described in any one of claims 1 to 6.

Images